Cybersecurity News of the Week, August 4, 2024

This week’s essential cybersecurity and privacy news for the cyber-aware and the cyber-concerned. Designed to educate, support, and advocate.

Stan’s Corner

We’re now into the 3rd week of the Crowdstrike debacle. The financial losses among the big guys are becoming clearer. The lawsuits are lining up. It’s time to take a deep look at how we can do better. That’s the fourth story below, the one by Bruce Schneier and Tarah Wheeler: Let’s start treating cyber security like it matters. From the Federal government to the little shop on the corner, it’s beyond time to start treating cybersecurity like it matters. We need laws and regulations to set standards and hold organizations accountable. We also need a campaign to engage the people in keeping their information secure and in demanding that the organizations they share it with do likewise.

• Delta CEO Says CrowdStrike Tech Outage Cost It $500 Million: The airline notifies CrowdStrike, Microsoft to prepare for litigation after it canceled thousands of flights over several days in July. … Delta Air Lines Chief Executive Ed Bastian said the carrier took a $500 million hit from the CrowdStrike technology outage that hurt its operations. … Delta has hired prominent litigator David Boies, chairman of the firm Boies Schiller Flexner, and notified CrowdStrike and Microsoft to prepare for litigation, according to letters reviewed by The Wall Street Journal.
• CrowdStrike is sued by shareholders over huge software outage: CrowdStrike has been sued by shareholders who said the cybersecurity company defrauded them by concealing how its inadequate software testing could cause the July 19 global outage that crashed more than 8 million computers. … In a proposed class action filed on Tuesday night in the Austin, Texas federal court, shareholders said they learned that CrowdStrike’s assurances about its technology were materially false and misleading when a flawed software update disrupted airlines, banks, hospitals and emergency lines around the world. … They said CrowdStrike’s share price fell 32% over the next 12 days, wiping out $25 billion of market value.
• CrowdStrike Outage Could Cost Cyber Insurers $1.5 Billion Most Claims Will Be Made Under ‘Systems Failure’ Coverage, Says Moody’s Ratings. … The global IT outage triggered by a faulty CrowdStrike software update on July 19 could lead to cyber insurers paying out up to $1.5 billion in compensation. … That’s the conclusion of cyber risk analytics platform CyberCube, which in a Thursday report said the insurer losses range from $400 million to $1.5 billion. Those figures represent 3% to 10% of the $15 billion in global cyber premiums held today.
• Let’s start treating cyber security like it matters: That means a real investigatory board for cyber incidents, not the hamstrung one we’ve got now. … When an airplane crashes, impartial investigatory bodies leap into action, empowered by law to unearth what happened and why. But there is no such empowered and impartial body to investigate CrowdStrike’s faulty update that recently unfolded, instead ensnarling banks, airlines, and emergency services to the tune of billions of dollars. We need one.

From SecureTheVillage

• Smaller business? Nonprofit? Take your security to the next level. Apply Now! If you’re a small business or nonprofit in the greater Los Angeles area, apply NOW for LA Cybersecure. Protect your organization with our innovative team-based learn-by-doing program with coaching and guidance that costs less than two cups of coffee a week.
• IT Service Provider / MSP? Take your client’s security to the next level. Apply Now!  If you’re an IT service provider in the greater Los Angeles area, apply NOW for LA Cybersecure. With our innovative team-based learn-by-doing program, you’ll have both that “seat at the table” and the peace of mind that you’re providing your clients with the IT security management they need. The LA Cybersecure Program is funded in part by a grant from the Center for Internet Security (CIS) Alan Paller Laureate Program.
• Family Protection Newsletter: Did you know we created the Family Protection Newsletter for non-cyber experts? For your parents, friends, those who need to protect themselves in a digital world. Sign up or share with a friend! Click here to learn more and quickly add to your free subscription! 
• How Hackable Are You? Think your defenses are strong. Find out as SecureTheVillage tests you on five basic controls and download our free updated 13-step guide.
• Please Support SecureTheVillage: We need your help if we’re to build a world of CyberGuardians ^TM. Please donate to SecureTheVillage. Thank you. It takes a village to secure the village. ^TM. 

Cybersecurity Nonprofit of the Week … The Global Anti-Scam Alliance

Our kudos this week to the Global Anti-Scam Alliance. Their mission is to create a world where people worldwide are safe from the financial and emotional trauma caused by online scams. To protect consumers worldwide from scams. GASA realizes its mission by raising awareness, enabling hand-on tools for consumers and law enforcement, facilitating knowledge sharing, organizing research, supporting the development of (legal) best practices, and offering training and education. Like SecureTheVillage, the Global Anti-Scam Alliance is a fellow-member of Nonprofit Cyber.

Cyber Humor

Section 2: Let’s Be Careful Out There. And Let’s Help Others Who Aren’t Yet Cyber-Aware. 

Please share this story of broken dreams with the people you love.

• How One Man Lost $740,000 to Scammers Targeting His Retirement Savings: Criminals on the internet are increasingly going after Americans over the age of 60 because they are viewed as having the largest piles of savings. … For nearly three months, Barry Heitin, a 76-year-old retired lawyer, thought he was part of a government investigation that felt like something out of the movies. He was actually assisting criminals in stealing hundreds of thousands of dollars — of his own money. … Last fall, he spent just about every weekday doing the legwork and making withdrawals from his bank accounts as part of an intricate scam: He believed he was helping the feds safeguard his money and catch thieves who were after it.

Always be suspicious.

• Scammers are taking to the skies, posing as airline customer service agents: Scammers are always looking for new ways to target vulnerable people. Now they’re taking to the skies. … The scammers are now lurking on social media, looking for posts from upset travelers dealing with flight cancellations and delays, and posing as airline customer service agents, the Federal Trade Commission warned in a recent alert.
• Threat actor impersonates Google via fake ad for Authenticator: We have previously reported on the brand impersonation issue with Google ads: users who search for popular keywords are shown malicious ads that purport to be from an official vendor. … Not only does this trick innocent victims into downloading malware or losing their data to phishing sites, it also erodes trust in brands and by association in Google Search itself. … Today, we show yet another example of brand misuse, except that this one targets Google itself.

Section 3: Cybersecurity and Privacy News for the Cyber-Concerned.

From the nation’s Capital. The New York Times piece on the Kids Online Safety Act illustrates the deep challenges in writing a good law.

• How the Kids Online Safety Act Was Dragged Into a Political War: The Senate overwhelmingly passed the Kids Online Safety Act on Tuesday, but the legislation faces an uphill battle in the House because of censorship concerns. … Last week, the American Civil Liberties Union sent 300 high school students to Capitol Hill to lobby against the Kids Online Safety Act, a bill meant to protect children online. … The teenagers told the staffs of 85 lawmakers that the legislation could censor important conversations, particularly among marginalized groups like L.G.B.T.Q. communities. … “We live on the internet, and we are afraid that important information we’ve accessed all our lives will no longer be available,” said Anjali Verma, a 17-year-old rising high school senior from Bucks County, Pa., who was part of the student lobbying campaign. “Regardless of your political perspective, this looks like a censorship bill.”
• U.S. Sues TikTok, Alleging It Violated Child Privacy Law: Justice Department says the social-media platform failed to comply with parent requests to delete children’s personal information. … WASHINGTON—The U.S. government sued TikTok on Friday, alleging the Chinese-owned social-media company knowingly and repeatedly failed to protect the privacy of children. … The complaint, brought by the Justice Department in coordination with the Federal Trade Commission, accused TikTok of failing to comply with the Children’s Online Privacy Protection Act. That 1998 law requires internet companies to provide parental notification and obtain parental consent before collecting personal information from children under the age of 13.

A Wall Street Journal expose of enslaved people forced to scam.

• Posing as ‘Alicia,’ This Man Scammed Hundreds Online. He Was Also a Victim: A multibillion-dollar cyberfraud industry operating out of Southeast Asia relies on forced labor and torture. … MAE SOT, Thailand—In late December, Guracha Belachew Bersha helped lead a small but brazen rebellion. … He’d been enslaved for 16 months in a twisted new criminal empire in which Chinese gangsters traffic people from around the world, often to remote and lawless parts of Southeast Asia, and force them to sit at computers all day scamming strangers online. The cyber frauds they’re forced to commit are called pig butchering, named for the way the perpetrators fatten up their victims by gaining their trust before taking their money and cutting them loose. … Behind the scenes, the scammers are victims too.

Google’s changing the rules in an attempt to rid the world of non-consensual explicit deepfakes.

• Google makes it easier for victims to have non-consensual explicit deepfakes removed but won’t downrank top deepfake sites unless victims mass report: Today, Google announced new measures to combat the rapidly increasing spread of AI-generated non-consensual explicit deepfakes in its search results. … Google made it easier for targets of fake explicit images—which experts have said are overwhelmingly women—to report and remove deepfakes that surface in search results. Additionally, Google took steps to downrank explicit deepfakes “to keep this type of content from appearing high up in Search results,” the world’s leading search engine said.

Is this $75M ransomware payment the new GOAT?

• Fortune 50 Co. Pays Record-Breaking $75M Ransomware Demand: The runaway success of an upstart ransomware outfit called “Dark Angels” may well influence the cyberattack landscape for years to come. … A Fortune 50 company paid $75 million to its cyberattackers earlier this year, greatly exceeding any other confirmed ransom payment in history. The beneficiary of the payout is an outfit called Dark Angels. And Dark Angels isn’t just effective — in some ways, the gang turns so much of what we thought we knew about ransomware on its head.

This week in cybercrime. Lives at risk as US blood center recovers from ransomware.

• Ransomware attack on major US blood center prompts hundreds of hospitals to implement shortage protocols: One of the largest blood centers in the U.S. is operating at reduced capacity after ransomware hackers shut down parts of its system. … Nonprofit OneBlood, which provides blood to healthcare facilities across the southeast, released a statement on Wednesday warning the public that the ransomware attack is impacting their ability to operate.
• HealthEquity says data breach impacts 4.3 million people: HSA provider HealthEquity has determined that a cybersecurity incident disclosed earlier this month has compromised the information of 4,300,000 people. … HealthEquity, one of the largest HSA custodians in the U.S., specializes in providing health savings accounts (HSAs), flexible spending accounts (FSAs), health reimbursement arrangements (HRAs), and 401(k) retirement plans. … In a Form 8-K filing submitted on July 2, 2024, the company disclosed that threat actors stole members’ sensitive health data using a partner’s compromised credentials.
• Jerico Pictures Inc., operating as National Public Data, exposed the personal information of nearly 3 billion individuals in an April data breach: A proposed class action claims that Jerico Pictures Inc., operating with the National Public Data, exposed the personal information of nearly 3 billion individuals in a data breach that occurred in April.
• Hackers directly email customers of immigration firm after damaging cyberattack: A prominent U.K.-based company offering immigration services and legal resources for those with international businesses warned officials in multiple countries that a recent cyberattack may have exposed sensitive customer information. … Sable International, which has offices in the U.K., Australia and South Africa, released several statements this week about a “sophisticated” cyberattack that caused a range of issues. 

Section 4: Helping Executives Understand Why and Know How.

• Crucial Lessons Learned For Cybersecurity Resilience: “This event underscores the need for robust incident response plans and resilience strategies,” emphasized John Chirhart, founder and CEO of GTG.Online.

Section 5:  Securing the Technology.

• DigiCert to Revoke 83,000+ SSL Certificates Due to Domain Validation Oversight: Certificate authority (CA) DigiCert has warned that it will be revoking a subset of SSL/TLS certificates within 24 hours due to an oversight with how it verified if a digital certificate is issued to the rightful owner of a domain. … The company said it will be taking the step of revoking certificates that do not have proper Domain Control Validation (DCV).