Hello and welcome back to GlobalSign’s weekly cybersecurity news wrap-up!
As always, there is plenty of activity going on. For one, people are taking a look back at exactly what happened at Twitter and how a 17-year old from Tampa, FL was able to get away with a huge hack. (As an aside, can you imagine being the parent of this kid? What is the proper parenting technique in this situation? I’d really love to know.)
Observers are also dissecting what happened at Garmin, which many sites are reporting paid hackers a fee in the millions. According to Sky News, Garmin paid the ransom to criminals who encrypted its computer files through a ransomware negotiation business called Arete IR.
Meantime, it now looks as if Canon (cameras) is the victim of a ransomware attack.
It’s like it’s just never-ending, or seems to be at times. But fortunately the bad guys don’t always get away with it! A software writer recently plead guilty to being part of a massive cybercrime ring and now he’s probably heading to prison. Check out the Engadget story below for all the details.
That’s all for this week. Hope you enjoy reading this post.
Top Global Security News
The Hill (August 5, 2020) Officials warn of increasing cyber threats to critical infrastructure during pandemic
Senators and other energy sector officials warned Wednesday that foreign adversaries are continuing to target the U.S. electric grid, noting that the COVID-19 pandemic has only underscored the dangers.
“The threat of cyberattacks by foreign adversaries and other sophisticated entities is real and it’s growing,” Senate Energy and Natural Resources Committee Chairman Lisa Murkowski (R-Alaska) said Wednesday during a committee hearing on cyber threats to the grid. “The COVID-19 pandemic has created a unique opportunity for cyber criminals to attack our networks, including critical energy infrastructure.”
Murkowski pointed to concerns over Russian targeting of the Ukrainian power grid in 2015, and to recently announced indictments by the Department of Justice against two Chinese hackers for targeting a wide range of groups including a Department of Energy site.
Reuters (August 5, 2020) Australia to spend $1.2 billion on cyber security for private sector after rise in attacks
"Australia will spend A$1.66 billion ($1.19 billion) over the next 10 years to strengthen the cyber defenses of companies and households after a rise in cyber attacks, Prime Minister Scott Morrison said on Thursday.
Cyber attacks on businesses and households are costing about A$29 billion $20.83 billion) or 1.5% of Australia's gross domestic product (GDP), Morrison told reporters in Canberra.
Just weeks ago, Canberra said it would spend A$1.35 billion over the next decade to bolster the capabilities of its chief cyber intelligence agency."
Forbes (August 5, 2020) Has Canon Suffered A Ransomware Attack? 10TB Of Data Alleged Stolen: Report
"Last week Canon suffered an outage impacting users of the canon photo storage site. Now, it has been reported that it may have been hit by a ransomware attack involving the theft of 10TB of data across multiple services. This is a breaking story, but here's what I know so far.
According to Bleeping Computer, which has a partial screenshot of what is alleged to be the ransom note, Canon was attacked during the morning of August 5 by the notorious Maze ransomware gang. A member of the cybercrime group told the publication that it had stolen 10 terabytes of 'data, private databases, etc.'
There is currently no information regarding how big a ransom is being sought, and no proof of the data it claims to have stolen. This is thought to be unconnected to the outage at the image.canon photo storage service which started July 30 and was resolved August 4. Indeed, Maze has said that they did not attack that service."
Silicon Angle (August 4, 2020) Google debuts a more flexible Certificate Authority Service in beta
"Google LLC today announced availability of a new, cloud-based Certificate Authority Service in beta testing that makes it easier for companies to set up the digital certificates they need for their public key infrastructure.
Public key infrastructure is used by companies to authenticate their users and devices in the digital world. It refers to a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The basic idea is to have one or more trusted parties digitally sign documents, or certificates, that certify that a particular cryptographic key belongs to a particular user or device.
'Recently, we’ve seen increased interest in using PKI in DevOps and device management, particularly for IoT devices,' Google wrote in a blog post today. 'But one of the most fundamental problems with PKI remains — it’s hard to set up Certificate Authorities, and even harder to do it reliably at scale. These issues are front and center for these growing use cases.'"
Business Insider (August 3, 2020) Garmin reportedly paid hackers a multimillion dollar ransom to recover files after a cyberattack
"GPS and aviation tech company Garmin paid a multi-million dollar sum to hackers in an effort to recover data that the group had held hostage in a ransomware attack last month, Sky News reported on Monday.
On July 23, Garmin's services, which range from smartwatches to aviation products, suffered a major outage. Several days later, the company confirmed that the outage was due to a cyberattack.
Bleeping Computer reported that Garmin had been targeted by Wastedlocker, a specific ransomware virus that is attributed to a Russia-based hacking group called Evil Corp, and that the group had demanded $10 million for the files."
Mortgage Finance Gazette (August 3, 2020) First electronic deed signing hailed as ‘historic moment’
"They were submitted by conveyancer, The Partnership, using SignIT from InfoTrack using electronic signature software and involved the vendor signing the deeds alongside a witness.
Peter Ambrose, CEO at The Partnership explained the significance of the event. He said: 'For us at The Partnership, who for years have offered a truly online approach with our client portal, this isn’t just a historic moment for the conveyancing profession, it also allows us to streamline the process and offer a truly digital experience from start to finish.'
He added: 'It has been a long time coming but recent events make this a must for law firms. I am very confident in the security levels provided.
'The technology acts as a witness and the certificates issued upon signing demonstrate a security you just don’t get with wet signatures.'"
Engadget (August 2, 2020) Malware writer pleads guilty to helping $568 million cybercrime ring
"Another key member of the massive Infraud cybercrime ring is likely heading to prison. Software writer Valerian Chiochiu has pleaded guilty to RICO conspiracy for helping Infraud Organization develop and use FastPOS malware that helped the group steal massive amounts of data. Infraud is now believed to have stolen enough identities, payment cards and other sensitive data to produce $568 million in losses."
Other Industry News
The Teenager Behind the Twitter Hack and How He Did It (paywall)
Volunteer hackers to help get US election cybersecurity up to par
The realities of ransomware: Five signs you’re about to be attacked
Bush Presidential Center, Boy Scouts, Texas Tech, UT Austin hit in Blackbaud ransomware attack
Google and Amazon most impersonated brands in phishing attacks
Black Hat: How your pacemaker could become an insider threat to national security
Researchers uncover vulnerabilities in devices used at industrial facilities
Why a data security sting lurks in COVID-19’s long tail
Like what you’re reading? Head to the Subscriber form in the sidebar to get insightful GlobalSign content delivered directly to your inbox.
