← Cybersecurity Headlines
Cybersecurity Headlines
Halliburton cyberattack costs, Israel credit card DDoS, Forth announces breach
00:08:00
Loading summary
Transcript1 lines
- [00:00]
Steve Prentice
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Tuesday, November 12, 2024. I'm Steve Prentice. Cyberattack cost Halliburton $35 million thus far following up on a story we covered in late August, the attack on Halliburton, one of the largest oilfield service providers in the world, cost the company $35 million by the end of September. Ransom Hub is believed to be the group behind the attack, but this has not been officially confirmed. According to Security Week, quote, Halliburton has yet to confirm that the incident was a ransomware attack, but its brief description suggests that it was. The company has confirmed that hackers accessed and exfiltrated information from its corporate Systems. End quote. DDoS attack makes credit card readers malfunction in Israel Customers at supermarkets and gas stations in Israel were apparently unable to make payments during a DDoS attack that had been launched against the payment gateway company HIP and its Credit Guard product. The attack, which lasted around an hour, disrupted communications between the card terminals and the wider payment system, but did not steal information or payments. An Iran linked hacker group has apparently claimed responsibility, but this has not been confirmed. This is far from the first time that this type of attack has happened in Israel. The most recent prior to this occurred in October at the payment firm Sheba. Debt relief firm 4th announces data breach for customers and non customers the breach, which occurred on May 21st of this year, now sees debt relief solutions provider fourth, its full legal name being set forth, notifying one and a half million individuals that their personal information has been compromised. Although the breach occurred in May, it was on July 1 that the company confirmed that attackers had accessed certain documents on its systems. The affected individuals might not even have been customers of Forth, but may be customers of Centrix software, which provides cloud based customer relationship management solutions. Powered by the Set Forth platform, this platform allows businesses to collect and share consumer information with their permission between its users. This, according to the company. Secure by Design hits six month mark Progress being made in an interview with recorded Future News, Jack Cable, a senior technical advisor at CISA who has been championing the effort, says 248 companies signed the pledge and most are taking it seriously. Secure by Design includes a pledge from these software companies to the Biden administration and to their own customers that they would adopt seven key digital security practices within a year. Cable says he is seeing significant impacts across the Internet ecosystem and that the progress has exceeded expectations. He has pointed out Microsoft's expansion of Multi Factor authentication, Google's improvements to secure code development, and Fortinet's new requirement that customers receive automatic security updates as examples. Thanks to today's episode's sponsor, Threat Locker do zero day exploits and supply chain attacks keep you up at night? Well, worry no more. You can harden your security with Threat Locker. Threat Locker helps you take a proactive default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit threatlocker.com that is T H R E A T L O C k e r threatlocker.com hackers using zip file concatenation to evade detection this new technique was identified by researchers at Perception Point, who discovered a concatenated zip archive hiding a Trojan while analyzing a phishing attack that lured users with a fake shipping notice. In essence, threat actors create two or more separate zip archives and then hide the malicious payload in one of them, leaving the rest with innocuous content. These separate files are concatenated into one by appending the binary data of one file to the other, merging their contents into one combined zip archive. Although the final result appears as one file, it contains multiple zip structures, each with its own central directory and end markers. This allows the malware to bypass security solutions. Windows 11 will add a Share button to the Start menu and the taskbar in case customers feel they do not already have enough ways to share files, links, or text. A button will soon be available to allow everyone to share via email to nearby devices or installed apps like X. This is largely because not all apps do have this option individually. This new feature from Microsoft is still being tested in preview builds, and there is no confirmed deadline or date for the release of this feature. New version of remcos RAD appears According to researchers at Fortinet. This is a new variant of the commercial malware known as remcos rat. Remcos itself is a legitimate remote administration tool that allows regular users to operate other computers remotely. Threat actors, however, use this technology for more malicious activities. In this new situation, victims receive a phishing message containing a malicious Excel document disguised as a purchase order. This Excel file accesses a shortened URL that redirects to a specific IP address, and the process unfolds from there. The malicious code maintains persistence by adding a new autorun item to the system. Registry DNA firm holding highly sensitive data vanishes without warning Atlas Biomed is a company based in London, England, and which offers to provide insights into people's genetic makeup and predisposition to certain illnesses. It, however, has recently ceased operations without telling its customers what has happened to the highly sensitive data that customers shared with them. All activity on social media has ceased and its London office stands empty. The company has links to Russia. It used to have eight official positions, although according to the BBC, four of its officers have resigned and two of the apparently remaining officers are listed at the same address in Moscow, as is a Russian billionaire who is described as a now resigned director. Talk about data privacy concerns and many CISOs will be sympathetic. Businesses won't make expensive changes to infrastructure or procedures just on principle. CISOs must make a case to the business to make these changes before an incident occurs. But how do you start that conversation? That's one of the segments we go deep on in this week's episode of the CISO series podcast. Look for Wait. We can prioritize data privacy before an incident in your favorite podcast app. I'm Steve Prentice reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.