# data[].attributes.body
This news talks about Telefonica breach leaves data on millions exposed. Hacker exploited a flaw at Spanish operator Telefonica early Monday and likely exposed all the personal data of millions of the company's customers.  Data that was exposed are identity, payment information, landline, mobile, numbers, national ID numbers, addresses, bank, names, records of calls, and other data.
https://www.scmagazine.com/home/news/data-breach/telefonica-breach-leaves-data-on-millions-exposed/

# data[].attributes.body
https://www.scmagazine.com/home/news/freelancers-baited-with-job-offers-to-download-malicious-macros/

Fiverr and Freelancer.com are two largely trusted sites that are used for freelancers. Anyone can post a profile or send a request to a freelancer for their type of work, anywhere from blogging to making logos. It is hard to discern a true customer or patron from a cybercriminal. Due to the risks of doing business with mass varieties of people, one must take precautions. Disabling Marcos is important, but having a well-made sandbox to run high-risk applications in a completely isolated environment can help immensely if a threat finds its way through to your system. This will protect your system and any of your other files from being corrupted if you run across malware while allowing you to use the application as usual. As soon as a threat is noticed, it must be reported to the company so they can enforce their accountability to their users and their business.

Aside from reporting such attacks from to entities such as Fiverr and Freelancer.com, it’s important to share suspicious activity with email providers. While somewhat dated, Google’s own software engineer Ela Czajka wrote a fairly detailed post in 2012 detailing exactly how and why various messages get moved over to your spam folder ( https://gmail.googleblog.com/2012/03/learn-why-message-ended-up-in-your-spam.html ), as well as linking to an in-depth guide explaining all-things spam-related ( https://support.google.com/mail/answer/1366858?hl=en ). The takeaway from both of these resources is that a bulk of spam and malicious emails are caught by service providers because end-users report suspicious senders and prompt providers to investigate. Marking such senders as spam or otherwise malicious helps keep other users safe, and ensures that that particular sender’s account won’t make their way into your inbox in the future.

Businesses like Fiverr and Freelancer.com have a duty of ensuring accountability on a large scale. That being said, if businesses don’t have controls in place to deter or counteract the people who would break the rules and exploit the resources they have access to, their users can end up in compromised and have their assets at risk. Companies ensure their accountability through auditing, thus allowing them to know what was done and when because of the records they hold of the actions. By using a combination of established best practices as a situation demands and routine auditing, companies can protect themselves and those they serve.

# data[].attributes.body
This Article talks about how a data mining software was being used in a breach with a network packet sniffer to steal personal information from Click2Gov a government portal used to pay for US permits. FireEye was used in the investigation and discovered the data breach and let known how it was completed, so it can be prevented in the future.

https://www.scmagazine.com/home/news/report-hackers-used-data-mining-tool-network-sniffer-to-steal-click2gov-information/

# data[].attributes.attachment_link.readable_text
The malicious actor behind a year-old campaign targeting the web payment portal Click2Gov appears to have been using a malicious webshell, data mining utility program and network sniffer to steal information from users, according to a new report from FireEye researchers.

The researchers note that while the perpetrator's tools and techniques are "generally consistent with other financially motivated attack groups," this particular actor has "demonstrated ingenuity in crafting malware exploiting Click2Gov installations, achieving moderate success."

Originally a product of software company Superion, which was recently acquired by CentralSquare Technologies, Click2Gov is a portal used by government entities to accept payments for permits, licenses, fines and utilities. In October 2017, the company disclosed the discovery of suspicious activity indicative of a breach, and by June it was widely reported that tens of thousands of local government customers across the country had their information exposed.

In their report, FireEye researchers explain that the attacker likely exploited one or several Oracle Web Logic vulnerabilities to compromise Click2Gov webservers, allowing them at that point to upload a variant of the publicly available SJavaWebManage a webshell to achieve persistence, interact with infected hosts and execute commands.

The variant deviated from the original version in that it had, among other changes, different variable names (possibly to hinder detection), Chinese characters that were altered to English, and the added ability to manipulate timestamps on the server.

For the next step, FireEye reports, the attacker would "restart a module in DEBUG mode using the SJavaWebManage CMDS page after editing a Click2Gov XML configuration file," causing the Click2Gov module to log payment card data in plain text to its log files. At this point, the actor would use the webshell to upload and execute a command line data mining utility nicknamed "FIREALARM," which parses the plain-text logs to retrieve payment card data, format it, and print it to the console.

Additionally, the actors would upload "SPOTLIGHT," a network sniffer that improves persistence and data collection, "ensuring the mined data would not be lost if Click2GovCX log files were deleted by an administrator," the blog post continues.

Although FireEye is unable to connect the attacker with any known threat groups that have similar motives, researchers believe the campaign is likely the work of a team of individuals who "will continue to conduct interactive and financially motivated attacks."

To counter this threat, FireEye recommends that Click2Gov customers exercise diligent patch management, implement a file integrity monitoring solution for e-commerce webservers, and ensure that web service accounts run at least privilege.

# data[].attributes.attachment_link.title
Report: Hackers used data mining tool, network sniffer to steal Click2Gov information | SC Media

# data[].attributes.attachment_link.description
The malicious actor behind a year-old campaign targeting the web payment portal Click2Gov appears to have been using a malicious webshell, data mining utility program and network sniffer to steal information from users, according to a new report from FireEye researchers.

# data[].attributes.body
This article shows vulnerability assessment and penetration done by Fashion Nexus, to identify a server containing a database with customer information, to be unsecured. Though the exposed database contained names, emails, birth dates, and phone numbers, it did not contain any financial information of customers. GO ETHICAL HACKERS!

# data[].attributes.attachment_link.readable_text
A server containing a database holding customer information pertaining to various U.K.-based online fashion retailers was discovered to be insecure after it was breached by a white-hat hacker on July 9.

Third-party IT and e-commerce services provider Fashion Nexus, which manages the server in question, disclosed in an online notification that roughly 922,000 unique email addresses were left exposed by the server - although 280,000 of these addresses had been previously exposed "by audit processes in brute force login attempts from external unrelated already-breached email lists."

However, security expert Graham Cluley reported a higher number, writing in a July 30 blog post that the faulty server exposed data on approximately 1.3 million shoppers.

Fashion Nexus's clients Jaded London, AX Paris, Elle Belle Attire, Perfect Handbags,and Traffic People - all apparel and accessories merchants - are affected. Cluley reported that DLSB was impacted as well, but Fashion Nexus contended that this retailer's data was not taken.

Potentially exposed data includes salted password hashes, names, birth dates, email addresses, phone numbers, and some shipping addresses, but not financial information.

Crediting the insecure server's discovery to ethical hacker Taylor Ralston, Cluley said it is unclear what the cause of the breach is. However, Fashion Nexus's statement did briefly refer to an unspecified bug, noting, "The breach was quickly identified and the vulnerability removed." The company also said that the Information Commissioner's Office (ICO) was informed of the incident.

Additionally, Cluley reported that Fashion Nexus' sister company White Room Solutions told him that "the breach was via a site that has subsequently been taken down and is considered resolved."

# data[].attributes.attachment_link.title
Insecure server holding U.K. fashion retailers' customer data breached by white hat | SC Media

# data[].attributes.attachment_link.description
A server containing a database holding customer information pertaining to various U.K.-based online fashion retailers was discovered to be insecure after it was breached by a white-hat hacker on July 9.

# data[].attributes.body
App "Teensafe", an app for iOS devices meant for parents to keep surveillance on their children's web browsing, texting, and other usage, had a vulnerable server which security specialists found that Apple ID's and their passwords were stored in plaintext without any encryption, the emails associated with parent Apple accounts stored in plain text, and the app required users to have two factor authentication turned OFF in order to use it.

# data[].attributes.attachment_link.readable_text
Parents probably don't appreciate the irony - the TeenSafe app they use to monitor their children's devices instead has left personal information exposed after a server affiliated with the app and hosted on AWS was left open to the public.

This enabled anyone who ran across the server could access Apple IDs, user ID and passwords stored in plaintext.

"It is absolutely shocking that a company that promotes security and protecting your most valuable assets, your children, have completely left sensitive data unsecured available to cybercriminals who will abuse it," said Joseph Carson, chief security scientist at Thycotic. "It might be time for TeenSafe to change their tagline to 'TeenSafe, built by parents who have no idea about security and for parents who don't care about security.'"

Parents use the app to monitor their children's web browser history, location data, third-party apps, text messages and the like. The app touts its security measures, including encryption, but requires that parents turn off two-factor authentication to use it, leaving sensitive information vulnerable to an attacker. "The ironic thing is that they require two-factor authentication to be turned off (yes turned OFF) and that they store passwords in clear text," said Carson. "It's surprising that companies still do such irresponsible actions against cybersecurity best practices."

Carson warned that "passwords should never be left exposed and you should never turn off two-factor authentication for such apps." Instead, he advised, "communicate more with your children so you do not have to spy on them."

Calling the TeenSafe fail "a result of poor judgment and bad security processes," Chris Morales, head of security analytics at Vectra, called the company "irresponsible" for storing parental email addressed "associated with their corresponding child's Apple ID email address, the child's device name, unique identifier and plaintext passwords for the child's Apple ID in the cloud without proper security controls."

Rishi Bhargava, co-founder at Demisto, called clear text passwords "evil" and said there isn't a good reason "to store any password in a database without encryption. There are so many open source libraries to do basic encryption that encrypting passwords is not additional work at all."

The exposed server, which compromised the data of 10,200 accounts, along with a second server was discovered by security researcher Robert Wiggins, who is based in the U.K., according to a report by ZDNet. Open servers in the cloud have become increasingly common much to the glee of bad actors. "Properly configuring AWS for security requires a new set of skills and understanding of how to manage cloud resources," said Sanjay Kalra, co-founder and Chief Product Officer at Lacework. "It is unfortunately too easy to overlook the configuration of AWS resources such as S3 buckets where data is often stored. Hackers have discovered that many organizations have left these buckets open to public access."

Morales noted, "cloud is a shared responsibility and as a provider of a cloud service" and "TeenSafe is responsible for securing their customer's information in the cloud. Even if this server was on-premises at TeenSafe within their perimeter security controls, this type of data should be secured with encryption and administrative access controls."

Mukul Kumar, Chief Information Security Officer and VP of Cyber Practice at Cavirin, a Santa Clara, Calif.-based provider of cybersecurity risk posture and compliance for the enterprise hybrid cloud:

"Under the shared responsibility model, said Mukul Kumar, CISO and vice president of cyber practice at Cavirin, "TeenSafe has the responsibility to protect the data, but their IT team obviously didn't uphold their part of the (shared responsibility) bargain."

But cloud providers, even those like Amazon that pros said offer security, "probably need to do more, and in fact they are moving in this direction, to protect the cloud assets of organizations with little or no expertise," said Kumar.

"When spinning up on EC2 instance and S3 storage bucket is almost as easy as learning how to ride a bike, the providers need to implement process checks that take into account little or no cloud knowledge," he said. "Parents deploying these types of applications also need to better understand the nuances of these applications, but we know that won't happen."

TeenSafe should count itself lucky the lapse in security and privacy was discovered before the GDPR requirements take effect later this week. "With only 4 days until the EU GDPR is enforced, TeenSafe appears to have been lucky with the timing of this incident," said Carson. "However, I'm sure it might not be the last we hear about how this impacts EU citizens data which should make May 26 (the day after the GDPR compliance deadline) an interesting day related to this particular data breach."

# data[].attributes.attachment_link.title
TeenSafe app exposes data on more than 10K accounts | SC Media

# data[].attributes.attachment_link.description
Parents probably don't appreciate the irony - the TeenSafe app they use to monitor their children's devices instead has left personal information exposed after a server affiliated with the app and hosted on AWS was left open to the public. This enabled anyone who ran across the server could access Apple IDs, user ID and passwords stored in plaintext.

# data[].attributes.body
Article offers up 4 questions that healthcare organization should ask before moving their data to the cloud. These question cover auditing the data to know what is being protected and how as well as complying with HIPAA regulations to what to do in case of a breach and who is accountable.
https://www.scmagazine.com/home/opinions/four-security-questions-healthcare-organizations-must-address-when-moving-to-the-cloud/

# data[].attributes.body
Vulnerabilities that have been nicknamed Peekaboo were discovered in NUUO NVRMini2, a video software used in surveillance cameras. These vulnerabilities could potentially allow attackers to potentially grant themselves privileges to not only view, but even alter output from these cameras. These vulnerabilities were discovered by Tenable, the company that provides the Nessus vulnerability scanning tool. This discovery allowed NUUO to start working on a patch before a major attack occurred.

# data[].attributes.attachment_link.readable_text
Multiple vulnerabilities, including a zero-day, have been uncovered in NUUO NVRMini2 video software that, if exploited, could expose thousands of surveillance cameras to remote code execution, allowing the video feed to be viewed and altered by unauthorized people.

Tenable recommends those affected to update to NUUO NVRMini2 v. 3.9.1.

The flaws, dubbed Peekaboo, were discovered by Tenable Research and potentially affect more than 100 brands and 2,500 camera models. NUUO software and devices are commonly used for commercial web-based video monitoring and surveillance. The vulnerabilities could allow attackers to increase their privileges to a level where the they could not only disconnect the live feed, but also replace it with something entirely different like a static image in order to confuse security personnel.

"The Peekaboo flaw is extremely concerning because it exploits the very technology we rely on to keep us safe. As more IoT devices are brought online, the attack surface expands and introduces new risks to both consumers and organizations," said Tenable CTO and co-founder Renaud Deraison.

NUUO versions 3.9.0 and earlier are affected.

The first problem, CVE-2018-1149, is that the implemented session handling mechanism doesn't validate the user's input properly, which an attacker can exploit to trigger stack overflow in session management routines in order to execute arbitrary code. Next, the NUUO NVRMini2 web server, CVE-2018-1150, contains a backdoor PHP code that when enabled would allow an unauthorized individual to change a password for any registered user except the system administrator.

Tenable said it has notified NUUO of the issues and although a patch has not been issued by that company it did say one is under development. In the meantime, Tenable is recommending those using the vulnerable devices disconnect them from the internet or update the software to version 3.9.1.

"Unfortunately, many users will be unaware that their devices are vulnerable because NUUO software is also integrated into products from other vendors. In these cases, users should contact their video surveillance vendors to confirm whether they are exposed and when a patch will be released," Tenable said.

The company has also created a plug in to assess whether or not a system is at risk.

# data[].attributes.attachment_link.title
Zero day found in NUUO video software allowing camera takeover | SC Media

# data[].attributes.attachment_link.description
Multiple vulnerabilities, including a zero-day, have been uncovered in NUUO NVRMini2 video software that, if exploited, could expose thousands of surveillance cameras to remote code execution, allowing the video feed to be viewed and altered by unauthorized people. The flaws, dubbed Peekaboo, were discovered by Tenable Research and potentially affect more than 100 brands and 2,500 camera models.

# data[].attributes.body
This article reveals the increase in non-compliance fines for several industries. Financial, retail, healthcare, technology, media and energy & utility industries all saw major increases in non-compliance costs from 2011 to 2017. The largest increase involved healthcare organizations at 106% and the lowest coming from Energy & Utility companies at 6%. This article also talks of the importance of a centralized data governance program in establishing a procedure for the handling of data securely and the highly recommends the regular use of audits. These audits are proven to save millions across industries in studies cited in the article and will ensure sensitive data is not mishandled.

# data[].attributes.attachment_link.readable_text
Data is King. Understanding where it travels, where it resides and how to best protect it is no longer just an option-it's a necessity for all businesses. Organizations are burdened with the responsibility of protecting customer, partner and vendor data, and storing it as securely as possible. Government mandates and regulations such as the General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA) and Sarbanes Oxley are constructed to help us do just that: keep private data, private.

The enforcement of these privacy regulations underscores the new era of complex policies developed to protect data at the individual level from increasingly sophisticated cyberattacks. We're just getting started, as more data protection regulations and frameworks are expected to be developed and implemented globally in the near future.
Pay now, or, pay much, much more later
Globalscape recently partnered with the Ponemon Institute to quantify the cost of compliance and non-compliance to businesses. The report, called True Cost of Compliance with Data Protection Regulations, found that if companies invested in compliance activities upfront-such as audits, enabling technologies, training and expert staffing-that they could avoid the astronomical financial impact of non-compliance.

Consider these staggering numbers: Non-compliance costs businesses on average $14 Million; a 45 percent increase since 2011. For those businesses that do comply, costs averaged around $5.47 million annually-less than half the cost of non-compliance.
Factors of compliance readiness
Compliance readiness varies by organizational size and industry. When adjusting compliance and non-compliance costs by each organization's headcount, smaller companies (<5000 employees) incur substantially higher per-capita compliance costs than larger companies (> 5,000 employees).

Understandably, organizations in heavily regulated industries have the highest compliance costs. For example, we saw a spread of $7.7 million for media to more than $30.9 million for financial services. Between 2011 and 2017, healthcare organizations, and technology companies experienced the highest growth in cost at 106 percent and 99 percent, respectively. Energy and utilities, and retail companies experienced the lowest growth in total compliance cost at 6 percent and 40 percent, respectively, according to our report.
Reducing compliance costs
Whether you choose to invest in technologies such as managed file transfer (MFT), data loss prevention, data classification or governance, risk and compliance solutions, or better enforcement of current data protection policies, the risks and rewards from a cost perspective are clear. Keep the following in mind on your journey to compliance:
Evaluate data governance programs and auditing process
The deployment of a centralized data governance program can reduce total compliance costs by $3.01 million, according to our report. Similarly, we found that conducting compliance audits reduces total compliance costs by $2.86 million. Governance can help organizations maintain the appropriate oversight required to understand, track and audit where sensitive data is shared, and ultimately, stored. This is increasingly important as there are specific response times or data protection measures required in regulations like GDPR or PCI DSS. Regular audits can provide details on where an organization fails to meet compliance measures before an incident or regulatory body enacts fines or other penalties.

Among individual regulations, 90 percent of survey respondents said they believed GDPR will be the most difficult to achieve within their organization. PCI-DSS was the second most difficult, followed by U.S. state laws and HIPAA.
Does your managed file transfer solution meet compliance mandates?
Data privacy matters. It's the core reason why compliance regulations are in place. Do you understand how data moves throughout your organization? Are you certain that your MFT solution meets compliance mandates?
Empowering employees
In addition to complying with regulatory guidelines, organizations should provide employees with the right training and tools to ensure they're consistently working in ways that improve their security posture. To counter the problem of end user error, or poor data sharing practices, companies should consider offering their workers intuitive, convenient tools that automatically provide higher levels of protection, such as encryption. This strategy aims to make sure team members don't disregard best practices and resort to less dependable consumer-grade programs.
Ensuring data privacy is worth the long-term investment
Organizations can implement preventative measures to better control, integrate and govern data so that compliance is easily achievable and staggering costs are avoided. Through the use of technology, regular audits and the strengthening of governance and visibility structures, these compliance mandates are not only achievable but worth the long-term investment.

Peter Merkulov serves as Chief Technology Officer at Globalscape. He is responsible for leading product strategy, product management, product marketing, technology alliances, engineering and quality assurance teams. Merkulov has more than 16 years of experience in the IT security industry, specifically in product strategy and management. Merkulov has a Masters from Moscow State Institute of International Relations (University) MFA Russia MGIMO.

From the May 01, 2018 Issue of SC Media

# data[].attributes.attachment_link.authors[].name
Peter Merkulov, Chief Technology Officer, Globalscape

# data[].attributes.attachment_link.title
The staggering costs of non-compliance | SC Media

# data[].attributes.attachment_link.description
Data is King. Understanding where it travels, where it resides and how to best protect it is no longer just an option-it's a necessity for all businesses. Organizations are burdened with the responsibility of protecting customer, partner and vendor data, and storing it as securely as possible.

# data[].attributes.body
This article explains how a botnet was searching for cryptocurrency mining rigs with exposed port 3333, which is the default port an Ethereum miner uses for RPC. If found, the device is forced to join another mining pool and uses the owners ETH wallet. The author says the best defense was to disable the remote admin API. He also mentions that by using network based intrusion detection systems, the abnormal use of the "miner_file" should be easily detected.

# data[].attributes.attachment_link.readable_text
According to a blog post by researchers at Qihoo 360 Netlab, hackers are targeting port 3333. This is frequently used for remote management features by cryptocurrency-mining hardware. The researchers indicated that this scanning activity started 11 May in a Tweet earlier this month.

Also following up the botnet was GreyNoise Intelligence. According to a tweet, it had observed a large spike of TCP port 3333 scan traffic today. "This is the default port for the "Claymore" dual Ethereum/Decred cryptocurrency miner," it said.

"Once the attacker identifies a server running the Claymore software they push instructions to reconfigure the device to join the "dwarfpool" mining pool and use the attacker's ETH wallet," Greynoise researchers added.

"Around 95 percent of the devices scanning for port 3333 today are located in the same residential ISP in Mexico as the majority of the hosts affected by the GPON vulnerability disclosed earlier this week."

Netlab confirmed Greynoise's discovery. "The source of this scan is about 17k independent IP addresses, mainly from Uninet SA de CV, telmex.com, located in Mexico," Netlab researchers said.

Johannes B. Ullrich, dean of research at SANS ISC, also managed to identify the botnet from observing his honeypots.

"I have no idea why someone would have the unauthenticated JSON RPC of their miner exposed to the internet, but then again, these attacks are targeting people who are into cryptocoin mining, so everything is possible," he said in a blog post.

In a follow-up exclusive interview with SC Media UK, Ullrich said the attack will for the most part affect hobbyists running this type of cryptocoin miner.

"The best defence is to not enable the affected remote administration API. The software also allows users to run the API in a feature reduced mode that will not allow any "write" features to alter configurations or overwrite the "reboot" file. In addition, the API should be configured to run on a non-standard port," he added.

Ullrich added that organisation would detect that the miner is no longer producing any revenue. "In addition, one may see additional software running on the mining equipment. Using network-based intrusion detection systems, it is possible to detect the use of the "miner_file" command which is an unusual command and unlikely to be used as part of normal operations," he said.

To clean up any malware on affected devices, in this case, it should be simple to restore the reboot.bat file and verify the miner configuration.

"So far, all the attacks we have seen will target the miner itself. However, the vulnerability could be used to execute any arbitrary command. Like with any intrusion, a complete forensics assessment should be conducted on the system and it is likely safer to just rebuild the system then to clean up individual artefacts left behind by the attacker," said Ullrich.

Chris Doman, security researcher at AlienVault, told SC Media UK that his firm had also noticed the uptick in activity and added that the exploits and subsequent activity are normally easily detected if you perform network detection. "Unofficial patches are available for those with vulnerable devices, though replacing the affected devices is best if possible," he said.
This article originally appeared on SC Media UK

# data[].attributes.attachment_link.title
Satori botnet searching internet for open Ethereum mining rigs | SC Media

# data[].attributes.attachment_link.description
According to a blog post by researchers at Qihoo 360 Netlab, hackers are targeting port 3333. This is frequently used for remote management features by cryptocurrency-mining hardware. The researchers indicated that this scanning activity started 11 May in a Tweet earlier this month. Also following up the botnet was GreyNoise Intelligence.