Category Archives: reuters

U.S. Govt. Apps Bundled Russian Code With Ties to Mobile Malware Developer

Posted on by

A recent scoop by Reuters revealed that mobile apps for the U.S. Army and the Centers for Disease Control and Prevention (CDC) were integrating software that sends visitor data to a Russian company called Pushwoosh, which claims to be based in the United States. But that story omitted an important historical detail about Pushwoosh: In 2013, one of its developers admitted to authoring the Pincer Trojan, malware designed to surreptitiously intercept and forward text messages from Android mobile devices. Continue reading U.S. Govt. Apps Bundled Russian Code With Ties to Mobile Malware Developer→

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

Posted on by

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts say the incident may be just the first of many such disclosures. Continue reading U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise→

FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals

Posted on by

On Monday, Oct. 27, KrebsOnSecurity began following up on a tip from a reliable source that an aggressive Russian cybercriminal gang known for deploying ransomware was preparing to disrupt information technology systems at hundreds of hospitals, clinics and medical care facilities across the United States. Today, officials from the FBI and the U.S. Department of Homeland Security hastily assembled a conference call with healthcare industry executives warning about an “imminent cybercrime threat to U.S. hospitals and healthcare providers.” Continue reading FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals→

NY Charges First American Financial for Massive Data Leak

Posted on by

In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant First American Financial Corp. had exposed approximately 885 million records related to mortgage deals going back to 2003. On Wednesday, regulators in New York announced that First American was the target of their first ever cybersecurity enforcement action in connection with the incident, charges that could bring steep financial penalties. Continue reading NY Charges First American Financial for Massive Data Leak→

Indian Bank Hit in $13.5M Cyberheist After FBI ATM Cashout Warning

Posted on by

On Sunday, Aug. 12, KrebsOnSecurity carried an exclusive: The FBI was warning banks about an imminent “ATM cashout” scheme about to unfold across the globe, thanks to a data breach at an unknown financial institution. On Aug. 14, a bank in India disclosed hackers had broken into its servers, stealing nearly $2 million in fraudulent bank transfers and $11.5 million unauthorized ATM withdrawals from more than two dozen cash machines across multiple countries. Continue reading Indian Bank Hit in $13.5M Cyberheist After FBI ATM Cashout Warning→

Monday, July 30: Dtex, Insider Threat, Privacy in the News: California Data Breach Horror Stories Feature Vulnerable Insiders, Trump Administration Focusing on Privacy Regulation

Posted on by

Last week, VentureBeat reporter Chris O’Brien took a deep look at some of our research about leading causes of data breaches in the State of California. In Daily horrors of cybersecurity detailed in California’s data breach reports, O&#8217… Continue reading Monday, July 30: Dtex, Insider Threat, Privacy in the News: California Data Breach Horror Stories Feature Vulnerable Insiders, Trump Administration Focusing on Privacy Regulation→

Monday, July 9: Dtex, Insider Threat, Privacy News: California Passes West Coast GDPR; Insider Threat Too Much Even for Security Company; Drones, Law Enforcement, Activity Monitoring and Transparency

Posted on by

May and June were huge months for privacy. July is already big for the Insider Threat. In May, GDPR enforcement commenced. In June, The United States Supreme Court ruled that law enforcement agencies must have a warrant to search cellphone location dat… Continue reading Monday, July 9: Dtex, Insider Threat, Privacy News: California Passes West Coast GDPR; Insider Threat Too Much Even for Security Company; Drones, Law Enforcement, Activity Monitoring and Transparency→

A software vulnerability could have been used to siphon over $15 million from Mexican banks

Posted on by

Over $15 million was stolen from Mexican banks this month by thieves who created fake money orders and phony accounts to withdraw funds from dozens of branches, according to media reports.  The criminals sent hundreds of fake money orders to move hundreds of thousands of pesos between at least five of Mexico’s biggest banks, whereafter accomplices quickly withdrew cash, Reuters reports.  A vulnerability in software that was used to connect payment systems between the banks is thought to have been exploited by the thieves, allowing them to create the fake orders, Lorenza Martinez, head of operations for Mexico’s central bank told Reuters.  Though initial estimates said that 300 million pesos ($15.2 million) had been stolen, other estimates have the amount closer to 400 million pesos ($20.3 million).  “There’s no evidence that would allow us to say with certainty that this is over,” said Mexico’s central bank Governor Alejandro Diaz de […]

The post A software vulnerability could have been used to siphon over $15 million from Mexican banks appeared first on Cyberscoop.

Continue reading A software vulnerability could have been used to siphon over $15 million from Mexican banks→

Report: Kaspersky Lab to open new data center in Switzerland to curb espionage suspicions

Posted on by

Hoping to curb suspicions surrounding its alleged relationship to Russian intelligence, Moscow-based cybersecurity company Kaspersky Lab is set to start building a new data center in Switzerland, Reuters reports.  The aim is to address recent concerns that Russian spies have supposedly leveraged the anti-virus platform to steal confidential files, according to documents seen by Reuters. In an official statement, the company explains that this new building is part of their larger Global Transparency Initiative. “We understand that during a time of geopolitical tension, mirrored by an increasingly complex cyber-threat landscape, people may have questions and we want to address them,” a company statement reads.  The Swiss lab will store and analyze malicious computer files with unusual characteristics that come from customers geographically located in the United States and European Union. Only “abnormal” files will be sent on to Kaspersky headquarters in Moscow for further manual review. A source told Reuters that 99.6 percent […]

The post Report: Kaspersky Lab to open new data center in Switzerland to curb espionage suspicions appeared first on Cyberscoop.

Continue reading Report: Kaspersky Lab to open new data center in Switzerland to curb espionage suspicions→

Registered at SSA.GOV? Good for You, But Keep Your Guard Up

Posted on by

KrebsOnSecurity has long warned readers to plant your own flag at the my Social Security online portal of the U.S. Social Security Administration (SSA) — even if you are not yet drawing benefits from the agency — because identity thieves have been registering accounts in peoples’ names and siphoning retirement and/or disability funds. This is the story of a Midwest couple that took all the right precautions and still got hit by ID thieves who impersonated them to the SSA directly over the phone.
In mid-December 2017 this author heard from Ed Eckenstein, a longtime reader in Oklahoma whose wife Ruth had just received a snail mail letter from the SSA about successfully applying to withdraw benefits. The letter confirmed she’d requested a one-time transfer of more than $11,000 from her SSA account. The couple said they were perplexed because both previously had taken my advice and registered accounts with MySocialSecurity, even though Ruth had not yet chosen to start receiving SSA benefits. Continue reading Registered at SSA.GOV? Good for You, But Keep Your Guard Up→