Accenture Acquires Revolutionary Security

Accenture has acquired a privately held Philadelphia company specializing in enterprise cybersecurity for information technology and operational technology environments.

Global professional services company Accenture announced its acquisition of Revolutionary Security on April 7. The financial terms of the deal were not disclosed.

Revolutionary Security was founded in 2016 and is headquartered in Whitpain Township, Pennsylvania. The company employs 90 cybersecurity professionals throughout the United States and serves a variety of clients in the energy, manufacturing, healthcare, financial services, and communications industries.

“The acquisition of Revolutionary Security is another demonstration of our continued commitment to invest in areas to keep our clients safe from cyber-threats,” said Kelly Bissell, who leads Accenture Security globally. 

“Revolutionary Security’s service offerings are a perfect complement to Accenture’s portfolio, and the acquisition furthers our mission of helping clients better protect and defend their organizations across their entire ecosystem.”

Jim Guinn II, who leads Accenture’s cybersecurity business for the energy, utilities, chemical, and mining industries, added that Revolutionary Security’s "extensive experience working with industrial companies and their specialized technical skill set will be incredibly valuable to our clients.”

Cybersecurity services offered by Revolutionary Security include assessment and testing, design and build of security programs and functions, and security operations across its clients’ IT and OT (operational technology) systems.  

LiveFire—Revolutionary Security's breach and attack simulation testing service—utilizes real-world cyber-threats to identify gaps in security processes and monitoring, as well as staff operations and technologies. 

President and CEO of Revolutionary Security Rich Mahler believes the acquisition will trigger growth. 

He said: “The opportunity to become part of Accenture Security will enable us to deliver more complete solutions to our clients and expand our services to even more clients globally. We’re excited to be joining a leading provider in cybersecurity services and look forward to working together to help clients solve their toughest challenges in IT and OT security.”

In March, Accenture agreed to acquire Context Information Security, which is the latest in a series of acquisitions—including those of Symantec’s Cyber Security Services, Deja vu Security, iDefense, Maglan, Redcore, Arismore, and FusionX—that the company says demonstrate Accenture Security’s "commitment to investing in and innovating advanced cybersecurity solutions."

Microsoft: Cyber-Criminals Are Targeting Businesses Through Vulnerable Employees

Microsoft has warned that cyber-criminals are preying on people’s vulnerable psychological states during the COVID-19 pandemic to attack businesses. During a virtual press briefing, the multinational technology company provided data showing how home working and employee stress during this period has precipitated a huge amount of COVID-19-related attacks, particularly phishing scams.

Working from home at this time is very distracting for a lot of people, particularly if they are looking after children. Additionally, many individuals are in a stressful state with the extra pressures and worries as a result of COVID-19. This environment is providing new opportunities for cyber-criminals to operate.

“We’re seeing a significant increase in COVID-related phishing lures for our customers,” confirmed Ann Johnson, corporate vice-president, Microsoft. “We’re blocking roughly 24,000 bad emails a day with COVID-19 lures and we’ve also been able to see and block through our smart screen 18,000 malicious COVID-themed URLs and IP addresses on a single day, so the volume of attacks is quite high.”

Johnson therefore urged businesses to adapt and step up security practices in this environment. She noted that in the rush to get employees set up working from home productively, putting in place more stringent measures has been something of an afterthought for many businesses.

“It’s important to educate users and tell them to pause and think before they click on a link, and the second thing we’re telling organizations is that they need to enable multi-factor authentication for 100% of users, 100% of the time, because if their users are stressed, they are going to click on those links and potentially give away their credentials,” added Johnson.

In the briefing, Microsoft stated that the countries most targeted by COVID-19 attacks have been China, the US and Russia, followed by Japan and parts of Latin America. The global technology giant has also seen signs that the volume of attacks is beginning to normalize over the past few days.

Quarter of DevOps Suffer Open Source Component Breaches

A quarter of organizations have suffered a breach related to their application development process over the past year, with most of these coming via open source components, according to Sonatype.

The DevOps automation firm’s 2020 DevSecOps Community Survey is based on responses from 5045 software professionals around the world.

It revealed that 21% of the 24% of responding organizations that reported a breach over the past 12 months linked it to use of third-party components.

These are incredibly popular among DevOps practitioners as they help to speed the release of new products, although they can also contain vulnerabilities and sometimes malware.

Interestingly, the figure for reported open source component breaches rose to 28% for those organizations with mature DevOps practices that include keeping a Software Bill of Materials (SBOM) for all components.

This could be because of cultural differences associated with finding and reporting such issues, Sonatype claimed.

“DevOps practice and thought leaders continue to suggest that mature DevOps cultures supports scenarios where information is actively sought, new information is welcomed, and bridging functional groups is a rewarded behavior,” the report added.

“Failures are not silent in mature DevOps practices, but rewarded. For mature DevOps practices, awareness is one of the best agents for driving change.”

The report also suggested that happy developers are more likely to be good for overall cybersecurity: they are 3.6-times less likely to neglect security when it comes to code quality, 2.3-times more likely to have automated security tools in place and 1.3-times more likely to follow open source security policies.

Research from Sonatype last year revealed that there had been a 71% increase in open source-related breaches over the previous five years. UK firms on average downloaded 21,000 software components known to contain vulnerabilities.

Over 350,000 Exchange Servers Exposed to Serious RCE Bug

Over 350,000 Exchange servers around the world are still exposed to a critical vulnerability patched by Microsoft in February and actively being exploited in the wild, according to Rapid7.

The security vendor deployed its Project Sonar scanning apparatus to find that over 82% of the 433,464 Exchange servers it detected were still vulnerable as of March 24.

Discovered by Trend Micro’s Zero Day Initiative, the vulnerability in question, CVE-2020-0688, allows for remote code execution on unpatched systems if the Exchange Control Panel (ECP) interface is accessible to the attacker and they have a working credential for it.

After Rapid7 itself released a Metasploit module related to the bug, security researchers at Volexity spotted “multiple APT actors” trying to exploit the vulnerability at the beginning of March.

“Many organizations employ two-factor authentication (2FA) to protect their VPN, e-mail, etc, limiting what an attacker can do with a compromised password,” the vendor explained.

“This vulnerability gives attackers the ability to gain access to a significant asset within an organization with a simple user credential or old service account. This issue further underscores why changing passwords periodically is a good best practice, regardless of security measures like 2FA.”

Rapid7 Labs manager Tom Sellers urged affected organizations to update Exchange immediately and check for compromise.

However, Project Sonar also revealed more widespread security deficiencies. It found over 31,000 Exchange 2010 servers around the world that have not been updated since 2012, while almost 800 Exchange 2010 servers have never been updated.

“In addition to the high numbers of servers that are missing multiple updates, there is a concerning number of Exchange 2007 and 2010 servers,” Sellers added.

“Exchange 2007 transitioned to End of Support (EoS) status nearly three years ago on April 11 2017. No security updates, bug fixes, timezone updates, etc., are provided after that date. Exchange 2007 does not have the vulnerability described by CVE-2020-0688 but if it did, it would not have been fixed.”

EU Privacy Tsar Calls for Europe-Wide #COVID19 Tracking App

Europe’s data protection tsar has called for a pan-EU COVID-19 health tracking app to avoid fragmented member state approaches which may not follow privacy-by-design principles.

European data protection supervisor (EDPS), Wojciech Wiewiórowski, said his team is already cooperating with other EU institutions to create a joined-up approach in line with GDPR.

He argued that even the strict EU data protection regulation makes some allowances for use of personal data in exceptional circumstances like the current pandemic.

“GDPR states that the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality,” explained Wiewiórowski.

“Legality of processing the personal data – even so called sensitive data like data about health – can be achieved when processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued.”

To that end, even if specific data processing during the crisis may interfere with privacy rights, it may be necessary. However, an EU-wide approach as advocated by the EDPS will ensure any measures are temporary, and limited in purpose and data access.

There must also be a clear “way back to normality” – i.e. organizations must know what they will do with any data collected after the crisis is over, said Wiewiórowski.

“The EDPS is aware that a number of EU member states have or are in the process of developing mobile applications that use different approaches to protect public health, involving the processing of personal data in different ways. The use of temporary broadcast identifiers and Bluetooth technology for contact tracing seems to be a useful path to achieve privacy and personal data protection effectively,” he added.

“Given these divergences, the EDPS calls for a pan-European model ‘COVID-19 mobile application,’ coordinated at EU level. Ideally, coordination with the World Health Organisation should also take place, to ensure data protection by design globally from the start.”

The statement should go some way to assuaging the fears of global rights groups, which signed an open letter last week warning that efforts to contain the virus mustn’t be used as cover to usher in a new era of online surveillance.

They claimed that telecoms-based tracking is already underway in 23 countries, while 14 have deployed tracking apps.

Tracking infection rates and movement across the populace is seen as an essential step to helping prevent the spread of the pandemic and a key pillar of any lockdown exit strategy.

Akamai CSO: Online and Remote Work is the Future of Business

The internet is proving to be the most valuable resource at the moment, and opportunities will await those who adapt and are more prepared.

Speaking as part of the Akamai Edge conference, delivered as a virtual summit, Andy Ellis, CSO and senior vice-president at Akamai, said that where once the internet was disruptive, it is now enabling us to teach our children and talk to family members during the COVID-19 crisis.

“Maybe we’re at conferences that are recorded in people’s basements, living rooms and potentially on their back porch, and we didn’t have to travel to them,” he said. “Maybe we’re having meetings with staff no longer focused on who is in the headquarters.”

Ellis called these “opportunities for us to seize” and we can wait and “return to the world we used to be in” when COVID-19 pandemic is over, but the digital landscape is now different now. “People have tasted the opportunity where we have meetings on video rather than in person,” and support staff who can work wherever they want to be, as long as they have an internet connection.

“The world we are going to come out of this in, will be one in which the internet becomes a more crucial component of everything we do,” he said. This could be exercise, banking, work or school; “the opportunities are bound for us and those who anticipate and seize them and are prepared to adapt will come out of this more prepared for the world we will be in,” he said.

“Those who merely sit on their hands and wait, and are not prepared for the changes of the digital landscape, will be the followers. Which do you choose to be? My preference is to seize the opportunity.”

Asked by Infosecurity if he felt that threats were consistent or if they are taking advantage of a more dispersed and remote workforce and potentially vulnerable staff, Ellis followed Tom Leighton’s earlier point that attackers may have more time on their hands, but what has really happened is the environment has changed. “Businesses that were ill-prepared for the moment that we’re in are probably finding it a little more challenging to operate as where they are today isn’t where they were, and isn’t what their security was set up for,” he explained.

He added that too many businesses worked in a siloed model, and now everyone is remote “and what worked when 5% of the workforce [worked remotely] doesn’t work when 100% of the workforce is distributed, especially when they are seizing new technologies to enable them with their work which will expose you to hazards.”

Scammers Target US Stimulus Checks

In the latest sorry COVID-19 scam, fraudsters are impersonating financial institutions to steal from Americans expecting stimulus checks from the US federal government. 

Following the outbreak of the novel coronavirus, many Americans have been furloughed, fired, or had their hours or workload reduced as businesses across the country closed and lockdown measures were implemented. 

To soften the economic blow dealt by the deadly virus, the US Senate approved a $2tn stimulus package on March 25. 

Knowing that people all across America are now waiting to receive a government check, threat actors have swooped in to exploit the situation.

Researchers at Abnormal Security have detected an attack in which scammers impersonating a major financial institution are asking victims to verify their financial details before their stimulus funds can be released.

"These attackers created a convincing email and landing page that appeared to come from a major financial institution," wrote researchers.

"The email sent by the attackers claims that this financial institution has placed the funds on hold until the user can sign in and 'verify account ownership' so they can be released."

The email contains a link to a fake website that appears to be from a legitimate financial institution. 

"The URL is masked with a link, and the real URL takes victims to a site hosted at 'https://theruncoach.icu/home.php,' which attackers likely control and will use to steal the login credentials for this financial institution from victims," wrote researchers. 

Should recipients of the email fall victim to this attack, the login information for their banking account will become compromised.

In a bid to appear authentic, the attackers also inserted other genuine links into the email, including one that took users to the impersonated financial institution's real privacy statement.  

"The landing page was similarly elaborate, appearing almost exactly like the true bank landing page," wrote researchers. 

"Recipients would be hard-pressed to understand that this was, in fact, a site designed specifically to steal their credentials."

Researchers would not name which financial institution the scammers they observed were pretending to be associated with. 

"Please keep in mind that, although these attackers were impersonating one specific financial institution for this attack, they have already launched attacks impersonating many other financial institutions," said the researchers.

Linux Servers Under Attack for a Decade

New research has found that the Linux platform has been under attack from Chinese threat groups for a decade. 

The "Decade of the RATs Research Report," published today by BlackBerry, reveals how five Chinese APT groups targeted Linux servers, Windows systems, and mobile devices running Android in a prolonged cross-platform attack. 

Researchers said that they are confident that the APT groups "are likely comprised of civilian contractors working in the interest of the Chinese government who readily share tools, techniques, infrastructure, and targeting information with one another and their government counterparts." 

Currently, Linux runs on all of the world’s 500 fastest supercomputers, and 90% of all cloud infrastructure and 96.3% of the world's top 1 million servers run on Linux.

Historically, the Linux platform has been overlooked from a security perspective. 

"One of the main reasons there aren’t many security tools for Linux is because there are relatively few Linux machines in the world (roughly 2%), therefore it’s a tough way for companies to make money,” Eric Cornelius, chief product architect at BlackBerry, told Infosecurity Magazine.

"Security products and services are not as widely deployed for Linux platforms as they are for the more popular Windows and Mac platforms."

Cornelius added that a prevailing assumption that Linux is more secure because it is open source "is just not the case." 

Asked what currently overlooked platforms could become "the Linux of the future" from a cybersecurity perspective, Cornelius said: “The most obvious one is mobile. As the 'Mobile Malware' report that we released this past fall points out, security vendors have only recently started deploying products to address a problem that governments and government-backed groups have been getting away with for a decade or more, with relative impunity. 

“Attitudes about adware are the source of another area of concern, as more and more APT groups disguise their malware as adware, thinking that it can fly under the radar and receive low priority if caught. We’ve also seen an uptick in the abuse of legitimate cloud service providers whose infrastructure is being co-opted by attackers to carry out their operations.”

By exposing a threat that has emerged from the past, the new research is bad news for security professionals, already stretched by dealing with current and predicted threats. 

Asked how professionals should split their attention when it comes to countering attacks, Cornelius said: “It's a process, not an exact science. But too often, the security industry and network defenders fixate on the next and the newest and forget to look back to see how past threats have evolved. As the old adage goes, 'Those who cannot remember the past are condemned to repeat it.'”

Philippines Arrests 32 on Fake News Charges

Police in the Philippines have charged 32 people with disseminating false information regarding the COVID-19 health crisis.

The Philippine National Police Anti-Cybercrime Group (PNP-ACG) said that 8 of those arrested allegedly spread fake rumors about the novel coronavirus orally around their local neighborhoods. The remaining 24 suspects are accused of using social media platforms to circulate falsehoods about the deadly virus.

Among the suspects is public school teacher Juliet Espinoza, who wrote on Facebook on March 27 that food supplies in General Santos City were running low. According to Philstar Global, Espinoza allegedly urged the public to seize food that was being stored in a gym. 

Another suspect, Vicente Cañonera, posted a list of people he said had contracted COVID-19 on Facebook to help in contact tracing. 

The 32 accused hail from Quezon City, Eastern Visayas, Calabarzon, Mimaropa, Western Visayas, Zamboanga peninsula, and Caraga. The crimes they are charged with allegedly took place from March 9 to April 5.

Police have charged the suspects with the unlawful use of means of publication and unlawful utterance under Article 154 of the Revised Penal Code and with violation of Republic Act 10175 or the Anti-Cybercrime Prevention Act.

ACG director Brig. Gen. Dennis Agustin asked the public not to share or post on social media any fake information about the COVID-19 outbreak that might create panic and confusion. 

“The ACG will be relentless in taking countermeasures on misinformation and spread of fake reports by conducting cyber patrol operations on social media and other online platforms,” Agustin said. 

As of Monday, coronavirus had claimed the lives of 163 people in the Philippines, according to Bloomberg. The total number of people with a confirmed case of COVID-19 in the country was 3,660.

On April 5, Al Jazeera reported that a 63-year-old man had been shot dead by police in the Philippines after threatening police and village officials at a coronavirus checkpoint with a scythe. The man, who was allegedly under the influence of alcohol, became violent after being cautioned by a village health worker to wear a face mask. 

Earlier today, Philippines president Rodrigo Duterte opted to continue the lockdown currently in place on the republic's main island of Luzon until April 30.

Internet Traffic Spiked to Double Normal Rate in March

Internet traffic saw a major spike in March, but it will scale in the face of increased user demand.

Speaking as part of the Akamai Edge conference, delivered as a virtual summit, Tom Leighton, CEO and co-founder of Akamai, said that COVID-19 is creating major changes in lifestyles, as the internet was intended to make our lives manageable.

“We are operating at a larger scale,” Leighton said, acknowledging that questions exist about whether the internet is ready to scale such demands “and handle applications that we rely on today.”

Leighton said that over the last four weeks global traffic has grown by 30%, whilst a normal growth would be 3%. “If we go back to 2019 and the same period, it declined by 1%, and this growth is in one month where there were no big sporting events,” he said. “We’re doing everything online now and there's been growth in a short period of time. 

Leighton also said that there had been a peak in traffic of 167 Tbps, compared to 82 Tbps in March 2019. 

Looking at the current state of security for remote working employees, Leighton explained that the “bad guys have been working remotely for years and know we’re vulnerable, they know we have got a lot on our minds and are taking advantage of it.”

He identified the four best defense strategies against attacks to be:

• Protect against DDoS attacks where there is resource exhaustion and sites are taken down
• Use application security and bot management, to stop your content from being corrupted and stop your site being taken over
• With people working at home, consider a zero trust approach as users working remotely is a major issue for access
• Consider page integrity and data being stolen from users, such as in the Magecart attacks

Asked if the internet will scale under current demand, Leighton said it would, but he warned it is under pressure “and especially in core data centers and that is where we help to deliver content into the network and at the edge where there is more bandwidth.”

UK Businesses Could Make Huge Savings on Cybersecurity Services

UK businesses could save up to £8.3bn by purchasing cybersecurity products and services from a more diverse range of suppliers, according to a study by Cynapse. It suggests that shopping around for cybersecurity services, thereby democratizing the market, would be hugely beneficial to UK companies.

Currently, businesses tend to turn to big firms for their cybersecurity needs. It is estimated that 76% of the UK cybersecurity market is controlled by just 10% of companies, equating to £6.3bn out of an overall £8.3bn. However, the market is changing rapidly, now encompassing over 1200 companies with a new startup joining the industry every week.

In a new study, Cynapse has found that smaller companies offer similar products and services at lower costs, in some instances saving businesses up to 40%. If firms utilize smaller cybersecurity suppliers in this way, it could potentially save them up to £8.3bn, according to Cynapse.

Cynapse is a London-based cybersecurity startup that offers companies free access to cyber-experts to better understand what their requirements are. It therefore believes it has a key role in unlocking the market, enabling businesses to find better value for money for their cybersecurity services.

The company stated: “Cynapse launched in March 2020 with the goal of providing a wider view of the cybersecurity market, tailored to individual customers’ needs.”

In its breakdown of the UK cybersecurity market, Cynapse showed that there are 122 large firms compared to 1099 medium, small and micro companies. The 122 large companies generate an estimated annual revenue of £6.3bn compared to £2bn among the rest. There are a total of 42,855 people employed in the UK cybersecurity sector, of which 27,746 work for the larger companies.

Only a Quarter of Orgs ‘Focus’ on Cyber-Attack Prevention

A new report from the Ponemon Institute has revealed that just 24% of organizations focus on optimizing cyber-attack prevention capabilities, despite 70% of security professionals believing that the ability to effectively prevent attacks strengthens security posture.

The research report, The Economic Value of Prevention in the Cybersecurity Lifecycle, sponsored by Deep Instinct, compiled survey responses from over 600 IT and IT security practitioners within organizations and revealed that a large percentage of companies prioritize cyber-attack detection and containment over prevention methods.

For example, according to respondents, whilst 79% of security budgets are being allocated to detection, containment, recovery and remediation activities, just 21% gets dedicated to prevention, even with 80% of those polled stating that prevention is the most difficult thing to achieve in the cybersecurity lifecycle.

The study determined that effective adoption of a preventative solution, when compared to the current spending of security departments and the cost of attacks, would result in significant cost reductions and require lower overall investment. 

“This study shows that the majority of companies are more effective at containing cyber-attacks after they happen because it is perceived to be more accountable. This explains why cybersecurity budgets focus on containing attacks rather than preventing them, as well as the increased rate of breaches despite investments in cybersecurity solutions,” said Dr Larry Ponemon, the Chairman and founder of the Ponemon Institute.

“Prevention of cyber-attacks is perceived to be too difficult, but as companies continue to suffer revenue losses due to cyber-breaches, we expect budgets to start allocating increased resources to preventative solutions.”

Guy Caspi, CEO and co-founder of Deep Instinct, added that most companies still operate under a policy of ‘assume breach,’ believing that it is more pragmatic to contain a cyber-attack after penetration.

“This is no longer an economically viable long-term strategy,” he said. “The value of prevention is clear – for any type of attack, prevention saves significant time and money.”

Shadow IT Represents Major #COVID19 Home Working Threat

Rising threat levels and remote working challenges stemming from the COVID-19 pandemic are putting increased pressure on IT security professionals, according to new data from Check Point.

The vendor polled over 400 respondents from global organizations with over 500 employees to better understand the current challenges facing security teams.

It revealed that 71% of security professionals had reported an increase in security threats or attacks since the start of the virus outbreak. Phishing (55%), malicious websites (32%), malware (28%) and ransomware (19%) were cited as the top threats.

These have been exacerbated by home working challenges, with 95% of respondents claiming to be under new pressures.

Top among these was providing secure remote access for employees (56%) and scalable remote access solutions (55%). However, nearly half (47%) of respondents complained that home workers using shadow IT solutions represented a major problem.

These challenges are only going to grow, according to the research.

Some 61% of security pros said they are concerned about the cyber-risks involved in making rapid changes to enable remote working, and over half (55%) felt remote access security needed to be improved. A further 49% said they’re concerned about the need to scale-up endpoint security for home workers.

“Cyber-criminals will always seek to capitalize on the latest trends to try and boost the success rates of attacks, and the coronavirus pandemic has created a perfect storm of a global news event together with dramatic changes in working practices and the technologies used by organizations,” argued Rafi Kretchmer, head of product marketing at Check Point.

“This has meant a significant increase in the attack surface of many organizations, which is compromising their security postures.”

According to recent figures, the volume of detected online threats jumped 37% month-on-month in March, while one vendor observed a 600% increase in phishing attacks from the end of February to the end of March.

The SANS Institute last month released a Security Awareness Work-from-Home Deployment Kit to help organizations support secure home working.

INTERPOL: #COVID19-Fighting Hospitals Facing Ransomware Deluge

INTERPOL has been forced to issue an alert to global police about the heightened risk of ransomware attacks on hospitals and other front-line organizations as they battle the COVID-19 pandemic.

The law enforcement organization said it issued a Purple Notice to all 194 member countries, highlighting the scale of the threat. Its Cybercrime Threat Response team claimed to have detected a “significant increase” in attempted ransomware attacks.

“As hospitals and medical organizations around the world are working non-stop to preserve the well-being of individuals stricken with the coronavirus, they have become targets for ruthless cyber-criminals who are looking to make a profit at the expense of sick patients,” said Interpol secretary general Jürgen Stock.

“Locking hospitals out of their critical systems will not only delay the swift medical response required during these unprecedented times, it could directly lead to deaths. INTERPOL continues to stand by its member countries and provide any assistance necessary to ensure our vital healthcare systems remain untouched and the criminals targeting them held accountable.”

To help out, INTERPOL said it is providing technical support and advice on how to protect key medical infrastructure.

The primary threat vector appears to be phishing emails spoofed to appear as if sent from trusted government sources, it said.

The news comes just days after Microsoft warned several dozen hospitals in a “first-of-its-kind notification” that their gateway and VPN appliances are vulnerable to ransomware groups scanning for exposed endpoints.

A study from the Vanderbilt University and the University of Central Florida published last year warned that data breaches at hospitals led to 36 additional deaths per 10,000 heart attacks per year.

It added that ransomware outages “might have an even stronger short-term negative relationship with patient outcomes than the long-term remediation efforts studied here.”

ICO’s Mega BA and Marriott Fines Delayed Again

Huge GDPR fines set to be levied by the UK regulator against British Airways and Marriott International have been delayed again as it considers representations from the multi-nationals.

BA owner the International Airlines Group (IAG) claimed in its Annual Report for last year that it has made “extensive representations” to the Information Commissioner’s Office (ICO) following its notice of intent to fine last July.

“As part of its procedures, the ICO will seek the views of other EU data protection authorities,” it continued.

“The ICO initially had six months from issuing the Notice of Intent to British Airways within which it could issue a penalty notice, which has been extended through to May 18 2020, to allow the ICO to fully consider the representations and information provided by British Airways.”

Unsurprisingly, the airline’s directors believe any fine should be “considerably lower” than the original £183.4m.

Meanwhile, a statement issued by Marriott cited by a leading data protection lawyer revealed: “We mutually agreed with the ICO to an extension of the regulatory process until June 1 2020.”

The hotel group was due to be fined £99m after a breach of 339 million customer records first notified in November 2018, while BA was on the hook for a Magecart attack which compromised 500,000 customers’ financial information.

The same legal expert, Mischon de Reya data protection advisor Jon Baines, argued that the current COVID-19 crisis may mean those fines never now materialize, given that the ICO’s own guidance is for an erring company's “ability to pay” to be considered when calculating a fine.

“As a public authority, the ICO has a general public law duty to take into account relevant factors when arriving at decisions. It is strongly arguable that if it failed to take into account the current effect, and the likely future effect, of COVID-19 on BA’s and Marriott’s finances, then any decision to issue a fine would be vulnerable to appeal or a successful application for judicial review,” he added.

“When the ICO announced its intent to serve these fines last year, some commentators questioned whether they would ever be served in the amount proposed, given the huge sums involved and the likelihood that the controllers would make strong representations against. No one could have predicted, however, that a public heath pandemic would come to be a major factor in deciding the issue.”

Vulnerabilities Detected in Government-sanctioned COVID-19 App

A COVID-19 app officially approved by the government of Colombia has been found to contain vulnerabilities.

Research published today by ZeroFOX’s Alpha Team raises concerns over an official government-sanctioned mobile app and several other apps created in response to the global health crisis. 

On March 9, Colombia's president, Ivan Duque, announced the launch of the CoronApp-Colombia app as a way for Colombians to send health updates and receive coronavirus news. Researchers found that the app, which has over 100,000 users, exposes user data.

"The CoronApp-Colombia app had a vulnerability where it was sending Personal Health Information (PHI) and Personally Identifiable Information (PII) data in plaintext," said Zack Allen, director of threat intelligence at ZeroFOX.  

"This includes passport numbers, passwords, and self-disclosed health information." 

Researchers found another app in use in Italy, released in beta testing mode, was recompiled with a backdoor and was "actively infecting victims." 

Asked if governments, instead of setting up new apps, should look to partner with existing apps to get the word out quickly and more safely, Allen said: "This is a fantastic demonstration of private and public industry working together, and I think it would be a great approach, granted the people trust these apps. It all depends on who wants to inherit the risk. 

"Many social media sites, for example, have COVID-19 splash pages and notifications for information, but having a large tech company hold all your data may have the same effects as government-sanctioned apps."

Unwilling to rely on TV and radio alone to communicate with citizens during the current health crisis, governments across the world have rushed out COVID-19 apps. 

"Mobile app usage is one of the faster ways to get information to citizens, but it comes at a cost," said Allen. "Governments inherit the risk of deploying code quickly and efficiently, and citizens have to trust that their privacy and protection are top of mind. 

"In my personal opinion, I'd like to see informational sources such as websites be used with a mobile-friendly website view. I would not install apps that use Bluetooth for tracking myself and others."

Asked if he personally uses any COVID-19 apps, Allen said: "I am primarily visiting the WHO and CDC websites on a daily basis. After reviewing about 30 of these apps, I would be hesitant to install them at this time."

Data Thieves Hit California Property Management Company

A California property management company has been targeted by data thieves operating out of the San Diego area.

An online database belonging to Wolfe & Associates, Property Services, was compromised by cyber-criminals in a data breach that may have occurred as many as six months ago. 

The company was unaware that a breach had taken place until it was notified by the Santa Barbara Police Department on March 5. 

In a statement released on April 3, Wolfe & Associates said that it was now working with the police "to determine the extent of the information that was obtained."

Police advised Wolfe & Associates that thieves may have obtained a wide variety of data belonging to the company's customers. This information could include rental applications that contain personal information such as name, date of birth, Social Security number, driver’s license number, and home address. 

"The Santa Barbara Police Department has been investigating the matter and informed us that the thieves likely used 'strong-arm' tactics to force breaching of security measures that were in place," said a spokesperson for Wolfe & Associates.

"On March 23, 2020, the police provided us with information about the identity of potentially affected applicants, including a list of their email addresses. Notice has been sent to those individuals."  

The company said that "people applying for apartments in Isla Vista after February of 2018, 2019 and 2020" have not been impacted by the breach.  

The culprits behind the attack, after targeting online databases belonging to several companies, have now been arrested. 

A spokesperson for Wolfe & Associates said: "According to the police, the suspects appear to have a history of obtaining personal information and using it to submit fraudulent insurance claims, among other things."

Wolfe & Associates manages over 30 Isla Vista properties, many of which are rented to students.

A fourth-year University of California student who leased with Wolfe & Associates from 2016 to 2018 told Daily Nexus: “The main concern is the cosigners. If my data was breached, my parents are my cosigners so the likelihood of their socials being taken as well are very high.” 

Since learning of the breach, Wolfe & Associates has transitioned their website onto an entirely new platform that includes an integrated and secured system for collecting, processing, and storing applications.

Australians Arrested Over $2.6m Email Scam

Police in Australia have arrested two men in connection with a $2.6m BEC (business email compromise) scam involving phony invoices. 

The men are believed to be part of a syndicate responsible for emailing businesses with invoices doctored to divert transferred funds into the scammers' personal bank accounts. 

In two early-morning raids carried out on April 2, New South Wales Police arrested a 29-year-old in Zetland, whom they believe to be the leader of the syndicate, and a 30-year-old in Roseberry.

Police seized computers, phones, drugs, $5,000 AUS, and $12,400 USD from two properties. 

The 29-year-old is believed to have successfully gained more than $1.6m from illegal scams, which ran from mid-2018 until early 2020. His attempts to gain a further $1m didn't pan out.

His alleged partner in crime was arrested for supporting the syndicate, drug charges, and handling the proceeds of crime. 

“These arrests are a timely reminder for all individuals and businesses to have strong cybersecurity measures in place for protection,” said commander of the NSW Cybercrime Squad, Detective Superintendent Matthew Craft.

“During this investigation, officers uncovered a criminal network targeting hard-working Australian businesses through a series of sophisticated email scams."

The syndicate allegedly stole money from businesses across a range of industries, which included property development, finance, construction, and other trades. 

Police said the scammers didn't restrict their activities to one single region. 

“Victims of cybercrime offences are not limited by state and territory borders and police will allege this syndicate targeted companies right across the country,” said Craft.

Last year, NSW police charged three other people in connection with the same criminal syndicate.

Australian businesses lost an estimated $60m to business email compromise scams in 2018 alone. 

Earlier this year, Canterbury Olympic Ice Rink in southwest Sydney was conned out of $77k in a BEC scam. The rink's finance department received an invoice for a new ice resurfacer that contained changed payment details. As a result, the rink's payment for the new equipment ended up going to an anonymous criminal’s bank account in Hungary.

Common Flaws Discovered in Penetration Tests Persist

Brute forcing accounts with weak and guessable passwords, and exploitation using the EternalBlue vulnerability remain among the top 10 findings in penetration tests.

According to research by Lares, the most frequently encountered vulnerabilities and attack vectors during engagements in the past six months have remained exactly the same as in it's previous report, which came out in July last year.

Its latest report analyzed the similarities between hundreds of engagements throughout 2019 and the following list represents the most frequently observed penetration test findings encountered:

• Brute forcing accounts with weak and guessable passwords
• Kerberoasting
• Excessive file system permissions
• WannaCry/EternalBlue
• WMI lateral movement
• Inadequate network segmentation
• Inappropriate access control
• Post-exercise defensive control tuning
• Malicious multi-factor enrolment or MFA bypass
• Phish-in-the-Middle (PiTM)

In an email to Infosecurity, Lares COO Andrew Hay said that a mix of the top findings are seen in “nearly every engagement.” He said: “Our analysis concludes that regardless of industry or vertical, these findings are evident in most environments we assess.”

Hay also confirmed that the top five findings are still prevalent, whilst implementations of the bottom five were described as “inadequate, inappropriate and ineffective.” Hay added that “those controls were either partially implemented but not tuned correctly, improperly implemented and not correctly hardened during initial deployment, or insufficiently monitored when the control capability exists.”

The fourth finding was unpatched instances of MS17-010, which enabled the WannaCry and NotPetya attacks of 2017. Lares said that despite this vulnerability being resolved, many organizations have yet to deploy this patch or disable SMBv1. “We observed slightly less EternalBlue during the second half of 2019, but we still encounter it quite frequently,” Hay said.

Commenting, Travis Biehn, principal security consultant at Synopsys, said that these sorts of issues come down to a server (or, maybe tens or even hundreds of ‘those servers’) that nobody maintains. He argued: “Perhaps it has been online for a decade, the individual or team that used to manage it is no longer with the company, or somehow it runs software that nobody on the team fully understands: this server may also be home to software that is mysteriously responsible for maintaining a large percentage of revenue.”

Biehn said often fixing these sorts of flaws ends up near the bottom of the pile year after year, and as a result attackers love such servers. “After establishing a foothold on the internal network, say a Linux server, they may hunt for that one Windows XP machine that’s still online. In doing so, there’s no need to worry about next generation anti-virus, EDR, logging, or a nosy sys-admin.”

DoJ: Zoombombing Could Land You Behind Bars

The Department of Justice (DoJ) has warned that Zoombombers could receive a prison sentence if found and convicted, as the COVID-19 pandemic forces meetings online.

The number of daily meeting participants on Zoom has risen from 10 million in December last year to a staggering 200 million by March, the firm revealed last week. However, users who fail to pay attention to their privacy settings may find their meetings disrupted by uninvited guests.

Reports have emerged of meetings interrupted by live-streams of adult content, and threatening language.

“You think Zoombombing is funny? Let’s see how funny it is after you get arrested,” warned Matthew Schneider, US attorney for Eastern Michigan. “If you interfere with a teleconference or public meeting in Michigan, you could have federal, state or local law enforcement knocking at your door.”

The charges, punishable by fines or even imprisonment, could include disrupting a public meeting, computer intrusion, using a computer to commit a crime, hate crimes, fraud, or transmitting threatening communications.

The DoJ reiterated best practice advice for video conferencing users including the following: change screen-sharing to “host only,” don’t share meeting ID on social media, keep software on the latest version, update corporate home working policies and don’t make meetings public.

Zoom has also been trying to educate users on how to keep the Zoombombers out. It now generates a password automatically for all new meetings, and the use of personal meeting ID for new meetings is switched off by default, meaning a one-time code will be issued.

Users are also encouraged to enable: “waiting room” which means attendees can’t join unless a host selects them individually from a list and a feature which allows the host to put any attendee on hold.

However, the firm was criticized last week after researchers easily found user meeting recordings stored online without a password. They blamed the Zoom default naming convention for files.