Cyber Security Roundup for November 2018

One of the largest data breaches in history was announced by Marriott Hotels at the end of November. A hack was said to have compromised up to a mind-blowing "half a Billion" hotel guests' personal information over a four year period.  See my post, Marriott Hotels 4 Year Hack Impacts Half a Billion Guests for the full details. The Radisson Hotel Group also disclosed its Rewards programme suffer a data compromise. Radisson said hackers had gained access to a database holding member's name, address, email address, and in some cases, company name, phone number, and Radisson Rewards member number.

Vision Direct reported a website compromise, which impacted users of their website between 3rd and 8th November, some 16,300 people were said to be at risk  A fake Google Analytics script was placed within its website code by hackers. 

Eurostar customers were notified by email to reset their passwords following presumably successful automated login attempts to Eurostar accounts with stolen credentials obtained by an unknown method.

Two of the TalkTalk hackers were sentenced to a grand total of 20 months for their involvement in the infamous 2015 blackmail hack, which was said to have cost TalkTalk £77 million. There may have been up to 10 other attackers involved according to the court transcripts when hackers attempted to blackmail TalkTalk’s then CEO Dido Harding into paying a ransom in Bitcoin to cover up the breach. Has the enterprise, and judiciary, learned anything from TalkTalk hack?

Uber was fined £385,000 by the UK Information Commissioner's Office, after hackers stole 2.7 million UK customers in October and November 2016. Uber attempted to cover up the breach by paying the hackers $100,000 (£78,400) to destroy the stolen customer data. Meanwhile stateside, Uber paid $148m to settle federal charges. 

HSBC announced it had suffered a customer data breach in between 4th and 14th of October 2018 in a suspected "credential stuffing" attack. HSBC didn't state how many customers were impacted but are known to have 38 million customers worldwide. HSBC advised their customers to regularly change and use strong passwords and to monitor their accounts for unauthorised activity, sage good practice online banking advice, but I am sure their customers will want to know what has happened.

Facebook is still making the wrong kind of privacy headlines, this time it was reported that Facebook member's private message data was found for sale online, with one instance involving 257,256 stolen profiles and including 81,208 private messages. The report appears to suggest malicious browser extensions, not Facebook, may be behind the data breach.

A report from a UK parliamentary committee warned the UK government is failing to deliver on protecting the UK's critical national infrastructure (CNI) from cyber attacks. "The threat to critical infrastructure, including the power grid, is growing" the committee reported, with some states -"especially Russia" - starting to explore ways of disrupting CNI. An advisory notice also warned that UK companies connected to CNI were being targeted by cyber attackers believed to be in eastern Europe. APT28 (Russian based FancyBear) has added the "Cannon" Downloader Tool to their arsenal, according to researchers.

Amazon's showcase Black Friday sale was hit by data breach days before it started. The online retail giant said it emailed affected customers, but refused to provide any details on the extent or nature of the breach. The customer email said “Our website inadvertently disclosed your email address or name and email address due to a technical error. The issue has been fixed. This is not a result of anything you have done, and there is no need for you to change your password or take any other action.” 

There was a far more positive security announcement by Amazon about their AWS (cloud) services, with the launch of three new services to simplify and automate AWS security configuration called AWS Control Tower, AWS Security Hub, and AWS Lake Formation.  McAfee released their 2019 'Cloud Adoption and Risk Report' which highlights the vital importance of configuring cloud services correctly and securely.

RiskIQ claimed that monitoring for malicious code could have stopped the recent theft of 185,000 British Airways customer records. The Magecart hacker group is believed to be responsible for injecting twenty-two lines of malicious script into the British Airway's payment page, which successfully lifted debit and credit card details, including the CVV code.

Finally, according to enSilo, European Windows users are said to be targeted by a sophisticated malware called 'DarkGate', which has an arrange of nefarious capabilities, including cryptomining, credential stealing, ransomware, and remote-access takeovers. The DarkGate malware has been found to be distributed via Torrent files disguised as popular entertainment offerings, which includes Campeones and The Walking Dead, so be careful to avoid becoming infected!

NEWS

• Marriott Hotels 4 Year Hack Impacts Half a Billion Guests!
• Facebook Users’ Data, Private Messages found up for sale Online
• Amazon hit with Major Data Breach Days before Black Friday
• HSBC Suffers Data Breach, Customer Banking Information Exposed
• Vision Direct Hack places Customers’ Money at Risk
• UK Power Grid Vulnerable as Government Failing on Cyber Security
• TalkTalk Hackers Jailed for Cyber Attack that Cost Company £77m
• Eurostar Customers Forced to Reset Passwords after Breach
• Radisson Hotel Group Member Rewards program Breached
• Uber Fined £385,000 for Losing UK Customer Data
• Amazon's AWS launches Three New Services to simplify Security Configuration
• Database Breach affects 2.6 Million Atrium Health Patients
• Monitoring file output for malicious code 'could have stopped BA attack more quickly’
• Kaspersky moves away from Moscow after allegations of Kremlin spying
• Microsoft Patches 62 Vulnerabilities, including 12 Critical for Windows, Edge\IE, Office Chakra, Flash, and .NET
• Adobe Releases Fixes for an Important Vulnerability for Acrobat and Acrobat Reader
• Cisco Fixes Two Critical Bugs, Recommends Workaround
• D-Link Router Vulnerability Detailed
• SSD Encryption Security Failures Revealed by Researchers
• Apache Struts Vulnerability would allow System Take Over
• Cisco WebEx Flaw Patched
• VMware issues Critical Security Update for Workstation and Fusion products

AWARENESS, EDUCATION AND THREAT INTELLIGENCE

• Targeted Ransomware Attacks on the Rise in 2018, NCSC warns
• APT Group TA505 testing out new modular RAT
• Kaspersky: Spam and Phishing in Q3 2018
• Chinese Hackers using Russian tactics to attack UK Firms
• Phishing campaign looks like work of Russian APT 28 Cozy Bear
• ‘DarkGate’ Miner, Password-Stealer could open up a world of hurt for Windows Users 
• DirtyCOW is back in Backdoor Attack targeting Drupal Web Servers
• ‘Cannon’ Downloader Tool added to Fancy Bear’s  APT28 arsenal 
• Trickbot’s latest Trick? POS feature

REPORTS

• McAfee Cloud Adoption and Risk Report: Cloud insecurity is the new normal
• Vectra 2018 Spotlight Report: Hackers attack energy companies' IT systems rather than ICS