Author Archives: Joe Warminsky

Apple says iOS anti-tracking feature is still on the way, also takes shot at Facebook

Posted on by

Apple affirmed Thursday that its mobile operating system will soon get a new privacy feature opposed by the advertising industry, and it specifically called out Facebook for showing a “disregard for user privacy.” The privacy technology — App Tracking Transparency (ATT) — will arrive in early 2021, according to a letter that Jane Horvath, Apple’s senior director for global privacy, sent to Ranking Digital Rights, an organization that has agitated for big tech companies to do more to improve security and privacy. The nonprofit had urged Apple in October to push forward with the feature. ATT essentially will block iOS apps from tracking the use of other apps on a device. The goal is to limit the information that advertising networks collect about Apple device users. “We delayed the release of ATT to early next year to give developers the time they indicated they needed to properly update their systems and […]

The post Apple says iOS anti-tracking feature is still on the way, also takes shot at Facebook appeared first on CyberScoop.

Continue reading Apple says iOS anti-tracking feature is still on the way, also takes shot at Facebook→

Double-dipping scammers don’t need malware to grab card numbers and turn a profit, report says

Posted on by

Stolen credit card numbers sometimes spill onto the dark web for the most mundane reason: People carelessly give them up. According to researchers with Gemini Advisory, a China-based e-commerce scam appears to be harvesting payment information not through direct hacks on companies or using pernicious malware to skim data, but with a simpler approach. The fraudsters set up hundreds of websites that appear to sell legitimate goods, but instead capture card numbers for sale on the dark web, Gemini says. It ends up being a double-dip for the crooks: In addition to vending the card data and other information about shoppers in cybercriminal forums, they also collect money for items that are “faulty, counterfeit, or nonexistent,” Gemini says in a report published Thursday. The dark web sales have led to profits upwards of $500,000 over the past six months, but the total take is “likely significantly larger,” considering all the money the scammers […]

The post Double-dipping scammers don’t need malware to grab card numbers and turn a profit, report says appeared first on CyberScoop.

Continue reading Double-dipping scammers don’t need malware to grab card numbers and turn a profit, report says→

Sneaky recon on roster of AWS users is possible, Unit 42 says

Posted on by

Knowing exactly who manages a certain cloud service can be valuable information for malicious hackers, and a cybersecurity company says it has found that kind of weakness in products run by one of the biggest cloud providers. More than 20 application programming interfaces (API) associated with 16 Amazon Web Services products can be abused to give up basic information about users and their roles, according to Unit 42, the research arm of cybersecurity giant Palo Alto Networks. “A malicious actor may obtain the roster of an account, learn the organization’s internal structure” and then perhaps “launch targeted attacks against individuals,” Unit 42 researcher Jay Chen says in a report released Tuesday morning. Palo Alto Networks says AWS gave permission to release the research. The problem is within a feature that validates “resource-based policies” for things like the commonly used Amazon Simple Storage Service (S3), Unit 42 says. A resource-based policy is basically a […]

The post Sneaky recon on roster of AWS users is possible, Unit 42 says appeared first on CyberScoop.

Continue reading Sneaky recon on roster of AWS users is possible, Unit 42 says→

Video game company Capcom details attack, data breach by ransomware gang

Posted on by

The Japanese video game company known for the “Resident Evil” and “Street Fighter” series confirmed Monday that a ransomware attack in early November potentially exposed data about thousands of customers and business partners. In a news release, Capcom said an investigation of the Nov. 2 breach showed that personal information of a handful of current and former employees definitely had been compromised, as well as company sales reports and other financial information. Another 350,000 records of employees, shareholders, customers and other business partners also may have been exposed, Capcom said, but it was unsure of the exact number because log files had been lost because of the attack. The company confirmed that the ransomware gang known as Ragnar Locker was responsible for the attack, and said it had referred the matter to law enforcement in Japan and the U.S., as well as data protection agencies in Japan and Europe. Earlier reports […]

The post Video game company Capcom details attack, data breach by ransomware gang appeared first on CyberScoop.

Continue reading Video game company Capcom details attack, data breach by ransomware gang→

Well-developed backdoor can harvest information from restaurants, bars and hotels, researchers say

Posted on by

Restaurants, bars and hotels are taking a big hit from the coronavirus pandemic, but they still can be inviting targets for cybercriminals. A point-of-sale-system widely used in the hospitality industry to process credit card payments and other transactions — ORACLE MICROS Restaurant Enterprise Series (RES) 3700 — is vulnerable to a backdoor that allows attackers to see some of the information in the system’s databases, according to researchers at Slovakia-based cybersecurity company ESET. The researchers stress that highly sensitive pieces of information — such as credit card numbers and expiration dates – do not appear to be vulnerable to the malware, which they’re calling ModPipe. The malicious software, for now, harvests only “data stored in the clear,” ESET says, including cardholder names. But ModPipe potentially could be the conduit for more harmful malware, given that it is modular — meaning that it’s designed for attackers to swap features in and out. […]

The post Well-developed backdoor can harvest information from restaurants, bars and hotels, researchers say appeared first on CyberScoop.

Continue reading Well-developed backdoor can harvest information from restaurants, bars and hotels, researchers say→

Palo Alto Networks to buy Expanse, which monitors exposed digital assets, for $800 million

Posted on by

Silicon Valley cybersecurity giant Palo Alto Networks plans to bolster its ability to protect customers by acquiring Expanse, a company with expertise in monitoring the internet for exposed assets that could be ripe for cyberattacks. The $800 million deal, which Palo Alto Networks expects to close sometime before the end of February, is geared toward boosting the company’s security operations center (SOC) product called Cortex. Expanse’s strength is mapping and managing the digital attack surfaces of companies, governmental agencies and other organizations. The acquisition comes during a relatively quiet year for bigger deals involving cybersecurity companies, after a rush of activity toward the end of 2019. Palo Alto Networks says San Francisco-based Expanse’s technology will help it secure parts of networks that can get overlooked when customers modernize their IT — a process that has only accelerated as more businesses and government agencies move operations to the cloud and maintain large teleworking […]

The post Palo Alto Networks to buy Expanse, which monitors exposed digital assets, for $800 million appeared first on CyberScoop.

Continue reading Palo Alto Networks to buy Expanse, which monitors exposed digital assets, for $800 million→

UK launches cyber-operation against Russian disinformation on COVID-19 vaccine, report says

Posted on by

The United Kingdom’s equivalent of the National Security Agency is actively trying to disrupt Russian attempts to cast doubt about attempts to develop a reliable coronavirus vaccine, the Times of London reported early Monday. The U.K.’s Government Communications Headquarters (GCHQ) is using digital tools originally developed to tackle online propaganda and recruitment material from the Islamic State, sources told the newspaper. GCHQ declined to confirm or deny the existence of the cyber-operation, the Times said. “GCHQ has been told to take out antivaxers online and on social media,” a government source told The Times. “There are ways they have used to monitor and disrupt terrorist propaganda.” The sources who spoke to the Times noted the GCHQ operation only has the authority to disrupt information “from state adversaries,” and not information posted online by ordinary people. It’s unclear whether the U.S. government is mounting similar campaigns against foreign disinformation related to […]

The post UK launches cyber-operation against Russian disinformation on COVID-19 vaccine, report says appeared first on CyberScoop.

Continue reading UK launches cyber-operation against Russian disinformation on COVID-19 vaccine, report says→

US seizes more domains with ties to suspected Iranian influence campaign

Posted on by

The U.S. Department of Justice’s actions against alleged Iranian influence campaigns continued this week with the seizure of 27 internet domains, including four that the feds say were targeted directly at U.S. audiences. Iran’s Islamic Revolutionary Guard Corps (IRGC) unlawfully used the domains in operations to “covertly influence” opinions in the U.S. and elsewhere, the department said in an announcement Wednesday. In early October, the feds seized 92 domains under similar allegations. Later that month, the Treasury Department sanctioned five Iran-linked organizations for spreading disinformation and making other attempts to sow discord in the U.S. As with previous announcements, U.S. officials cited help from Silicon Valley giants. “Thanks to our ongoing collaboration with Google, Facebook, and Twitter, the FBI was able to disrupt this Iranian propaganda campaign and we will continue to pursue any attempts by foreign actors to spread disinformation in our country,” said FBI Special Agent in Charge Craig […]

The post US seizes more domains with ties to suspected Iranian influence campaign appeared first on CyberScoop.

Continue reading US seizes more domains with ties to suspected Iranian influence campaign→

US seizes more domains with ties to suspected Iranian influence campaign

Posted on by

The U.S. Department of Justice’s actions against alleged Iranian influence campaigns continued this week with the seizure of 27 internet domains, including four that the feds say were targeted directly at U.S. audiences. Iran’s Islamic Revolutionary Guard Corps (IRGC) unlawfully used the domains in operations to “covertly influence” opinions in the U.S. and elsewhere, the department said in an announcement Wednesday. In early October, the feds seized 92 domains under similar allegations. Later that month, the Treasury Department sanctioned five Iran-linked organizations for spreading disinformation and making other attempts to sow discord in the U.S. As with previous announcements, U.S. officials cited help from Silicon Valley giants. “Thanks to our ongoing collaboration with Google, Facebook, and Twitter, the FBI was able to disrupt this Iranian propaganda campaign and we will continue to pursue any attempts by foreign actors to spread disinformation in our country,” said FBI Special Agent in Charge Craig […]

The post US seizes more domains with ties to suspected Iranian influence campaign appeared first on CyberScoop.

Continue reading US seizes more domains with ties to suspected Iranian influence campaign→

More suspected North Korean malware identified after US alert on Kimsuky hackers

Posted on by

Security researchers say they uncovered more tools associated with a North Korea-linked cyber-espionage group that was the subject of a U.S. government alert last week. The previously undocumented malware and server infrastructure appear to be the work of Kimsuky, an advanced persistent threat (APT) group, according to the researchers with Boston-based Cybereason. U.S. military and civilian agencies issued a joint warning about the APT on Oct. 27, saying the current threat was greatest for “commercial sector businesses,” although Kimsuky has often targeted government agencies, think tanks and other organizations connected to geopolitics. Organizations in the U.S., Europe, Japan, South Korea and Russia appear to be the targets, Cybereason says. Kimsuky also has a history of trying to gather intelligence about sanctions, nuclear policy and other issues salient to the Korean Peninsula. A U.N. Security Council report earlier this year said Kimsuky appeared to be behind hacking attempts against the international body. Kimsuky typically […]

The post More suspected North Korean malware identified after US alert on Kimsuky hackers appeared first on CyberScoop.

Continue reading More suspected North Korean malware identified after US alert on Kimsuky hackers→