Search This Blog
Load More
Trendy Right Now

Popular Posts

Showing posts with label CISO. Show all posts
Linkedin
CISO Cyber Fraud Fake Accounts High Profile Attacks Linkedin

Fake CISO Profiles of Corporate Giants swamps LinkedIn

 

LinkedIn has recently been flooded with fake profiles for the post of Chief Information Security Officer (CISO) at some of the world’s largest organizations. 

One such LinkedIn profile is for the CISO of the energy giant, Chevron. One might search for the profile, and find the profile for Victor Sites, stating he is from Westerville, Ohio, and is a graduate of Texas A&M University. When in reality, the role of Chevron is currently occupied by Christopher Lukas, who is based in Danville, Calif. 

According to KrebsOnSecurity, upon searching the profile of “Current CISO of Chevron” on Google, they were led to the fake CISO profile, for it is the first search result returned, followed by the LinkedIn profile of the real Chevron CISO, Christopher Lukas. It was found that the false LinkedIn profiles are engineered to confuse search engine results for the role of CISOs at major organizations, and the profiles are even considered valid by numerous downstream data-scraping sources. 

Similar cases could be seen in the LinkedIn profile for Maryann Robles, claiming to be the CISO of another energy giant, ExxonMobil. LinkedIn was able to detect more such fabricated CISO profiles since the already detected fake profile suggested 1 view a number of them in the “People Also Viewed” column. 


Who is Behind the Fake Profiles? 


Security experts are not yet certain of the identity of the threat actors behind the creation and operation of these fake profiles. Likewise, the intention leading to the cyber security incident also remains unclear.  

LinkedIn, in a statement given to KrebsOnSecurity, said its team is working on tracking the fake accounts and taking down the con men. “We do have strong human and automated systems in place, and we’re continually improving, as fake account activity becomes more sophisticated,” the statement reads. “In our transparency report we share how our teams plus automated systems are stopping the vast majority of fraudulent activity we detect in our community – around 96% of fake accounts and around 99.1% of spam and scam,” said LinkedIn. 

What can LinkedIn do?  


LinkedIn could take simple steps that could inform the user about the profile they are looking at, and whether to trust the given profile. Such as, adding a “created on” date for every profile, and leveraging the user with filtered searches. 

The former CISO Mason of LinkedIn says it could also experiment with offering the user something similar to Twitter’s ‘verified mark’ to those who chose to validate that they can respond to email at the domain linked with their stated current employer. Mason also added LinkedIn needs a more streamlined process allowing employers to remove phony employee accounts.
Read more »
Vulnerabilities and Exploits
attacks CISO Log4j Report Research Risk Vulnerabilities and Exploits

Homeland Security Warns Log4j’s 'Endemic' Threats for Years to Come

 

The US Department of Homeland Security (DHS) published the Cyber Safety Review Board's (CSRB) first report into the December 2021 Log4j incident, when a variety of vulnerabilities with this Java-based logging framework were revealed, this week. 

The report's methodology comprised 90 days of interviews and information requests with around 80 organisations and individuals, including software developers, end users, security specialists, and businesses. 

This was done to ensure that the board met with a wide range of representatives and understand the complexities of how different attack surfaces are constructed and defended. According to the report, although standardised and reusable "building blocks" are essential for developing and expanding software, they also allow any possible vulnerability to be mistakenly included in multiple software packages, putting any organization that uses those programs at risk. 

According to the report, while Log4j remains dangerous, the government-wide approach helped tone down the vulnerability. The board also noted the need for extra financing to help the open-source software security community, which is primarily comprised of volunteers. 

Industry experts, such as Michael Skelton, senior director of security operations at Bugcrowd, said of Log4J: “Dealing with it is a marathon, one that will take years to resolve. Java and Log4j are prevalent everywhere, not only in core projects but in dependencies that other projects rely on, making detection and mitigation not as simple an exercise as it may be with other vulnerabilities.” 

John Bambenek, the principal threat hunter at Netenrich, was more critical of the report’s timing, believing that “anyone still vulnerable is highly unlikely to read this report or in much of a position to do anything about it if they did. Most of the American economy is small to medium businesses that almost always never have a CISO and likely not even a CIO. Until we find ways to make the public without security budgets safe, no high-level list of best practices will move the ball significantly.” 

The CSRB report went on to state that, thankfully, it is unaware of any large Log4j-based attacks on critical infrastructure assets or systems, and that efforts to hack Log4j happened at a lesser level than many experts expected. 

The paper, however, emphasises that the Log4j incident is "not over" and will continue to be an "endemic vulnerability" for many years, with considerable risk persisting. The research concluded with 19 actionable recommendations for government and business, which were divided into four divisions. They were as follows:
  • Address Continued Risks of Log4j
  • Drive Existing Best Practices for Security Hygiene
  • Build a Better Software Ecosystem
  • Investments in the Future
Read more »
User Data
Accellion FTA CISO Data Breach Potential Cyber Breach Toronto User Data

City of Toronto Hit by a Potential Cyber Breach

 

A possible cyber breach from a third-party data transfer software supplier was reported by the City of Toronto on 22nd January 2021. The City took effective measures to halt all the applications that day, while research was promptly initiated by the Chief Information Security Officer of the City to assess the types of data potentially breached. 

The City has documented the infringement to the Commissioner for Information and Privacy of Ontario and had further interacted with everyone whose information might be infringed. Also, additional jurisdictions or organizations in Ontario and across the globe recently reported that this sort of cyber-breach has also affected them. 

The City of Toronto claims that in January, there was a "potential cyber breach" of data on its Accellion FTA file transmission servers that could include individual health details. 

Later, IT World Canada was assured by City workers that Accellion was involved. There had been a problem in the city on January 22nd. A city spokesperson said that the CISO office was examining and released a report only on the 20th of April, on being asked why and how the event had taken until now to be made public – “It takes time to reach any sort of conclusion given the legacy system that was breached, and the extent of investigation required,” the spokesperson said. 

The representative added that they are still investigating exactly how many folk details were revealed. In addition, the city hasn't submitted a ransom application and it is not known either that if a ransom demand has been obtained as a consequence of this violation. 

In its statement, the city said it “took immediate action and shut down access to the software that day, and the city’s chief information security officer immediately launched an investigation to determine the type of data that may have been compromised.” 

In all cases whereby personal health data are affected, the city must notify the IPC. The IPC has been informed since personal health information is potentially accessible. In its attempts to safeguard the privacy and welfare of Toronto people, Toronto has effectively stopped cyber threats regularly. 

In February, cybersecurity agencies across five countries released a global warning to organizations that have transferred their Accellion FTA files after several organizations have admitted that bugs in the program are being compromised at the beginning of this year. Publicly known victims include Shell, the oil supplier, Bombardier, and the pharmaceutical operation of the US retail chain, the Canadian company jet maker.
Read more »
Subscribe to: Posts (Atom)