This past week serves up a reminder why personal and medical data should be handled with care, as it’s among the most highly sought after and valuable for bad actors. Two of the biggest telecommunications providers in the world were also breached this week, which is what happens when you “phone in” cyber security.
Highlights from The Week in Breach:
- Unsecure Amazon S3 bucket strikes again! Hello… Verizon, can you hear me now?
- Unencrypted Healthcare Data.
- Learn about managed cybersecurity.
In Other News:
95% Success Rate GPS Spoofing
Researchers have successfully been able to launch GPS spoofing attacks on road navigation systems… a scary achievement. GPS spoofing systems have been around for a while but had previously been unable to trick humans into actually following the directions. The phone or GPS unit would give directions that didn’t make sense, such as abruptly turning off the road. The new and improved technology can now take into account the road layout while giving the driver wrong directions. As car manufacturers look toward a self-driving future, accurate GPS spoofing could lead to some unfortunate circumstances.
https://www.bleepingcomputer.com/news/security/researchers-mount-successful-gps-spoofing-attack-against-road-navigation-systems/
DDoS Siege
Gaming studio Ubisoft was the victim of a DDoS attack this week, leaving many of its most popular titles unplayable. The attacks lasted for several days and were focused on the game’s connections and server latency. This is not the first time a gaming studio has been targeted by a DDoS attack, as American studio Blizzard, known for their game World of Warcraft, experienced downtime last week due to the same issue. While the motive behind the attacks is unclear, what is certain is that these attacks are costing the companies that experience them a LOT of money.
https://cyware.com/news/ubisoft-hit-by-massive-ddos-attacks-affecting-far-cry-5-for-honor-and-other-games-d3efe5ab
Israel – Verizon – Exposed by Nice Systems
Exploit: Exposed Amazon S3 storage server, supply chain vulnerability.
Risk to Small Business: High: Supply chain breaches are increasingly blamed on the prime vendor as its their fiduciary responsibility to ensure the downstream vendors they use are secure. This one has global reach as many of the customers are US-based individuals.
Individual Risk: High: Could allow hackers to break into an exposed individual’s email account protected by 2FA.
Verizon: A U.S. based phone company that has over 108 million post-paid wireless customers.
Nice Systems: An Israeli based enterprise software company that has 85 of the Fortune 100 as customers.
Date Occurred/Discovered: Late June 2018
Date Disclosed: July 2018
Data Compromised:
https://www.zdnet.com/article/millions-verizon-customer-records-israeli-data/
Singapore – Ministry of Health
Exploit: Undisclosed at this time. Lack of advanced, real-time intrusion detection.
Risk to Small Business: High: Nation-state originated, this is a massive breach in both scope and severity; most business would not recover from this, especially due to the fines that many countries would levy on a business that did not secure healthcare data.
Individual Risk: High: Medical information is valuable on the Dark Web and can be used to impersonate or exploit an individual.
Ministry of Health: Singapore’s national health organization that manages the country’s public healthcare system.
Date Occurred/Discovered: June 27, 2018 – July 4, 2018
Date Disclosed: July 20, 2018
Data Compromised:
https://www.bleepingcomputer.com/news/security/hackers-stole-a-third-of-singapores-healthcare-data-including-prime-ministers/
Canada - CarePartners
Exploit: Unencrypted data-at-rest. Elevated privileged access. Unpatched vulnerability open for 2 years.
Risk to Small Business: High: Ransom and exfiltrate attacks are an increasingly common practice amongst cyber criminals and can be reputationally and monetarily damaging to an organization.
Individual Risk: Extreme: Health information is useful for identity theft and traded frequently on Dark Web market places.
CarePartners: An organization that provides home medical services for the Ontario government.
Date Occurred/Discovered: June 2018
Date Disclosed: June 2018… however this week, the hackers revealed that they had much more information than CarePartners revealed.
Data Compromised:
http://www.cbc.ca/news/technology/carepartners-data-breach-ransom-patients-medical-records-1.4749515
Something to think about:
How long could it take for your business to fail? Months of operating on a loss? Years of a bad employee costing you money? How about an hour. According to top researchers in the UK, more than HALF of UK small businesses could be hacked in less than an hour. Systems are put into place to prevent frivolous spending within an organization and to stop theft before it happens. Budgets are made, and doors are secured with locks. Why wouldn’t you do the same for cyber security? Especially when it could only take someone across the country, or even in a different country, less than an hour to cripple your business if you are not protected. You wouldn’t just eyeball your organization’s spending or leave your office’s door open at night. So again, the question is raised, why would you take a lackadaisical approach to cyber security? With the world becoming increasingly connected, it is important to proactively fight cyber-attacks with employee training and defense systems, monitor for Dark Web credential exposure with tools like dark web monitoring, a proactive IT strategy and to have a robust breach response plan in place.
https://www.silicon.co.uk/security/cyberwar/uk-businesses-hacked-cybersecurity-158970?inf_by=5b59ebc2671db87f7f8b4fd3
It's time for businesses to take threats seriously by proactively monitoring online exposure. You can start today with a Complimentary Strategic Planning Session from SimplifIT.