Hello and welcome to the latest issue of GlobalSign’s weekly cybersecurity wrap-up.
On the heels of the recent attack at Twitter, the tech world was abuzz about yet another attack, this one at Garmin. The undisputed GPS behemoth suffered what is being described as devastating ransomware attack that crippled Garmin’s website, disrupted customer support and more. Despite the high impact event, the company stayed silent for days but finally on Monday acknowledged it was indeed the victim of an attack that encrypted some of its systems. The attack caused a five-day outage for the company, during which time, users feared that the hackers might have also stolen their personal details along with geolocation history from the Garmin's servers. Fortunately, it appears that Garmin user data appears to be safe.
Also making headlines is the National Institute of Standards and Technology (NIST) which announced early last week that it’s getting closer to choosing a new post-quantum standard. After spending more than three years examining new approaches to encryption and data protection that could defeat an assault from a quantum computer, NIST has narrowed down the list to a final group of 15 algorithms. NIST has now begun the third round of public review and it expects to announce its final selection in approximately 18 months. This phase will help the agency decide on the small subset of these algorithms that will form the core of the first post-quantum cryptography standard.
Finally, the Securities and Exchange Commission recently announced it has observed an increase in sophisticated attacks. These attacks are targeted at broker-deals, investment advisors, and investment companies. It also impacts services to public financial institutions. The SEC’s July alert strongly encouraged all financial services industry participants to implement robust monitors and protections against cybercrimes.
There’s a lot more packed into this week’s wrap-up. Hoping you find a few minutes in your day to run through some of the articles highlighted.
Thanks and wishing you a great weekend,
Amy
Top Global Security News
Tech Republic (July 28, 2020) Experts: Devastating ransomware attack on Garmin highlights danger of haphazard breach responses
GPS titan Garmin is still recovering from the fallout of the devastating ransomware attack that has crippled its website, disrupted customer support, disabled apps, and paused communications since late July 22.
After days of opaque FAQs and brief Twitter statements, the company sent out a full response to the crisis on Monday, finally acknowledging that it was hit with a "cyberattack that encrypted" some of its systems.
Since the crisis began, employees of the company around the world took to social media to admit what the company would not: That it was hit with a damaging ransomware attack that locked them out of significant portions of their own system globally. The company courted even more controversy on Monday when inside sources told Sky News the company was somehow able to obtain "the decryption key to recover its computer files."
The Daily Swig (July 28, 2020) Promo.com data breach impacts 23 million content creators
A data breach at a popular video marketing website has exposed the personal information of 23 million users. The breach, which occurred at an unnamed third-party service, affected Israeli video marketing platform Promo.com.
Exposed data includes first name, last name, email address, IP address, approximated user location based on their IP address, and gender, as well as encrypted, hashed and salted passwords.
The breach was discovered by researchers at US cybersecurity firm Cyble, who found that the Promo.com user data was freely available on a dark net forum.
Boston Globe (July 27, 2020) Long before hack, Twitter leaders knew of porous security
Twitter has struggled for years to police the growing number of employees and contractors who have the ability to reset users’ accounts and override their security settings, a problem that CEO Jack Dorsey and the board were warned about multiple times since 2015, according to former employees with knowledge of the company’s security operations.
Twitter’s oversight over the 1,500 workers who reset accounts, review user breaches, and respond to potential content violations for the service’s 186 million daily users have been a source of recurring concern, the employees said.
The breadth of personal data most of those workers could access is relatively limited — including such things as Internet Protocol addresses, e-mail addresses, and phone numbers — but it’s a starting point to snoop on or even hack an account, they said.
BBC (July 27, 2020) Blackbaud hack: Second Welsh university's data attacked in hack
A second Welsh university has confirmed it was one of more than 20 institutions across the world to have been affected by hackers attacking a cloud provider.
The University of South Wales said it understood "email addresses and names of a section of our alumni database" were attacked in the Blackbaud hack.
The education software giant was held to ransom by hackers in May and paid an undisclosed ransom to cyber-criminals.
Engadget (July 26,2020) Report finds many US election officials vulnerable to phishing attacks
The security risks around the 2020 presidential election aren’t limited to direct attacks on the voting systems. Research firm Area 1 Security has published a report (via Wall Street Journal) warning that many election officials are using email systems that leave them vulnerable to phishing attacks and hacks. Out of more than 10,000 state and local officials, about 53 percent only had “rudimentary or non-standard” defenses against phishing. Only 18.6 percent had “advanced” safeguards in place, and 5.4 percent were using personal email addresses.
NIST (July 22, 2020) NIST’s Post-Quantum Cryptography Program Enters ‘Selection Round’
The race to protect sensitive electronic information against the threat of quantum computers has entered the home stretch.
After spending more than three years examining new approaches to encryption and data protection that could defeat an assault from a quantum computer, the National Institute of Standards and Technology (NIST) has winnowed the 69 submissions it initially received down to a final group of 15. NIST has now begun the third round of public review. This “selection round” will help the agency decide on the small subset of these algorithms that will form the core of the first post-quantum cryptography standard.
“At the end of this round, we will choose some algorithms and standardize them,” said NIST mathematician Dustin Moody. “We intend to give people tools that are capable of protecting sensitive information for the foreseeable future, including after the advent of powerful quantum computers.”
Other Industry News
Researchers Foil Phishing Attempt on Netflix Customers
DNA testing website claims data breach at rival company GEDmatch led to phishing campaign
IoT platforms: How they work and how to choose one
FBI warns US companies about Chinese tax software embedded with hidden malware: Report
HM Land Registry accepting electronic signatures a 'significant step forward' for homebuyers
Whatsapp confirms 2019 attack on Catalan politician’s cellphone
Why a cyber incident response plan is critical for trucking fleets
Like what you’re reading? Head to the Subscriber form in the sidebar to get insightful GlobalSign content delivered directly to your inbox.
