A weekly aggregation of important cybersecurity and privacy news designed to educate, support, and advocate; helping you meet your data care challenges and responsibilities.
Stan’s Top of the News
Our lead stories this week are both about national security. As the first story describes, we are, indeed, in dangerous times. Cybercrime, privacy issues, national cybersecurity, disinformation … all are increasing at rates we’ve never seen. As the second story states, expect the White House to continue its push towards the strong cyber defense the nation needs.
- ‘One of the most dangerous times’ in cyber nears: The U.S. is entering a high-risk period with China and Russia in the cyber domain. … The United States and its allies are in a period of rising conflict with China and Russia that raises the risks in cyberspace, a top cyber expert told me at a Washington Post Live event Wednesday. … “I do think we’re about to enter probably one of the most dangerous times that we’ve had in the history of the cyber domain when it comes to our infrastructure here in the West, both because of what Russia may be doing against us as well as China, where we are both simultaneously entering a time of confrontation with both countries,” said Dmitri Alperovitch, founder of the Silverado Policy Accelerator. The Washington Post, October 20, 2022
- White House cyber director defends ‘tough’ national cybersecurity strategy ahead of release: National Cyber Director Chris Inglis is expected to release the Biden administration’s first comprehensive national cybersecurity strategy in the coming days, a document that many expect will meet industry pushback as it could expand the government’s role in protecting the nation’s digital infrastructure. … Early reports suggest that the strategy is far more demanding of industry than previous efforts, with one source telling CyberScoop in July that Inglis plans to “more forcefully use government power in the cyber arena.” … Asked to comment on the “tough” new strategy at the Cipher Brief Threat Conference last week in Sea Island, Georgia, Inglis vigorously defended the document. … “If tough means that we have to be serious about what we want cyberspace to do for us and to then be willing to make investments to achieve that and if the government is then willing to put its money where its mouth is by specifying in its own architectures what the non-discretionary attributes are and making investments to deliver those … then it’s time for us to be tough,” he said. “Because at the end of the day, something like market forces only takes us so far.” CyberScoop. October 17, 2022
Cyber Humor
Security Nonprofit of the Week … Cybercrime Support Network
- Our kudos this week to the Cybercrime Support Network, a nonprofit that helps individuals and small businesses impacted by cybercrime. As a leading voice for cybercrime victims, Cybercrime Support Network is dedicated to serving those affected by the ever growing impact of cybercrime before, during, and after. Founded in 2017, Cybercrime Support Network (CSN) connects victims to resources, increases cybercrime and online fraud reporting, and decreases revictimization. Since November 2018, CSN has provided help to over 1,000,000 individuals and small businesses via FightCybercrime.org and ScamSpotter.org. The Cybercrime Support Network is a member of Nonprofit Cyber, a coalition of implementation-focused cybersecurity nonprofits including SecureTheVillage.
Section 2 – Personal Data Care – Security and Privacy
Important data care stories for protecting yourself and your family.
Online real estate fraud is the personal side of Business Email Compromise (BEC). See the business section for the same crime affecting businesses, nonprofits, schools, and other organizations. Never transfer money online without positive confirmation.
- Hackers Target Eager Homebuyers With a Scam That Keeps Working: Criminals have found a novel way to intercept wire transfers for down payments. Can a small team of Secret Service agents prevent your worst real estate nightmare? … For weeks, the Secret Service agent had been trying to identify the scammers moving millions of stolen dollars through banks around the New York tri-state area. His quest had begun on a quiet afternoon in May 2020, when the streets of New York were still mostly empty. Cases were moving slowly, and legal processes were delayed. The agent was restless, trying to keep busy during what he thought would be a short-lived pandemic. Bloomberg, October 7, 2022
I’m seeing a lot more of these stories of online ‘friends’ and ‘lovers’ stealing large sums from their victims. Please be careful out there.
- A Text Scam Called ‘Pig Butchering’ Cost Her More Than $1.6 Million: Scammers swindle professionals with friendship to generate fake cryptocurrency investments. … The text message on Jane Yan’s mobile phone came from a number she didn’t recognize. “Are we going to the salon tonight?” It looked like the kind of mistake that can happen any day. … In fact, it was part of a continuing scam that cost U.S. victims more than $429 million in losses last year, according to the Internet Crime Complaint Center, the Federal Bureau of Investigation’s clearinghouse for consumer complaints about online crime. The Wall Street Journal, October 20, 2022
Section 3 – A Deeper Look for the Cyber-Concerned Citizen
Data Care, cybersecurity, and privacy stories to keep you informed.
As we near the 2022 elections, it’s no surprise to again see the Chinese government behaving badly.
- A Resurgent Chinese Cyber Espionage Group Hacked a U.S. State Legislature: Symantec recently warned about the return of a Chinese cyber espionage group behind cyber attacks on a U.S. state legislature. … The endpoint solutions company attributed the attack to APT27, also known as Budworm, Bronze Union, Emissary Panda, Lucky Mouse, Iron Tiger, and TG-3390 (Threat Group 3390). … Symantec did not disclose the state legislative body compromised by the Chinese hackers. … However, the company’s threat intelligence team disclosed that the hackers compromised a network used by employees and legislatures. CPO Magazine, October 22, 2022
- Chinese government hackers are scanning state political party headquarters, FBI says: Chinese government hackers are scanning U.S. political party domains ahead of next month’s midterm elections, looking for vulnerable systems as a potential precursor to hacking operations, and the FBI is making a big push to alert potential victims to batten down the hatches. … Over the past week, FBI agents in field offices across the country have notified some Republican and Democratic state party headquarters they might be targets of the Chinese hackers, according to party and U.S. officials, who spoke on the condition of anonymity because of the matter’s sensitivity. The Washington Post, October 17, 2022
This week’s biggest breach occurred at Medibank Private, one of Australia’s biggest health insurance providers.
- Medibank hack: what do we know about the data breach, and who is at risk?: It is thought someone gained access to the insurer’s systems using fake or compromised credentials to steal customer data, including medical information. … A major cybersecurity incident has occurred at Medibank Private just weeks after one-third of Australians had their information held to ransom in the Optus data breach. … As one of Australia’s biggest health insurance providers, Medibank holds information that includes intimate medical records, making the breach orders of magnitude more serious than the Optus hack. Guardian, October 20, 2022
Amplifying our lead story about how things are heating up, a part of the Internet was hit this week in what has been called an act of sabotage.
- Zscaler CEO: ‘Major’ EU Internet Cable Cut Was ‘Act Of Vandalism’: Cybersecurity firm tries to mitigate damage that’s disrupted Internet connectivity in Europe, U.S. and Asia. The severed cable has since been fixed. … Zscaler chief executive Jay Chaudhry is calling a severed fiber cable in the south of France an “act of vandalism” that’s been felt by Internet users around the world. … In an online notice posted on Wednesday, Zscaler, the San Jose, Calif.-based cybersecurity company, first warned of Internet problems due to a severed fiber line in the southern portion of France. … “We are aware of a major cable cut in the South of France that has impacted major subsea cables with connectivity to Asia, Europe, US and potentially other parts of the world,” Zscaler reported. “As a result of the cable cut, customers may see packet loss and or latency for websites and applications which traverse these impacted paths.” CRN, October 20, 2022
We have two very interesting — and very different — stories from Brian Krebs this week.
- Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn: On October 10, 2022, there were 576,562 LinkedIn accounts that listed their current employer as Apple Inc. The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at Amazon comes as LinkedIn is struggling to combat a significant uptick in the creation of fake employee accounts that pair AI-generated profile photos with text lifted from legitimate users. Krebs on Security, October 20, 2022
- How Card Skimming Disproportionally Affects Those Most In Need: When people banking in the United States lose money because their payment card got skimmed at an ATM, gas pump or grocery store checkout terminal, they may face hassles or delays in recovering any lost funds, but they are almost always made whole by their financial institution. Yet, one class of Americans — those receiving food assistance benefits via state-issued prepaid debit cards — are particularly exposed to losses from skimming scams, and usually have little recourse to do anything about it. Krebs on Security, October 18, 2022
In our next story, a former Wall Street Journal reporter is suing a law firm, claiming he was fired after the firm had his email hacked.
- Ex-WSJ reporter says he was framed in elaborate ‘hack-and-smear’ operation: A former Wall Street Journal reporter has sued a multinational law firm, some of its attorneys, and others for allegedly stealing his emails and spreading the messages to wrongly discredit him, leading to his firing. … In court documents, Jay Solomon, who was the newspaper’s chief foreign affairs correspondent until he was axed in 2017, accused 11 defendants including Philadelphia-based law firm Dechert of costing him his job and damaging his reputation. The Register, October 18, 2022
These next two stories illustrate the profound impact the emergence of quantum computing will have on how we use computers.
- The quantum computing threat is real. Now we need to act: Cybersecurity is a top national security concern facing America. At this very moment, adversaries are carrying out “store now, decrypt later,” or SNDL, attacks against the U.S., wherein they are exfiltrating and storing sensitive encrypted data critical to national security, critical infrastructure, corporate enterprises and more. The intention is to steal this sensitive data to decrypt it when quantum computers can decrypt this information. CyberScoop, October, 20, 2022
- New Research Report Predicts Blockchain and Quantum Threat Will Quickly Spread Beyond Cybercurrencies; Surge in New Product and Services Opportunities to Come: Research report identifies the challenges as well as the opportunities for new products and services that arise from the threat that quantum computers pose to the “blockchain” mechanism. … The report “The Quantum Threat to Blockchain: Emerging Business Opportunities” has been added to ResearchAndMarkets.com’s offering. This new research report identifies not only the challenges, but also the opportunities in terms of new products and services that arise from the threat that quantum computers pose to the “blockchain” mechanism. According to a recent study by the consulting firm Deloitte, approximately one-fourth of the blockchain-based cybercurrency Bitcoin in circulation in 2022 is vulnerable to quantum attack. DARK Reading, October 17, 2022
Two stories — from the US and Brazil — on the challenges of disinformation and managing online speech.
- How Disinformation Splintered and Became More Intractable: Ahead of the midterm elections, the proliferation of alternative social media sites has helped cement false and misleading information as a defining feature of American politics. … On the morning of July 8, former President Donald J. Trump took to Truth Social, a social media platform he founded with people close to him, to claim that he had in fact won the 2020 presidential vote in Wisconsin, despite all evidence to the contrary. … Barely 8,000 people shared that missive on Truth Social, a far cry from the hundreds of thousands of responses his posts on Facebook and Twitter had regularly generated before those services suspended his megaphones after the deadly riot on Capitol Hill on Jan. 6, 2021. … And yet Mr. Trump’s baseless claim pulsed through the public consciousness anyway. It jumped from his app to other social media platforms — not to mention podcasts, talk radio or television. … Within 48 hours of Mr. Trump’s post, more than one million people saw his claim on at least dozen other sites. It appeared on Facebook and Twitter, from which he has been banished, but also YouTube, Gab, Parler and Telegram, according to an analysis by The New York Times. The New York Times, October 20, 2022
- To Fight Lies, Brazil Gives One Man Power Over Online Speech: Brazilian authorities granted the country’s elections chief broad power to order the takedown of online content in a bid to combat soaring misinformation ahead of this month’s election. … Brazilian authorities, grappling with a torrent of online misinformation ahead of the country’s presidential election, granted the nation’s elections chief unilateral power to order tech companies to remove many online posts and videos — one of the most aggressive actions taken by any country to combat false information. … Under rules passed on Thursday, the elections chief can order the immediate removal of content that he believes has violated previous takedown orders. Social networks must comply with those demands within two hours or face the potential suspension of their services in Brazil. The New York Times, October 21, 2022
When I saw this headline, I was expecting to read about some obscure Texas privacy law passed perhaps in the late-1800s. Seems that in Internet time, a never-used law passed in 2009 qualifies as “long-dormant.” Long-dormant or not, it’s an important story as the states continue taking on the challenge of regulating privacy.
- A long-dormant Texas privacy law is finally being put to use against tech giants: When Texas passed a biometric privacy law in 2009, it was only the second state to have such a rule on its books. But the regulation laid dormant until this year, when the state’s attorney general brought a suit against Meta. … On Thursday, Attorney General Ken Paxton activated the law again, alleging that Google’s data practices violate the 2009 Capture or Use of Biometric Identifier (CUBI) Act. The move highlights the power a handful of key states now wield in a U.S. privacy policy debate that has seen little action on the federal level — and suggests that Texas might soon play a leading role. The Record, October 21, 2022
Section 4 – Information Security and Privacy Management in the Organization
Stories to support executives and top management in securing their organizations and protecting privacy.
Proofpoint has released their “2022 Board Perspective” report displaying a dangerous sense of being unprepared.
- Majority of Board Members Feel Their Organization Is at Risk of a Cyber Attack, but Almost Half Feel They Are Unprepared: Cybersecurity firm Proofpoint’s “2022 Board Perspective” finds that while most executive boards are now aware of the risks to their companies from cyber attacks, a worrying amount remain unprepared. … Globally, 65% of board members feel that their organization is at risk of a material cyber attack in the next 12 months. However, 47% also say that their company is unprepared for this eventuality. … The survey was taken in August and includes responses from 600 board directors at organizations that have at least 5,000 employees. Respondents were from about a dozen different countries and industries, with a roughly even mix of public and private sector. CPO, October 20, 2022
Here’s a reminder from WaPo on the dangers of Business Email Compromise (BEC). Please double check your processes to make sure you’re carefully managing this threat. Never transfer money online without positive confirmation. See our Personal Data Care section for a BEC story of home buyers getting scammed.
- This sneaky kind of cybercrime rules them all: As ransomware steals the headlines, another kind of cybercrime is quietly making off with far, far more money — and there are signs it’s on the rise, too. … In “business email compromise,” or BEC, criminals pose as someone a victim trusts, such as their company’s CEO, sometimes by hacking them and taking over their email. The criminals send an urgent message to transfer money, which they then pilfer. The Washington Post, October 21, 2022
Another story on the cybersecurity challenges faced by Chief Information Officers.
- Cybersecurity Tops the CIO Agenda as Threats Continue to Escalate: ‘If I get a budget challenge, it doesn’t come out of cyber,’ says Lesley Salmon, global chief information officer of Kellogg. … Chief information officers say cybersecurity once again will be their top investment priority in 2023, a sign of how companies are racing to manage the business risk posed by escalating threats. … Companies are facing an escalation in cyberattacks such as the 2021 Colonial Pipeline ransomware attack that affected Eastern U.S. fuel distribution. Hospital operator CommonSpirit Health disclosed this month an attack that downed systems and disrupted patient care. The FBI’s Internet Crime Complaint Center said it received a record 847,376 complaints in 2021, with potential losses exceeding $6.9 billion. The Wall Street Journal, October 17, 2022
Complimentary Admission to 7th Annual Official Cyber Security Summit Oct 27. A special Invitation to friends of SecureTheVillage from The Official Cyber Security Summit. For C-Suite/Senior Level Executives, Directors, Managers, and other IT/Cyber Professionals and Business Owners/Leaders.
- Learn how to protect yourself & your business from becoming a victim of cybercrime. Join us for the region’s 7th Annual Official Los Angeles Cyber Security Summit, rated Top 5 InfoSec Conference Worldwide, held on Thursday, October 27th, 2022.
- SecureTheVillage is a proud partner of this event & has secured Exclusive Complimentary Admission for our network! Register with code STV22 to secure your Free Pass at https://CyberSecuritySummit.com/summit/LosAngeles22/.
- Attend onsite at the Loews Santa Monica Beach Hotel to network & engage with colleagues and Industry Experts face-to-face. You will also enjoy a catered breakfast, lunch & cocktail reception. If you cannot attend in person, you may register to attend virtually.
