Security News Bites for Week Ending July 13, 2018
Timehop Hack Compromises 21 Million Users
In a bit of good news/bad news, the social media time capsule site Timehop said that it was hacked around July 4th, but that they interrupted the hack in progress. Still the hackers got usernames, passwords, email addresses, date of birth, gender, some phone numbers and other information for 21 million users.
More importantly, the security tokens that Timehop uses to access the social media sites like Twitter were also compromised. Part of the good news is that since they detected this hack in progress, they were able to immediately disable those tokens, reducing the damage.
Still this does point out the risk of granting someone else proxy to your data – in this case, 21 million users were compromised because of a breach of a third party. The data here was not particularly sensitive – unless your FB posts are sensitive, but that is purely accidental.
One bit of bad news in all of this (beyond all the bad news above for the people who’s data was stolen). This attack in December 2017. The hacker logged on in March and April 2018 also. The hacker next logged in on June 22 and finally, stole the data on July 4, 2018.
Why is that important? Because GDPR went into effect on May 25, 2018 and the data was stolen on July 4, 2018. I hope they have deep pockets or a lot of insurance. The Register article has a table with the number of GDPR impacted records, but I am having a hard time making sense of it. For sure, it is in the millions. (Source: CNet and The Register)
Apple Adds Security Feature to iOS11.4.1
Apple has added USB restricted mode to the current release of iOS. Restricted mode locks down the lightning port of an iPhone or iPad after it has been locked for another so that it cannot be used for data access, only charging. It defaults to enabled although you can manually turn the feature off. This is designed to make it harder to hack an iPhone/iPad.
This will make it harder for law enforcement to hack into phones, but some of the hackers are saying that they have figured out a workaround. The cat and mouse game continues. (Source: The Verge)
Another Hospital Invokes Emergency Procedures Due to Ransomware
Cass Regional Medical Center in Harrisonville, MO. put ambulances on diversion and invoked its incident response protocol earlier this week due to a ransomware attack. They shut down their EHR system to make sure it did not become a casualty of the ransomware attack. The day after the attack they said that they had begun decryption of the affected systems, which, while they are not saying, is likely a result of paying the ransom and getting the decryption key from the attacker. The wording of the statement did not say that they were restoring the affected systems from their backups. Other hospitals, which chose not to pay the ransom, took weeks to recover, so the reasonable assumption is that they paid off the hackers. (Source: Cass Regional web site)
The Insider Threat is a Real Problem
We are seeing an increasing number of insider threat issues; some are accidental, some are intentional.
A hacker was found to be selling manuals for the Reaper MQ-9, a $17 million military drone for less than $200 on the dark web. He got them by hacking an Air Force Airman’s home Internet router which was not patched for a known vulnerability. It is likely that the Airman was not involved, but it is not clear if he was authorized to have the manuals on his personal home computer (Source: Defense One).
In another case, an employee of a Navy contractor stole thousands of documents from his soon to be former employer before going to work for a competitor. He was caught and convicted (Source: The Hartford Courant).
These are just two examples of many. Most do not get caught because the company that was hacked does not want the bad publicity. Still it is a multi-billion dollar a year problem.
by 