Monthly Archive May 2015

Information Security Breach Report – 07 May 2015

A round up of the most recent reports of information security breaches, infosec and privacy stories from around the world.

 

Breaches, Incidents and Alerts:

FireKeepers Casino investigates possible data breach – http://woodtv.com/2015/05/06/firekeepers-casino-investigates-possible-data-breach/

West coast gang robs banks with texts, phone calls – http://www.csoonline.com/article/2912473/cyber-attacks-espionage/west-coast-gang-robs-banks-with-texts-phone-calls.html#tk.rss_all

Tesla attack started with a single phone call – http://www.csoonline.com/article/2915963/disaster-recovery/tesla-attack-started-with-a-single-phone-call.html#tk.rss_all

Mobile ransomware targets Canadian porn viewers – http://www.csoonline.com/article/2918476/mobile-security/mobile-ransomware-targets-canadian-porn-viewers.html#tk.rss_all

More than 22 Thousand Finns Clicked WhatsApp Spam Today – https://www.f-secure.com/weblog/archives/00002809.html

Unknown hackers have stolen €4.6m from Ryanair bank accounts – http://securityaffairs.co/wordpress/36440/cyber-crime/ryanair-bank-accounts-hacked.html

Flawed password reset procedure exposes Betfair accounts – http://securityaffairs.co/wordpress/36449/hacking/password-reset-procedure-betfair.html

Why hackers target background investigation databases – http://securityaffairs.co/wordpress/36455/cyber-crime/hack-background-investigation-databases.html

SendGrid admits hack, says all customers must reset their passwords – http://venturebeat.com/2015/04/28/sendgrid-admits-hack-says-all-customers-must-reset-their-passwords/

Linux and BSD Web Servers Infected with ‘Mumblehard’ Malware – http://spamnews.com/The-News/Latest/Linux-and-BSD-Web-Servers-Infected-with-%E2%80%98Mumblehard%E2%80%99-Malware-2015050617778/

 

Miscellaneous Infosec stories:

Hacking Still Leading Cause of 2015 Health Data Breaches – http://healthitsecurity.com/news/hacking-still-leading-cause-of-2015-health-data-breaches

Report: IT managers not best leaders in breach crisis – http://www.csoonline.com/article/2912434/data-breach/report-it-managers-not-best-leaders-in-breach-crisis.html#tk.rss_all

Reporting cybercrime feels like ‘Groundhog Day’ – http://www.csoonline.com/article/2913836/data-breach/reporting-cybercrime-feels-like-groundhog-day.html#tk.rss_all

Zombie apps haunt BYOD workplaces – http://www.csoonline.com/article/2915533/mobile-security/zombie-apps-haunt-byod-workplaces.html#tk.rss_all

Cybercriminals borrow from APT playbook in attack against PoS vendors – http://www.csoonline.com/article/2918616/data-protection/cybercriminals-borrow-from-apt-playbook-in-attack-against-pos-vendors.html#tk.rss_all

PayIvy Sells Your Online Accounts Via PayPal – http://krebsonsecurity.com/2015/05/payivy-sells-your-online-accounts-via-paypal/

 

Tools, Tips and How it’s done:

Study: Firms not ready to respond to complex threats – http://www.csoonline.com/article/2913833/cyber-attacks-espionage/study-majority-of-firms-not-ready-to-respond-to-complex-threats.html#tk.rss_all

Having ‘the ear of the CEO’ is key to battling cyberthreats – http://www.csoonline.com/article/2913953/malware-cybercrime/having-the-ear-of-the-ceo-is-key-to-battling-cyberthreats.html#tk.rss_all

Key management is the biggest pain of encryption – http://www.csoonline.com/article/2914084/data-protection/key-management-biggest-pain-of-encryption.html#tk.rss_all

6 hard truths security pros must learn to live with – http://www.csoonline.com/article/2914738/data-protection/6-hard-truths-it-security-pros-must-learn-to-live-with.html#tk.rss_all

The hardware roots of trust – http://www.csoonline.com/article/2912486/vulnerabilities/the-hardware-roots-of-trust.html#tk.rss_all

Identity as an attack surface – http://www.csoonline.com/article/2911537/identity-access/identity-as-an-attack-surface.html#tk.rss_all

Malware remodeled: New tricks, new suits slamming enterprise resources [free registration required]- http://www.csoonline.com/article/2915397/malware-cybercrime/malware-remodeled-new-tricks-new-suits-slamming-enterprise-resources.html?nsdr=true

Professional hackers talk social engineering threats and security awareness – http://www.csoonline.com/article/2915925/data-protection/professional-hackers-talk-social-engineering-threats-and-security-awareness.html#tk.rss_all

CeWL v5.1 – Password Cracking Custom Word List Generator – http://www.darknet.org.uk/2015/04/cewl-v5-1-password-cracking-custom-word-list-generator/

Tinba – Yet another anti-sandbox tricks – https://www.f-secure.com/weblog/archives/00002810.html

An Insider’s Look at the History of Cybersecurity – http://now.avg.com/an-insiders-look-at-the-history-of-cybersecurity/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+avg-blogs+%28AVG+Blogs%29

 

Miscellaneous Privacy stories:

How the top social networks compare on privacy — in one handy chart – http://www.csoonline.com/article/2915643/privacy/how-the-top-social-networks-compare-on-privacy-in-one-handy-chart.html#tk.rss_all

The Truth About Smartphone Apps That Secretly Connect to User Tracking and Ad Sites – http://www.technologyreview.com/view/537186/the-truth-about-smartphone-apps-that-secretly-connect-to-user-tracking-and-ad-sites/

 

Safeguarding Children and School E-Safety stories:

The dirty secrets of webcam-hacking peeping toms and sextortionists – http://www.welivesecurity.com/2015/04/21/webcam-hacking/

Canadian woman accused of remotely taking over victims’ PCs and spying on them using webcams – http://securityaffairs.co/wordpress/36422/cyber-crime/woman-spying-through-webcams.html

Online Safety – Protecting our children from Radicalisation and

Extremism – http://www.saferinternet.org.uk/Content/Childnet/SafterInternetCentre/downloads/Online_Safety_-_LSCB_bulletin_-_Radicalisation.pdf

60% of Parents Fear their Child is Visiting Pornography Sites Online – http://www.informationsecuritybuzz.com/60-of-parents-fear-their-child-is-visiting-pornography-sites-online/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+InformationSecurityBuzz+%28Information+Security+Buzz%29

 

If you would like this report sent to your inbox each morning, email me at jon.fisher@srm-solutions.com

You can see all previous issues of this blog at http://blog.srm-solutions.com/

or www.jonfisherthoughts.co.uk

My Linkedin Profile is uk.linkedin.com/in/jonfisher99/

Information Security Breach Report – 06 May 2015

A round up of the most recent reports of information security breaches, infosec and privacy stories from around the world.

 

Breaches, Incidents and Alerts:

CozyDuke hackers targeting prominent US targets – http://www.theregister.co.uk/2015/04/22/cozyduke_hackers_white_house_state_dept_malware/

USIS data breach affected more than 27K – http://thehill.com/policy/cybersecurity/239732-dem-usis-data-breach-affected-more-than-27k

St. Vincent Medical Group notifies patients after successful phishing attempt compromises PHI – http://www.databreaches.net/in-st-vincent-medical-group-notifies-patients-after-successful-phishing-attempt-compromises-phi/

Costa Coffee Club warns of possible database intrusion – https://nakedsecurity.sophos.com/2015/04/22/costa-coffee-club-warns-of-possible-database-intrusion/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+nakedsecurity+%28Naked+Security+-+Sophos%29MI

Hyatt Gold Passport notifies a small number of loyalty program members of possible breach (update2) – http://www.databreaches.net/hyatt-gold-passport-notifies-a-small-number-of-loyalty-program-members-of-possible-breach/

Hackers hit Wake public schools server – http://www.wral.com/hackers-hit-wake-public-schools-server/14599060/

Verifone statement on default password Z66831 – http://www.databreaches.net/verifone-statement-on-default-password-z66831/

Seton Family Health notifying 39,000 patients after employee falls for phish; Second Ascension Health member to report breach this week (Update2) – http://www.databreaches.net/seton-family-health-notifying-39000-patients-after-employee-falls-for-phish-second-ascension-health-member-to-report-breach-this-week/

Update on Security Incident and Additional Security Measures – https://sendgrid.com/blog/update-on-security-incident-and-additional-security-measures/

Compass Group USA notifies consumers of NEXTEP-related payment card breach – http://www.compass-usa.com/pages/KioskUpdate.aspx

Oregon’s Health CO-OP Notifies Affected Plan Members Of Security Incident – http://www.databreaches.net/oregons-health-co-op-notifies-affected-plan-members-of-security-incident/

Big Credit Card Data Breach Hits Bars And Restaurants Using Harbortouch Point-of-Sale Systems – http://consumerist.com/2015/05/05/big-credit-card-data-breach-hits-bars-and-restaurants-using-harbortouch-point-of-sale-systems/

VA blocks more than a billion cyber threats in March – http://www.upi.com/Top_News/US/2015/05/05/VA-blocks-more-than-a-billion-cyber-threats-in-March/1391430841755/

Lawyers threaten researcher over key-cloning bug in high-security lock – http://arstechnica.com/security/2015/05/05/lawyers-threaten-researcher-over-key-cloning-bug-in-high-security-lock/

Attackers Used CareerBuilder to Send Malicious Resumes to Victims: Proofpoint – http://www.securityweek.com/attackers-used-careerbuilder-send-malicious-resumes-victims-proofpoint?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Securityweek+%28SecurityWeek+RSS+Feed%29

Skype vulnerable to “Redirect to SMB” – http://infosecaffairs.blogspot.in/2015/05/skype-vulnerable-to-redirect-to-smb.html

More Uber Accounts Have Been Hacked, This Time in the United States – http://motherboard.vice.com/read/more-uber-accounts-have-been-hacked-this-time-in-the-united-states

EllisLab Tells Users to Change Passwords After its Web Host Discovers Security Breach – http://www.thewhir.com/web-hosting-news/ellislab-tells-users-change-passwords-web-host-discovers-security-breach

‘Rombertik’ malware kills host computers if you attempt a cure – http://www.theregister.co.uk/2015/05/05/rombertik_malware/

Sally Beauty investigates possible second card breach – http://www.pcworld.com/article/2918652/sally-beauty-investigates-possible-second-card-breach.html

Hard Rock Hotel & Casino reveals data breach – http://www.nafcu.org/News/2015_News/May/Hard_Rock_Hotel___Casino_reveals_data_breach/

 

Miscellaneous Infosec stories:

The hotly disputed black magic of data breach cost estimates – http://fortune.com/2015/04/24/data-breach-cost-estimate-dispute/

More than 1 year after breach, data show up for sale on darknet – http://www.databreaches.net/more-than-1-year-after-breach-data-show-up-for-sale-on-darknet/

Taking out cyber insurance cover to become ‘the norm’ within 10 years, says ABI – http://www.out-law.com/en/articles/2015/may/taking-out-cyber-insurance-cover-to-become-the-norm-within-10-years-says-abi/

Lawsuit: Home Depot data breach was caused by management’s ‘overarching complacency’ over security – http://www.bizjournals.com/atlanta/news/2015/05/05/lawsuit-home-depot-data-breach-was-caused-by.html

Spending More on Breach Prevention Isn’t Fixing the Problem – http://www.infosecurity-magazine.com/news/spending-more-on-breach-prevention/

Firms ‘at risk of data breach’ – http://www.irishexaminer.com/business/firms-at-risk-of-data-breach-328950.html

Security Breach Detection, Prevention Harder Than 2 Years Ago Despite Security Spending: Survey – http://www.securityweek.com/security-breach-detection-prevention-harder-2-years-ago-despite-security-spending-survey

SHARED INFRASTRUCTURE AND THE RISK TO OUR DATA – http://www.thatchers.co.uk/blog/blog/cyber-security/shared-infrastructure-and-the-risk-to-our-data

The Top 10 Highest Paying Jobs in Information Security – Part 1 – http://www.tripwire.com/state-of-security/off-topic/the-top-10-highest-paying-jobs-in-information-security-part-1/

Data security in the payments ecosystem – http://www.net-security.org/secworld.php?id=18344&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+HelpNetSecurity+%28Help+Net+Security%29

Analogue modems allow UNSTOPPABLE Android attack … at 13bps – http://www.hp.com/make-it-matter/uk/en/smart-telcos.html?jumpid=ba_yfgpei6u4r

 

 

Tools, Tips and How it’s done:

Local Administrator Password Solution aims to stop credential replay – http://searchsecurity.techtarget.com/news/4500245671/Local-Administrator-Password-Solution-aims-to-stop-credential-replay

Deconstructing Mobile Fraud Risk – http://www.darkreading.com/attacks-breaches/deconstructing-mobile-fraud-risk/a/d-id/1320248

Facepwn: Script Kiddies Beware – http://thecryptosphere.com/2015/05/05/facepwn-script-kiddies-beware/

Defending Against Web Attacks: X-XSS Protection – http://resources.infosecinstitute.com/defending-against-web-attacks-using-http-headers-part-2/

 

Miscellaneous Privacy stories:

THE COMPUTERS ARE LISTENING – HOW THE NSA CONVERTS SPOKEN WORDS INTO SEARCHABLE TEXT – https://firstlook.org/theintercept/2015/05/05/nsa-speech-recognition-snowden-searchable-text/

 

Safeguarding Children and School E-Safety stories:

Mom Horrified After Kids’ Photos Stolen From Facebook – https://www.yahoo.com/parenting/mom-horrified-after-kids-photos-stolen-from-118210047777.html

Administrators Confront Student ‘Sexting’ – http://www.edweek.org/ew/articles/2009/06/17/35sexting_ep.h28.html

New Research Reveals Teens’ Near-Constant Use of Online Sites, Tools – http://blogs.edweek.org/edweek/DigitalEducation/2015/04/new_research_explores_teens_mobile_device_use_social_media.html

Anti-terror guidance for colleges and teachers published – https://www.tes.co.uk/news/further-education/breaking-news/anti-terror-guidance-colleges-and-teachers-published

 

If you would like this report sent to your inbox each morning, email me at jon.fisher@srm-solutions.com

You can see all previous issues of this blog at http://blog.srm-solutions.com/

or www.jonfisherthoughts.co.uk

My Linkedin Profile is uk.linkedin.com/in/jonfisher99/

SRM Blog

SRM Blog