$2.47 Million Hacker Crypto Theft

• March 25, 2019
• by:  RKN Global 
• note: 0 Comments

Computer hacker silhouette of hooded man with binary data and network security terms

In a recent crypto theft, hackers stole $2.47 million worth of cryptocurrency from a Turkish firm. Crypto networks are exposed to cyber and crypto theft threats, and hackers are constantly trying to find ways to breach security measures. This is one of the main reasons why cryptocurrency firms and networks spend a lot of money on security development and the repair of vulnerabilities.

How was the crypto theft successful?

A group of hackers were able to pull off the cyber-theft on a domestic cryptocurrency firm with the help of a popular multiplayer, online battle-royale game called PUBG (PlayerUnknown’s Battlegrounds). The group of suspects, who have been detained by the local authorities, used PUBG for communicating before the actual crypto theft.

The victim firm is an Istanbul-based cryptocurrency company. Police were able to recover only $256,000 out of a total stolen amount of $2.47 million.

According to the local Turkish newspaper, the Daily Sabah, the identity of the firm has been kept hidden but there have been reports that the firm provides digital currency trading platforms. There have also been reports that a large amount of XRP, Ethereum and Bitcoin were stolen in the cyber heist.

Crimes happen because of bad security policy: Report

According to a report by cyber security firm CipherTrace, most cryptocurrency thefts are enabled by bad security policy of the victimized firms. The report points out that digital currency scammed from investors and stolen from exchanges hiked more than 400% in 2018 to over $1.7 billion.

The adoption of cryptocurrencies has increased in Turkey, especially after the Lira dropped about 14% against the US dollar. This increased adoption makes it even more important for firms dealing in cryptocurrencies to put in place better security systems against cyber-attacks and hacks.

Cyber Attack on Australian Parliament’s System

• March 18, 2019
• by:  RKN Global 
• note: 0 Comments

Australian Parliament By Thennicke – Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=57886437

In recent years, Australia has faced several cyber attacks, some of which local media attributed to countries like China. There were massive attacks in 2015 and 2016 on the government’s weather and statistics agencies, for example. Australia’s Parliament was also hit by a cyber attack recently, and all its passwords were reset for security purposes.

Security agencies investigating the cyber attack

Local media again attributed the Parliament attack to China, but what stands out after so many breaches is a bigger question: How could such a data breach happen even after so many cyber security steps taken by the government? There is no evidence as of the time of this writing that any data was stolen.

According to cyber experts, the hackers were quite sophisticated in their approach. The presiding officers of the Federal Parliament noted in a statement that they don’t know whether the attack was intended to affect political or electoral processes or to disrupt the results of parliamentary processes.

Investigators will take time to find the perpetrators. The ASD (Australian Signals Directorate) is securing the parliament network and trying to mitigate any harm caused due to the cyber-attack. There is no evidence as to what—or how much– data was stolen. Reportedly, the system contained sensitive information on politicians, government departments, staffers, and even included state secrets.

No government department targeted in the cyber-attack: PM

Scott Morrison, Australia’s Prime Minister, revealed that no federal government agency or department was targeted in the cyber-attack.

The attack may not have affected the computer networks of government staff or ministers, but it did affect the opposition, government backbenchers and crossbenchers. According to staff and labor politicians, access to emails had been irregular since the cyber-attack.

The good thing related to the attack was that authorities took action quickly.  The issue of blame is taking a back seat to assessing the attack’s impact and mitigating any harm.

Facebook Discussed Charging Companies for User Data

• March 12, 2019
• by:  RKN Global 
• note: 0 Comments

According to reports, Facebook staff discussed requiring companies to pay to access to user data. However, this discussion did not turn into action, as the company decided against such policy. The internal discussions were discovered in edited court documents released by the company during litigation against software developer Six4Three in 2018.

Documents presented in a misleading way: Facebook

The information was collected through emails dating between 2012 and 2013, in which Facebook staff discussed ways to access user data to make more money on advertising from big clients. In one email, an employee proposed blocking access to any applications that do not spend at least $250k annually in order to continue access to user data.

There was no suggestion that the tech giant assented to such proposals. The UK parliament took copies of the emails from the chief executive of Six4Three and quoted from the filings during a recent hearing. Facebook’s head of policy in Europe, Richard Allan, was asked during the hearing if apps were removed or “whitelisted” on the basis of their spending on mobile advertising. He answered no to both questions.

Facebook told the Guardian in a statement that the documents were presented in a misleading way and it is unable to disprove the false accusations because the evidence was sealed by a California court.

Facebook says it had users’ permission

In March 2018, Facebook admitted that it had collected data from texts and calls. However, it also said that it had prior consent of users. The US-based software developer Six4Three had sued the social network over its app Pikinis, which enabled users to zoom in on bikini pictures. Six4Three accused Facebook of tracking users without their express consent.

There have been other reports that the tech company collected data of users without notifying them properly. Earlier, the company was accused of sharing data of users with over 150 companies, including Spotify and Netflix.

Artificial intelligence to Play a Major Role in Cybersecurity in 2019

• March 5, 2019
• by:  RKN Global 
• note: 0 Comments

The year 2018 has ended and we’re well into the beginning of 2019. The major shifts that organizations and security teams might anticipate in this year could be in the line of artificial intelligence, machine learning and risk management tools.

Trends in cybersecurity

There were several data breaches in companies like Facebook (87 million+ records breached), MyHeritage (92 million+ records breached), Exactis (340 million+ records breached), Under Armour (150 million+ records breached) and Aadhaar (1.1 billion records breached). These were just some of the many data disasters that took place in 2018. The data breaches highlight the importance of cybersecurity and demonstrate that security professionals as well as companies are not doing enough to protect customers’ data.

Governments have now stepped in to protect consumers through new security regulations. Security teams will have to prioritize and identify mitigation actions to safeguard customers against new attacks and prevent similar breaches.

Prognosticators of AI trends point to Biometric Security, GDPR compliance, and IoT security. Humans will no doubt be required to identify attacks, but artificial intelligence may take action in response to cyberattacks. Technology magazine CIOReview notes in its blog that biometrics is quite dependable in terms of security and offers excellent identity verification. Organizations could incorporate it into their security models for better safety.

As for GDPR compliance, privacy vendors, security risk analysis and data security professionals have accepted the regulation open-heartedy because its demand has led to more sales.

10% of VM Tools to be risk-based by the end of 2019

Gartner released a report in 2018 on risk-based vulnerability management. The report discussed the requirement that VM (vulnerability management) tools  incorporate risk into their calculations on the basis of its impact on business. Traditional VM tools identify hundreds of risks at a given time and make it almost impossible for security teams to decide which risk to address or prioritize first. Advanced risk-based VM tools, according to Gartner, will consider the impact of risks on the business and then produce a prioritized and clearer set of actions for the security team.