Security news Bites for the Week Ending March 29, 2019

We’re From the Government and WE’RE HERE TO HELP YOU!

Well, not really.

We don’t have to worry about the gov being hacked.  They just give our information away.  At least in this case there is no hard evidence that the data was misused.

FEMA hired a contractor to help it find temporary housing for 2+ million people displaced by the recent hurricanes and wildfires.  In order to validate that the people were eligible for assistance, FEMA shared data like name and last 4 of social with the vendor.

Unfortunately, they also shared people’s address, bank account number, bank routing number and other financial details.

FEMA’s OIG discovered it and FEMA says they are sorry.

FEMA then conducted an audit of the contractor and didn’t find any obvious signs of abuse/misuse.  They are also fixing the problem.

Hopefully, that is the end of it, but given how much government agencies use contractors, are you betting this situation is unique?

Are YOU oversharing information with third parties? Are you sure?

Drones are rapidly becoming a large security risk

Because, at the low end, drones are really cheap and expendable and at the high end, really sophisticated, the bad guys have figured out that that are a great tool to cause disruption and potentially even death.

We saw late last year that rogue drones shut down London’s Gatwick airport.  While this was distressing, what if, instead, a drone hovered over some crowd and released some lethal whatever.  Relatively easy to do and it could cause mass casualties.

While the drone makers are adding no fly zones around places like airports and prisons, users can hack the drone software or pick second tier targets.  Everything can’t be off limits, otherwise the drone business will end.

For very high risk targets, authorities are trying to use military anti-drone technology, but that won’t be possible to protect every possible target.

Alternatively, drones are great surveillance tools – quietly photographing potential targets and eavesdropping on WiFi signals.

And, there are many more issues – and right now, no good answers.  Source: Threatpost.

Source: ZDNet.

Norsk Hydro says that they lost $40 Mil in the first week alone after the ransomware attack

Norsk Hydro estimates that they lost over $40 million in the first week after the ransomware attack shut down many factories and forced others to run in manual mode.

The good news is that they say they have cyber insurance led by AIG (so apparently multiple interlocking policies to give them more coverage with multiple providers sharing the risk).  How much insurance they aren’t saying and what the final costs are, including any lawsuits, won’t  be known for years,

They believe it will take weeks to repair all of the affected systems, which, actually, is good, scary as that may seem.

Norsk says that they think they have cleaned all of the infected servers and are ready to begin restoring data.

My assessment from a distance is that they appear to have a well designed and well tested INCIDENT RESPONSE PROGRAM.  Still it will cost them tens of millions of dollars – maybe more.

Consider how you would respond to an incident like this.  There is no indication that this was a targeted attack, but rather a random event.

Source: Security Week.

36 New Security Flaws Found in CURRENT Cellular Networks

While the president seems hell bent at stopping Huawei from becoming an integral part of the worldwide next generation cellular network due to security risks (which is probably not a bad idea, but will no impact on security for at least 5-10 years until 5G cellular becomes the norm), the government is doing nothing about the security holes that are affecting us today and will continue to affect us for years and likely decades.

Security researchers from Korea (South, not North) have identified 51 vulnerabilities in the current cellular network, 36 of which were previously unknown.  While they have reported these issues to various parties, it is likely that hundreds of millions of phones and maybe even the network itself will never be fixed.  Source: Computing.

by