Author Archives: Jeff Stone

Google makes safe logins more convenient by allowing smartphones to be security keys

Posted on by

Google users can now use an iPhone or Android device as a security key to sign into their accounts, utilizing a technique that improves their defense against phishing attacks, the company announced Wednesday. In a blog post, a product manager for Google’s Advanced Protection Program wrote that people who exclusively use security keys when logging in to their accounts “never fell victim to targeted phishing attacks.” Yet security keys, which are more secure than text-based authentication, typically are available in the form of a standalone physical device, an inconvenience that may discourage adoption. Google’s update Wednesday is a significant step toward solving that problem. Instead of plugging a key into a USB slot, users just need to have their phones close to their machines. “Everything becomes much simpler when the things we’re already carrying around — our smartphones — have a built-in security key,” Shuvo Chatterjee said in the post. “That’s been the […]

The post Google makes safe logins more convenient by allowing smartphones to be security keys appeared first on CyberScoop.

Continue reading Google makes safe logins more convenient by allowing smartphones to be security keys→

Equifax to pay customers $380.5 million as part of final breach settlement

Posted on by

Equifax has agreed to pay $380.5 million to resolve allegations related to the 2017 data breach in which hackers stole information belonging to some 147 million Americans, under the terms of a settlement approved by a federal judge. A court in the Northern District of Georgia on Monday approved an agreement covering the roughly 147 million people whose information was compromised when hackers spent May 2017 through July 2017 lurking in Equifax’s system. Equifax had failed to fix a known vulnerability, resulting in the theft of information about many Americans who never signed up with the credit monitoring service. A House Oversight committee in October 2018 said the incident was “entirely preventable.” Under the terms of the settlement, Equifax will deposit the $380.5 million into a fund where members of the class action suit can withdraw up to $20,000, if they can prove out-of-pocket losses. Equifax may also be required to […]

The post Equifax to pay customers $380.5 million as part of final breach settlement appeared first on CyberScoop.

Continue reading Equifax to pay customers $380.5 million as part of final breach settlement→

Amnesty suit asking Israel to revoke NSO Group’s license heads to court

Posted on by

Amnesty International is urging an Israeli court to restrict the business of NSO Group, a spyware vendor accused of helping repressive governments spy on dissidents and journalists. The U.K.-based human rights group on Tuesday published a statement encouraging Tel Aviv’s District Court to revoke NSO Group’s export license, a move that would effectively prohibit the company from providing foreign clients with its technology. NSO Group sells Pegasus, hacking software which allows clients to monitor targets’ emails, text messages, collect passwords and gather other valuable personal information. Government critics and journalists in Mexico, Saudi Arabia and the United Arab Emirates have been targeted with Pegasus, Amnesty said. “The best way to stop NSO’s powerful spyware products reaching repressive governments is to revoke the company’s export license, and that is exactly what this legal case seeks to do,” Danna Ingleton, deputy director of Amnesty Tech, said in a statement Tuesday. NSO Group, founded […]

The post Amnesty suit asking Israel to revoke NSO Group’s license heads to court appeared first on CyberScoop.

Continue reading Amnesty suit asking Israel to revoke NSO Group’s license heads to court→

Authentication startup Trusona raises $20 million by promising to help clients ditch passwords

Posted on by

An Arizona-based startup used by the likes of Microsoft and Aetna on Tuesday announced it has raised $20 million, bringing its total funding to $35 million. Trusona, founded in 2015, describes itself as an enterprise authentication company that helps customers abandon passwords in favor of QR codes. By using their phone to scan a QR code on their desktop, the idea goes, users can log-in to their accounts without a username and password, just as long as that service also is using Trusona. Along with physical security keys, password management tools and biometrics, it’s the latest emerging technology that is challenging traditional sign-on techniques. “It’s not just a fad,” said Trusona chief executive Ori Eisen, a former financial industry executive who specialized in anti-fraud. “We think that passwordless, in the next three to five years, will become [more common].” Georgian Partners, a Canadian venture capital firm, led the most recent […]

The post Authentication startup Trusona raises $20 million by promising to help clients ditch passwords appeared first on CyberScoop.

Continue reading Authentication startup Trusona raises $20 million by promising to help clients ditch passwords→

Travelex says ransomware recovery is underway two weeks after global blackout

Posted on by

The financial exchange Travelex said Monday it has restored some of its digital capabilities for foreign currency trades, nearly two weeks after a ransomware attack forced staff to rely on pens and paper. Travelex said its making “good progress” in its recovery from a security incident that, on Dec. 31, forced the company to suspend online services, including its app and internal email systems. Ransomware attackers used a malicious software strain called Sodinokibi, or REvil, reportedly to demand a fee of $6 million (£4.6 million) to release the affected data. Now, Travelex said, it is restoring internal processes and issuing refunds to customers “where appropriate,” according to Reuters. Hackers previously told the computer security blog Bleeping Computer they were in negotiations with Travelex about the ransom payment. Travelex did not respond to a request for comment from CyberScoop Monday. The company, a subsidiary of United Arab Emirates-based Finablr, operates 1,200 locations […]

The post Travelex says ransomware recovery is underway two weeks after global blackout appeared first on CyberScoop.

Continue reading Travelex says ransomware recovery is underway two weeks after global blackout→

U.K. regulator dings tech retailer for breach that affected 14 million people

Posted on by

Britain’s data protection authority said Thursday it has fined Dixons Carphone, a massive electronics retailer, the maximum fine allowed under law for a data breach that exposed financial information from millions of customers. Malicious software lurking inside point-of-sale systems at Dixons Carphone stores from July 2017 through April 2018 collected payment card data of 5.6 million people. Attackers accessed personal information including names, email addresses and details about failed credit checks on some 14 million people. The U.K.’s Information Commissioner’s Office fined the company £500,000 ($653,000) for the incident, the highest penalty authorized under the U.K.’s 1988 Data Protection Act. The ICO found that Dixons Carphone, which reported £10.5 billion (equivalent to $13.7 billion in 2020) in revenue in 2018, broke the law “by having poor security arrangements and failing to take adequate steps to protect personal data.” The company is also known as DSG Retail. Security issues included a […]

The post U.K. regulator dings tech retailer for breach that affected 14 million people appeared first on CyberScoop.

Continue reading U.K. regulator dings tech retailer for breach that affected 14 million people→

Latest ‘Intrusion Truth’ data dump peels back layers on Chinese front companies

Posted on by

Intrusion Truth is back. The anonymous group known in the cybersecurity world for publishing detailed blog posts about suspected nation-state hackers released new information Thursday alleging that Chinese technology companies are recruiting attackers working on Beijing’s behalf. By identifying job postings seeking offensive cybersecurity skills, the group wrote, they found a number of companies in Hainan, a province in South China, all using the same language in their advertisements. Some of those companies have only a small web presence outside the job ads seeking offensive-minded computer specialists, suggesting to Intrusion Truth that employers actually are trying to recruit hackers for advanced persistent threat groups. “We know that these companies are a front for APT activity,” states the blog post published Thursday. This blog post is the first from Intrusion Truth since July 2019, when the group reported that a Chinese APT had offered to sell stolen data. Intrusion Truth emerged in […]

The post Latest ‘Intrusion Truth’ data dump peels back layers on Chinese front companies appeared first on CyberScoop.

Continue reading Latest ‘Intrusion Truth’ data dump peels back layers on Chinese front companies→

Kuwait’s state news agency says hackers breached its Twitter

Posted on by

U.S. military forces are not pulling out of Kuwait. The Kuwaiti government clarified that fact on Wednesday after KUNA, the state news agency, reported that a defense minister said Americans planned an “imminent withdrawal” within three days. In fact, KUNA had been hacked, and word of the withdrawal had been posted by an outsider, according to Tareq al-Muzraem, head of Kuwait’s government communication office. KUNA deleted the original claim from its Twitter page, and posted a series of updates on its website and to its more than 34,000 followers on Twitter. Reuters, a global news and wire service, was one credible news outlet to publish a brief article based on the false KUNA report. (KUNA) categorically denies reports it broadcast statements by Defense Minister Sheikh Ahmad Al-Mansour about withdrawal of US forces from Kuwait.#kuna #kuwaitS.A — kuna (@kuna_en) January 8, 2020 While KUNA provided no details about how the breach […]

The post Kuwait’s state news agency says hackers breached its Twitter appeared first on CyberScoop.

Continue reading Kuwait’s state news agency says hackers breached its Twitter→

Sodinokibi ransomware plagues Travelex currency exchange as investigation continues: report

Posted on by

A days-long ransomware attack against Travelex has forced the British currency exchange to suspend many of its online operations as the United Kingdom’s Metropolitan police investigate the incident. The company said on Dec. 31 it would suspend all of its online services, including its app and internal email systems, to mitigate a cyberattack it detected that day. Two days later, Travelex contacted the Metropolitan police, seeking help to resolve the situation. Normal operations hadn’t been restored, the BBC reported Tuesday, with hackers reportedly demanding a $6 million ransom (£4.6 million) to unlock the affected data. Travelex did not respond to a request for comment Tuesday. The firm’s website was still offline at press time, citing planned maintenance. “The company’s network of branches continues to provide foreign exchange services manually,” the firm said in a Jan. 2 tweet. Travelex, a subsidiary of United Arab Emirates-based Finablr, operates 1,200 locations in 70 […]

The post Sodinokibi ransomware plagues Travelex currency exchange as investigation continues: report appeared first on CyberScoop.

Continue reading Sodinokibi ransomware plagues Travelex currency exchange as investigation continues: report→

Pro-Soleimani messaging immediately floods Twitter following general’s death in drone strike

Posted on by

The U.S. drone strike that killed Iran’s top security and intelligence commander also triggered a wave of social media propaganda apparently meant to sway international opinion on an attack that represents a dramatic escalation in the conflict between Washington and Tehran. Twitter accounts claiming to be located in Iran and throughout the Middle East pushed out many thousands of tweets under a handful of hashtags, such as #HardRevenge and #DeathToAmerica, promising payback against the U.S. for President Donald Trump’s order to eliminate the Iranian commander. The #HardRevenge hashtag was included in 95,000 tweets between Jan. 1 and Jan. 3, according to Kanishk Karan, a researcher at the Atlantic Council’s Digital Forensics Research Lab. There were zero mentions in all of December 2019, Karan said. The wide availability of propaganda again highlights the difficulty that social media platforms encounter when trying to keep pace with such fraught geopolitical events. Often, social media campaigns are designed to […]

The post Pro-Soleimani messaging immediately floods Twitter following general’s death in drone strike appeared first on CyberScoop.

Continue reading Pro-Soleimani messaging immediately floods Twitter following general’s death in drone strike→