Tag Archive for: poor

Poor security led to pathology hack | Information Age

/in


Pathology company Australian Clinical Labs has come under fire from Australia’s privacy watchdog for a 2022 cyber attack which saw credit card details and health records for more than 200,000 people leaked to the dark web.

The Office of the Australian Information Commissioner (OAIC) has taken ACL to court with allegations the company had “serious and systemic” failures leading to the attack.

In October of last year, while Australia had its focus on a landmark data breach at health insurer Medibank, the parent company of medical testing company Medlab – Australian Clinical Labs (ACL) – revealed it had suffered a significant cyber attack of its own.

The incident was largely overshadowed by similar happenings at Medibank and Optus, however, it saw the personal information of at least 223,269 individuals exposed to a hacker group known as Quantum, which exfiltrated 86GB of data including passport numbers, health information and credit card details.

Notably, the attack took place in February last year – eight months before being publicly confirmed by ACL.

Much of the stolen data appeared on the dark web in June 2022 – approximately four months prior to ACL’s public confirmation of the incident.

Serious allegations levied at ACL

The OAIC alleges ACL “seriously interfered with the privacy of approximately 21.5 million individuals”, whose personal information it held, by “failing to take reasonable steps” to protect said information from unauthorised access or disclosure.

In its concise statement, the commissioner notes ACL still does not know the precise time or method of the attack, but that it started “on or before” 25 Feb 2022 when Quantum attacked the Medlab computer network operated by ACL.

According to the statement, an employee discovered the attack at approximately 5:00am when they attempted to access a computer on the Medlab network, only to find a ransomware demand sitting on the desktop.

The employee soon after notified Medlab’s IT team, and by 9.00am the ransom note had appeared on other computers on the Medlab network in Brisbane and Sydney.

The OAIC notes ACL – which hit nearly $1 billion in revenue during financial year 2022 – did…

Source…

JBS’s cybersecurity was unusually poor prior to 2021 ransomware attack, internal homeland security records show

/in


Key takeaways

* JBS’s cybersecurity was “outside the typical range” for food production companies, experts told the federal government following the 2021 attack. (JBS did not respond to requests for comment.)

* Experts said the range of devices connected to the internet at food companies leaves them vulnerable.

* It’s difficult to gather information on cyberattacks, and they happen more often than what is reported, experts said.

A May 30, 2021, ransomware attack on JBS, one of the world’s largest meat companies, disrupted the company’s operations internationally and ended when the company paid an $11 million ransom to Russian hacker group REvil. 

While food production companies are potentially lucrative targets for cyberattacks, JBS was poorly protected against them compared to similar companies, according to cybersecurity experts.

The food and agriculture industry is designated as a Critical Infrastructure Sector by the U.S. Department of Homeland Security, meaning its “incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety.”

The whole industry is vulnerable to attacks like the one on JBS — and they happen quietly and often, according to John Hoffman, senior research fellow at the Food Protection and Defense Institute at the University of Minnesota. 

In the aftermath of the JBS ransomware attack, a representative of cybersecurity risk management firm BitSight told national security officials that JBS had “many many issues” with its computer system.

“Overall rating was poor and outside the typical range for Food Production companies,” wrote BitSight Vice President Jake Olcott in a June 2, 2021, email to Jeffrey Greene, who served as the National Security Council chief of cyber response and policy at the time. 

The emails obtained by Investigate Midwest via a public records request shed light on the federal government’s and private industry’s response to the JBS attack. 

“We’ve observed a massive number of malware infections on JBS over the last year (including Conficker),” Olcott wrote in the email. “JBS has been…

Source…

Ethical hacker discusses dangers of poor cybersecurity behaviors

/in


Smartphones and personal computers make access to bank accounts convenient for customers and hackers alike. To combat online threats, banks employ their own hackers

DAUPHIN COUNTY, Pa. — Smartphones and personal computers make access to bank accounts convenient for customers and hackers alike.

To combat online threats, banks employ their own hackers.

The Pennsylvania State Employee Credit Union has more than half a million members, making it the largest credit union in the Commonwealth.

And with so many accounts, online hacking attempts are just part of the workday.

“We’re seeing attacks come from China, from Russia, even North Korea, and we have to make sure those attacks don’t get through,” said Manager of Security Operations Scott Lenker.  

In order to protect customer information from prying eyes, Lenker uses his skills as a United States-certified ethical hacker.

“From a certified ethical hacker standpoint, we actually break into the systems, we make sure that we’re the first people to find the vulnerabilities, so if we break into and find the vulnerabilities, we’re able to fix it before the bad guys are able to get in,” said Lenker.

His proactive approach to cybersecurity is common among other ethical hackers that use their hacking skills for good, rather than for damage.

“It’s in the high 80s to low 90% of hackers out there who are financially motivated. Now there are other hackers that are trying to steal your personal information and they’re trying to use that for other nefarious reasons,” Lenker explained. 

Most hackers are able to manipulate a user’s online account through various means, regardless of a user’s protection plan.

Virtual private networks and two-factor authentication can be bypassed,…

Source…

Poor more prone to Aadhaar frauds

/in


Srinivas Kodali, an independent researcher and technology activist, believes that the guidelines recommended by the Supreme Court have been largely ignored because of the Government’s insatiable need for surveillance on citizens, wanting to know everything from their telecom details to hotel stays.

Kodali also explains that this applies to the private sector as well, where surveillance capitalism is the new buzzword and first-party data is being captured. Questions to be asked, Kodali says, are where is the money going, who is behind it, and who is vulnerable?

A close look at the frauds by technology activists and researchers reveals that monetary frauds are being carried out at various levels and are prevalent across the country with mostly the poor and the uneducated being the victims.

Cyber security expert Ritesh Bhatia says that fraudsters come in all shapes and sizes. Various media reports show that Business Correspondents, Common Service Centre agents, government staff and gangs running an organised crime syndicate are believed to be part of the racket. Business Correspondents are appointed by banks for providing banking and financial services. On the other hand, the Common Services Centre (CSC) programme is an initiative of the Ministry of Electronics and IT (MeitY), Government of India, and serves as an access point for the delivery of various electronic services to villages in India. The CSCs have been set up by the Ministry of Electronics & IT under the Companies Act, 1956 to oversee the implementation of the CSC scheme. But unfortunately, many of these staff have been found to be a part of the Aadhaar-enabled payment system or AePS-related frauds.

Kodali mentions that problems begin with the way Aadhaar has been designed. “I don’t know where and how I am using it. And this is a problem,” he says, pointing to news reports from Haryana where some fraudsters are believed to have stolen many if not all of the Haryana land registry fingerprints database. It is not just Haryana. Cases of AePS fraud are emanating from all over. Police in Mumbai, Jharkhand and Haryana, Uttar Pradesh, and Telangana have cases under investigation.

“The fingerprints are not just in the UIDAI…

Source…