Individuals at Risk
Identity Theft
Ransomware, data breach, cyberattack: What do they have to do with your personal information, and how worried should you be?: The headlines are filled with news about ransomware attacks tying up organizations large and small, data breaches at major brand-name companies and cyberattacks by shadowy hackers associated with Russia, China and North Korea. Are these threats to your personal information? The Conversation, June 24, 2021
Cyber Privacy
Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax: Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by the end of this month. Krebs on Security, July 1, 2021
Data for 700 million LinkedIn users up for grabs on hacker forum: Information scraped from LinkedIn user profiles includes full names, gender, email addresses and phone numbers. WeLiveSecurity, June 29, 2021
The 5 most essential privacy tools of 2021 (so far, anyway): The year may be passing the halfway mark, but the race to invade your privacy is far from over. Mashable, June 27, 2021
Cyber Warning
Police warn of WhatsApp scams in time for Social Media Day: You might be forgiven for thinking that every day is social media day, given how much gets shared each day via social media services. NakedSecurity, June 30, 2021
Cyber Humor
Information Security Management for the Organization
Information Security Management
Ransomware: This new free tool lets you test if your cybersecurity is strong enough to stop an attack: CISA’s Ransomware Readiness Assessment allows organisations to test how well their networks can protect against and recover from ransomware attacks – and provides advice on improvements. ZD Net, July 2, 2021
CISA Publishes Catalog of Poor Security Practices: The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) is creating a catalog of poor security practices that increase risk for organizations, especially those supporting designated critical infrastructure or what it calls National Critical Functions (NCFs). DarkReading, June 29, 2021
Three Cyber Security Roles Today’s Enterprises Need: Cyber security continues to evolve from technology, process and people standpoints. To keep pace with these changes, organizations need to continually assess their cyber security posture and whether they have the talent they need to effectively protect the organization, its assets and stakeholders. Cyber Security Hub, June 22, 2021
Cyber Warning
PrintNightmare, the zero-day hole in Windows – here’s what to do: There’s a critical Windows bug out there that’s not only known by three different names, but also listed variously as having three different severities. NakedSecurity, June 30, 2021
Cyber Insurance
Ransomware Losses Drive Up Cyber-Insurance Costs: Ransomware payouts are putting the squeeze on cyber-insurance companies and resulting in higher premiums for organizations that want protection against the threat. Dark Reading, June 30, 2021
Cybersecurity in Society
Cyber Crime
Hacking Attack Likely Hit Thousands of New Targets: The ransomware group that collected an $11 million payment from meat producer JBS SA about a month ago has begun a widespread attack that has likely infected hundreds of organizations world-wide and tens of thousands of computers, according to cybersecurity experts. … The group, known as REvil, has focused its attack on Kaseya VSA, software used by large companies and technology-service providers to manage and distribute software updates to systems on computer networks, according to security researchers and VSA’s maker, Kaseya Ltd. msn News, July 3, 2021
SolarWinds hackers had access to Denmark’s central bank, report says: A group of Russian hackers is accused of compromising a Danish bank in the latest example of fallout involving cyber-espionage emanating from Moscow, according to a European media outlet that cites documents related to the incident. CyberScoop, June 30, 2021
When Ransomware Hackers Tried to Ruin Summer on Martha’s Vineyard: By 6 a.m. on the morning of Wednesday, June 2, Sean Driscoll knew something was wrong. When he checked his in-box, not one email had arrived overnight. “That’s always a bad sign for a communications director,” says Driscoll, who works for the Massachusetts Steamship Authority, the state-run operator of the only ferries equipped to carry cars between Cape Cod and the islands of Martha’s Vineyard and Nantucket. Driscoll and his colleagues discovered that the Steamship Authority’s ticketing website was down too. It was two days after Memorial Day, a time of year when the boats are suddenly packed with Vera Bradley–toting summerhousegoers and weekenders. By evening, cars stretched from Tisbury to Oak Bluffs, taking their chances in hopes of going standby aboard a ferry at Vineyard Haven, as Steamship agents wrote out tickets by hand. Intelligencer, June 26, 2021
Cyber Attack
How New Orleans Defeated Ransomware Attack: NEW ORLEANS, LOUISIANA – In the early hours of a Friday in December 2019, the team monitoring the computer network handling governmental operations for New Orleans noticed something suspicious. Voice of America, June 30, 2021
Zero-Day Used to Wipe My Book Live Devices: Threat actors may have been duking it out for control of the compromised devices, first using a 2018 RCE, then password-protecting a new vulnerability. ThreatPost, June 30, 2021
Gaming industry under siege from cyberattacks during pandemic: Cyberattacks targeting the gaming industry skyrocket, with web attacks more than tripling year-on-year in 2020 WeLiveSecurity, June 24, 2021
Cyber SURVEILLANCE
Feds Told to Better Manage Facial Recognition, Amid Privacy Concerns: A GAO report finds government agencies are using the technology regularly in criminal investigations and to identify travelers, but need stricter management to protect people’s privacy and avoid inaccurate identification. ThreatPost, June 30, 2021
Cyber Defense
Poor coordination hampers HHS cyber threat info sharing with industry: The Department of Health and Human Services doesn’t routinely share cyber threat information with private sector partners because the two centers responsible haven’t formalized coordination, according to the Government Accountability Office. FedScoop, June 29, 2021
National Cybersecurity
After Biden Meets Putin, U.S. Exposes Details of Russian Hacking Campaign: The revelations, which dealt with a Russian espionage campaign, came after President Biden demanded that President Vladimir V. Putin rein in more destructive ransomware attacks. The New York Times, July 1, 2021
The Cybersecurity 202: Angus King says it’s time to get tougher on Russian hackers:The United States should get far more aggressive at punching back against cyber adversaries including ransomware gangs operating in Russia, Sen. Angus King (I-Maine) says. The Washington Post, June 30, 2021
When Does a ‘Cyber Attack’ Demand Retaliation? NATO Broadens Its View: A set of “malicious cumulative cyber activities” may now amount to an armed attack. DefenseOne, June 30, 2021
Colonial Pipeline Hack Rockets Ransomware to Top of U.S. Security Agenda: Ransomware has rocketed to the top of the Biden administration’s agenda as cyberattacks launched from the soil of U.S. adversaries have started to bite into key critical infrastructure. MeriTalk, June 30, 2021
Financial Cybersecurity
We Infiltrated a Counterfeit Check Ring! Now What?: Imagine waking up each morning knowing the identities of thousands of people who are about to be mugged for thousands of dollars each. You know exactly when and where each of those muggings will take place, and you’ve shared this information in advance with the authorities each day for a year with no outward indication that they are doing anything about it. How frustrated would you be? KrebsOnSecurity, June 30, 2021
NFC Flaws Let Researchers Hack ATMs by Waving a Phone: Flaws in card reader technology let a security firm consultant wreak havoc with point-of-sale systems and more. Wired, June 24, 2021
Know The Enemy
NSA, FBI Reveal Hacking Methods Used by Russian Military Hackers: An ongoing brute-force attack campaign targeting enterprise cloud environments has been spearheaded by the Russian military intelligence since mid-2019, according to a joint advisory published by intelligence agencies in the U.K. and U.S. The Hacker News, July 1, 2021
Cyber Enforcement
FBI Muscles Up Against Hackers With Breaches Going ‘Bananas’: For the last several years, FBI agents debated turning the tables on hackers by remotely accessing breached computer networks and booting out the attackers caught in mid-hack. Bloomberg, June 30, 2021
International law enforcement take down DoubleVPN service allegedly used by ransomware gangs: (CNN)A group of international law enforcement agencies have taken down DoubleVPN, a virtual private networking service allegedly used by ransomware gangs to hide their online tracks, in a coordinated operation aimed at disrupting cyber criminals. CNN, June 30, 2021
DOJ files 7 new charges against alleged Capital One hacker: The U.S. Department of Justice (DOJ) has filed seven new charges against Paige Thompson, the former Amazon Web Services (AWS) engineer accused of hacking Capital One and stealing the personal data of more than 100 million Americans. TechCrunch, June 30, 2021
Cyber Research
NIST maps out the migration to post-quantum cryptography: To ease the migration from public-key cryptographic algorithms to quantum-resistant algorithms, the National Institute of Standards and Technology’s National Cybersecurity Center of Excellence (NCCOE) has released a draft document describing migration challenges and approaches for facilitating that migration. GCN, June 30, 2021
