Tag Archive for: threatens

Missouri Threatens to Sue a Reporter Who Flagged a Security Flaw

/in


Missouri Governor Mike Parson Thursday threatened to prosecute and seek civil damages from a St. Louis Post-Dispatch journalist who identified a security flaw that exposed the Social Security numbers of teachers and other school employees, claiming that the journalist is a “hacker” and that the newspaper’s reporting was nothing more than a “political vendetta” and “an attempt to embarrass the state and sell headlines for their news outlet.” The Republican governor also vowed to hold the Post-Dispatch “accountable” for the supposed crime of helping the state find and fix a security vulnerability that could have harmed teachers.

Despite Parson’s surprising description of a security report that normally wouldn’t be particularly controversial, it appears that the Post-Dispatch handled the problem in a way that prevented harm to school employees while encouraging the state to close what one security professor called a “mind-boggling” vulnerability. Josh Renaud, a Post-Dispatch web developer who also writes articles, wrote in a report published Wednesday that more than 100,000 Social Security numbers were vulnerable “in a web application that allowed the public to search teacher certifications and credentials.” The Social Security numbers of school administrators and counselors were also vulnerable.

“Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved,” the report said.

The Post-Dispatch seems to have done exactly what ethical security researchers generally do in these situations: give the organization with the vulnerability time to close the hole before making it public.

“The newspaper delayed publishing this report to give the department time to take steps to protect teachers’ private information and to allow the state to ensure no other agencies’ web applications contained similar vulnerabilities,” the article said. The news report was published one day after the “department removed the affected pages from its website.”

As of this writing, the DESE’s educator-credentials checker was “down for maintenance.”

Governor: Journalist Tried…

Source…

Missouri governor threatens to prosecute journalist for sharing web security flaw

/in


Missouri Governor Mike Parson might want to read up on the differences between disclosing and exploiting security flaws. According to The Missouri Independent, Parson accused a St. Louis Post-Dispatch reporter of being a “hacker” for having the audacity to… report security holes. The journalist disclosed a Department of Elementary and Secondary Education web app flaw that let anyone see over 100,000 teachers’ Social Security numbers in site source code, and Parson interpreted this as a “political game” meant to “embarrass the state” — that is, a malicious hack.







JEFFERSON CITY, MO - MAY 29: Gov. Mike Parson listens to a media question during a press conference to discuss the status of license renewal for the St. Louis Planned Parenthood facility on May 29, 2019 in Jefferson City, Missouri. Parson stated that the facility still had until Friday to comply with the state in order to renew the license. (Photo by Jacob Moscovitch/Getty Images)

© Jacob Moscovitch via Getty Images
JEFFERSON CITY, MO – MAY 29: Gov. Mike Parson listens to a media question during a press conference to discuss the status of license renewal for the St. Louis Planned Parenthood facility on May 29, 2019 in Jefferson City, Missouri. Parson stated that the facility still had until Friday to comply with the state in order to renew the license. (Photo by Jacob Moscovitch/Getty Images)

The governor has already referred the case to the Cole County Prosecutor, and even has the Missouri Highway State Patrol investigating. An attorney for The Post-Dispatch maintained that the reporter “did the responsible thing” by sharing the flaw with the government to get it fixed. The lawyer also helpfully refreshed Parson on his internet lingo. A hacker is someone who “subverts” security with sinister intent, not a reporter trying to bolster security by sharing publicly available information.

Loading...

Load Error

This flaw wasn’t recent, either. University of Missouri-St. Louis professor Shaji Khan told The Post-Dispatch that this kind of vulnerability had been known for “at least” 10 years, and that it was “mind boggling” the Department would let these problems linger. Audits in 2015 and 2016 had highlighted data collection issues at both the Department and school districts.

No, prosecutors probably won’t file charges. It’s a bit difficult to convict someone whose ‘hack’ effectively amounted to clicking “view page source” in their browser. However, this highlights an all-too-familiar problem with politicians that don’t understand tech. It doesn’t just lead to embarrassments, such as

Source…

Ransomware Attack Threatens Closings, Sensitive Client Data

/in


A ransomware attack on Cloudstar, which provides cloud hosting for title insurance applications, is threatening to derail mortgage closings and put sensitive client information at risk.

A ransomware attack on a company that provides cloud hosting for title insurance applications is threatening to derail closings and put sensitive client information at risk.

Cloudstar, which claims to operate the nation’s largest privately held settlement services cloud, first reported a “possible service interruption” affecting a “portion of our customers” on Friday, July 16.

Two days later, Cloudstar revealed that the company had in fact discovered on Friday that it “was the victim of a highly sophisticated ransomware attack.” In a Sunday, July 18, notice, Cloudstar said it had hired a third-party forensics expert, Tetra Defense, “to assist us in our recovery efforts and also informed law enforcement. Negotiations with the threat actor are ongoing.”

In another update Monday, the company said its Office 365 mail services, email encryption, and technical support services were “still fully operational and secure.”

On its website, Cloudstar says it operates six U.S. data centers, providing virtual desktop hosting and other services to more than 42,000 users.

Cloudstar says it offers cloud hosting for clients who use title insurance applications including SoftPro, RamQuest, ResWare, TitleExpress, Impact, RBJ Edge, Streamline, TitleScan, HalFile, LanTec, Double Time, Closer’s Choice and GreenFolders.

Cloudstars clients are title agents and other end users, not the software providers themselves, many of whom were quick to reassure clients.

SoftPro, for example, posted a notice on the company’s website Tuesday reassuring customers that the ransomware attack “has in no way impacted the functionality of SoftPro products or services. SoftPro was not breached or impacted in any way by this incident. Additionally, we have received no reports of impact from our integrated partners.”

Similarly, RamQuest said it had “not not been impacted by this ransomware attack as Cloudstar does NOT…

Source…

Cyberespionage malware threatens PH – Manila Bulletin

/in


A rare, wide-scale, cyberespionage malware now targets users in Southeast Asia, mostly in the Philippines.

Already, the advanced persistent threat (APT) campaign victimized 1,400 users in the Philippines, some of which were government entities, according to experts of cybersecurity firm Kaspersky.

Initial infection occurs via spear-phishing emails containing a malicious word document.

Once downloaded in one system, the malware spreads to other hosts through removable Universal Serial Bus (USB) drives.

Advanced persistent threat campaigns are highly targeted, often focusing on just a few dozen users are targeted, with surgical-like precision.

However, the recently uncovered APT was a rare, widespread threat campaign in Southeast Asia, Kaspersky stressed.

The malware, dubbed LuminousMoth, had been conducting cyberespionage attacks against government entities since October 2020, at least.

While initially focusing their attention on Myanmar, the attackers have since shifted their focus to the Philippines.

The attackers typically gain an initial foothold in the system through a spear-phishing email with a Dropbox download link.

Once clicked, this link downloads a RAR archive disguised as a Word document that contains the malicious payload.

Once downloaded on a system, the malware attempts to infect other hosts by spreading through removable USB drives.

If a drive is found, the malware creates hidden directories on the drive, where it then moves all of the victim’s files, along with the malicious executables.

The malware also has two post-exploitation tools that can in turn be used for lateral movement.

One consists of a signed, fake version of Zoom and another steals cookies from the Chrome browser.

Once on the device, LuminousMoth proceeds to exfiltrate data to the command and control (C2) server.

For the targets in Myanmar, these C2 servers were often domains that impersonated known news outlets.

Kaspersky experts attribute LuminousMoth to the HoneyMyte threat group, a long-standing, Chinese-speaking threat actor, with medium to high confidence.

HoneyMyte gathers geopolitical and economic intelligence in Asia and Africa.

…

Source…