|
IT Security News Blast – 6-17-2021
Health care ransomware attacks: Oklahoma health system driven to EHR downtime
Stillwater Medical Center was hit with a ransomware attack on June 13 and is currently operating under electronic health record downtime as it attempts to bring its systems back online. The health system operates a number of care sites, specialist offices, hospitals and clinics in Oklahoma.
https://www.scmagazine.com/home/health-care/health-care-ransomware-attacks-oklahoma-health-system-driven-to-ehr-downtime/
NHS Test and Trace strengthens cyber defences
NHS and other critical national infrastructure organisations face increasing risks from supply chain cyber-attacks. These risks can include third parties failing to encrypt sensitive data when it is being transferred. Risk Ledger’s platform will provide NHS Test and Trace with visibility of its supply chain and a set of data to identify, measure and mitigate security risks at scale.
https://www.healthcareitnews.com/news/emea/nhs-test-and-trace-strengthens-cyber-defences
Why cyber gangs won't worry about US-Russia talks
However President Putin told reporters that the Colonial Pipeline attack and others have "nothing to do with Russian authorities". Mr Putin also claimed he had been told by US sources that most cyber-attacks originate from the US, and that Russian attempts to get information about attacks originating from the US are being ignored.
https://www.bbc.com/news/technology-57504007
The Top Ten Industries Under Cyber Attack
According to the most recent NETSCOUT Threat Intelligence Report, vital pandemic industries such as ecommerce, streaming services, online learning, and healthcare all experienced increased attention from malicious actors targeting the very online services essential to remote work and online life.
https://www.csoonline.com/article/3621659/the-top-ten-industries-under-cyber-attack.html
Cyber EO May Move Software Supply Chain Security From Neutral to Highway Speed
Industry can be transparent about software that is built and delivered to government customers. It’s doable today. The software bill of materials (SBOM) mandate in the EO will make customers more confident in the applications they are running, and ultimately, will reduce the government’s cybersecurity risk.
https://www.meritalk.com/articles/cyber-eo-may-move-software-supply-chain-security-from-neutral-to-highway-speed/
Cybersecurity: The next financial crisis could be cyber
“This lightly state-sponsored warfare spilling into the private enterprise space has – thinking optimistically – served as a wake-up call for all organisations, and private equity firms in particular, to understand the potential for what might be lying around the corner,” he says.
https://www.funds-europe.com/june-2021/cybersecurity-the-next-financial-crisis-could-be-cyber
The risk of cyber attacks on the food and agriculture supply chain
“This vast dependence upon complicated networks of cyber devices and their broad connectivity results in enormous risk, particularly in the face of nefarious actors who seek to harm our infrastructures or leverage this risk for illicit gain. As demonstrated very recently with the highly consequential ransomware attacks upon our energy and food sectors, the unprotected may pay a high price.
https://twin-cities.umn.edu/news-events/risk-cyber-attacks-food-and-agriculture-supply-chain
TSA preps second pipeline cyber directive
Sonya Proctor, the assistant administrator for surface operations at TSA, told two subcommittees of the House Homeland Security Committee that the new directive will be a "security sensitive information" document and "will be rather prescriptive in terms of the mitigation measures required."
https://fcw.com/articles/2021/06/15/tsa-cyber-directive-pipeline-hearing.aspx
Luxury cars and $100 bills: Police bust ransomware gang in Ukraine
The gang, known as Cl0p, has hacked a number of American targets, including the University of Miami, Florida, Stanford University, University of Maryland, and University of Colorado, demanding a payment to either keep their systems functional or to not publish material they were able to steal.
https://www.nbcnews.com/tech/security/ransomware-gang-busted-authorities-ukraine-rcna1199
Senate panel unanimously advances key Biden cyber nominees
CISA, the key federal agency that protects U.S. critical infrastructure from cyber threats, has been without a Senate-confirmed leader since former CISA Director Christopher Krebs was fired by then-President Trump in November following CISA’s efforts to combat election misinformation.
https://thehill.com/policy/cybersecurity/558717-senate-panel-unanimously-advances-key-biden-cyber-nominees
Warner previews cyber breach notification bill
The lawmaker also called for serious discussions about whether ransomware payments should be legal. That debate has been reignited after several high-profile companies admitted to making multi-million dollar payments to criminal groups.
https://washingtontechnology.com/articles/2021/06/15/warner-breach-notify-bill-cyber.aspx
Biden just gave Putin a big, fat cyber bombshell -- and China is watching
If Russian President Vladimir Putin doesn’t get the Russian hacking and ransomware cyber-attacks under control, the US can mess with Russia’s oil export pipelines. Yes, there were strong words on Ukraine, Afghanistan, Iran, Belarus, the Arctic and more. But the historic takeaway from Geneva is that Biden unveiled a direct cyber threat to counter Russia’s recent actions.
https://www.foxnews.com/opinion/biden-putin-cyber-bombshell-rebecca-grant
Military could get cyber-capabilities to repel digital attacks
The Commission on the Defence Forces has been urged to examine whether the military should be provided with enhanced cyber-capabilities to protect Irish cyberspace and attack those who threaten it. The National Cyber Security Centre (NCSC), the agency responsible for protecting the state’s cybersecurity, has urged the commission to look at the cyber-capabilities of other European armies[.]
https://www.thetimes.co.uk/article/military-could-get-cyber-capabilities-to-repel-digital-attacks-58kx9bfgs
Suspected Iranian hackers exploit VPN, Telegram to monitor dissidents
The findings are consistent with a surveillance dragnet that Iranian authorities have used to jail and beat protesters who challenge the regime. Iranian security services killed 304 people in a 2019 crackdown, according to Amnesty International.
https://www.cyberscoop.com/iran-hackers-protests-kaspersky/
Encrypt Consumer Data When Your Privacy Policy Says You Encrypt Consumer Data
While the FTC's primary complaint involved deceptive advertising of its subscription plan, the proposed settlement also addressed a data breach that occurred after MoviePass left an unencrypted database exposed—which lead to unauthorized access to consumer personal information—as well as inaccuracies in MoviePass's representations concerning its cyber and privacy practices.
https://www.jdsupra.com/legalnews/encrypt-consumer-data-when-your-privacy-8547610/
Millions of Connected Cameras Open to Eavesdropping
The bug (CVE-2021-32934, with a CVSS v3 base score of 9.1) has been introduced via a supply-chain component from ThroughTek that’s used by several original equipment manufacturers (OEMs) of security cameras – along with makers of IoT devices like baby- and pet-monitoring cameras, and robotic and battery devices.
https://threatpost.com/millions-connected-cameras-eavesdropping/166950/
Ten-year hactivist fugitive Commander X arrested in Mexico
Chris lives in a gated community in Mexico City, and on the afternoon of Friday 11th June, several armed, uniformed, Mexican men identifying themselves as DEA agents attempted to gain entry to the community but were turned away. They returned dressed as civilians, with representatives from the US embassy, scaled the walls of the compound and took Chris away in the early evening.
https://arstechnica.com/tech-policy/2021/06/ddos-fugitive-commander-x-arrested-in-mexico-extradited-to-us/
|
