Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Exposure. Show all posts
Resume
Data Breach Data Exposure Hiring Job Scam Resume

Millions of Resumes Exposed Online Due to Unsecured Hiring Platform

 



A major data exposure has come to light after cybersecurity experts discovered an unsecured online storage system containing nearly 26 million documents, many of which appear to be resumes of job seekers in the United States.

The exposed files were found in a cloud-based storage system, commonly used to save and share digital files. According to the research team, this storage space had not been properly secured, meaning anyone who knew where to look could access its contents without needing a password or any special permissions.

On further examination, it was revealed that the majority of the documents stored in the system were personal resumes and CVs. These files included sensitive personal details like full names, phone numbers, email addresses, education history, previous work experience, and other professional information. In the wrong hands, such detailed personal data can become a serious security risk.

Experts warn that job seekers are particularly vulnerable in situations like this. If cybercriminals gain access to such data, they can use it to send highly personalized scam messages. These messages may appear trustworthy, as they can be tailored using real employment history or job interests, making it easier to trick someone into clicking a malicious link or sharing their login information.

One common tactic includes sending fake job offers or interview invitations that secretly install harmful software on a person’s device. Some advanced scams may even go as far as conducting fake job interviews before sending victims "sample tasks" that involve downloading malware.

The database in question was linked to a platform used by employers and hiring teams to manage job applications and connect with candidates. However, the researchers who found the issue say they did not receive any confirmation that access to the exposed files has been blocked. While the team reached out to suggest tightening security settings, it’s unclear whether any action was taken.

There is no current proof that the data has been used by cybercriminals yet, but experts note that the longer the files remain unprotected, the higher the risk of misuse. Even if no signs of abuse have appeared so far, the availability of such information online creates an ongoing threat.

This situation serves as a reminder for companies handling sensitive data to prioritize cybersecurity. Properly configuring cloud storage, regularly updating access settings, and limiting who can view certain files are essential steps in preventing such exposures. It’s not just about protecting a system, it’s about safeguarding real people’s identities and futures.


Read more »
Sensitive customer information
Customer Information Cyber Security Data Exposure Data Leak data security IT Data Sensitive customer information

Willow Data Exposure Puts Over 240,000 Customer Records at Risk

 


Data Breach at Willow Exposes Over 240,000 Customer Records

A significant data exposure incident involving the Chicago-based financial technology firm Willow has left the personal details of more than 240,000 customers vulnerable. Willow, which offers a service to pay customer bills upfront and allows repayment in installments, reportedly left a large volume of sensitive data accessible online without password protection. The discovery was made by cybersecurity researcher Jeremiah Fowler, who uncovered an unsecured database containing approximately 241,970 files.

The exposed data included customer names, email addresses, phone numbers, transaction details, and partial banking information. Alarmingly, receipts uploaded to the database revealed additional sensitive details, such as partial credit card numbers and home addresses. Fowler also found a T-Mobile bill containing call and text message records, underscoring the severity of the breach. One particularly concerning file contained data on 56,864 individuals categorized as prospects, active customers, or former customers barred from using Willow’s services.

The scale of the exposure raises significant concerns about the risk of identity theft and financial fraud. While there is no evidence yet that the leaked data has been exploited, the breach highlights the potential for phishing scams and social engineering attacks. Fraudsters could use the exposed information to craft convincing schemes, such as fraudulent billing requests or identity verification scams, targeting affected individuals.

Fowler immediately attempted to notify Willow of the breach, but his outreach went unanswered. Shortly thereafter, the database was secured and removed from public access. However, it remains unclear whether the database was managed directly by Willow or a third-party contractor. The duration of the exposure also remains unknown, raising concerns about whether unauthorized parties may have accessed the data before it was secured.

Experts recommend that affected customers take proactive measures to protect themselves. These include closely monitoring financial accounts for unusual activity, changing passwords linked to Willow, and remaining vigilant against phishing attempts. Customers should be cautious of unsolicited communications requesting personal or financial information, as scammers may leverage the exposed data to appear legitimate.

Willow has yet to publicly address the breach or outline measures to prevent future incidents. This lack of transparency underscores the importance of stringent data protection protocols. Cybersecurity experts stress that companies handling sensitive financial information must regularly audit their systems to identify and mitigate vulnerabilities.

Until Willow provides clarity, customers must rely on their own vigilance to safeguard against potential misuse of their information. This incident serves as a stark reminder of the growing need for robust data security practices in today’s digital landscape.

Read more »
Medisecurity
Cyberattacks CyberCrime Cybersecurity CyberThreat Data Breach Data Exposure Datathreat Medisecurity

Sensitive Health Data of 12.9 Million Individuals Stolen in Cyberattack

 


One data breach has led to the exposure of several personal and medical data about 12.9 million people who have become victims of cybercrime. Several customers of MediSecure, one of Australia's leading healthcare providers, have been affected by the huge data breach. There has been a breach of data relating to prescriptions distributed by the company's systems from March 2019 to November 2023 that have been exposed. 

MediSecure, a company that provides electronic prescriptions, said today that a total of 12.9 million customer records have been stolen and that an unknown amount of these records have been uploaded online. When it first learned of the data breach on April 13, when other servers holding sensitive personal and health data were discovered to be infected with suspected ransomware, the company publicly confirmed the hack in May. 

In an attack on MediSecure, which provides medical prescriptions, almost 13 million Australians were impacted by an incident where their personal and health data was breached. Based on a comprehensive investigation into the metadata accessed by its attackers in May 2024, MediSecure has uncovered that 12.9 million individuals, who used the service from March 2019 to November 2023 for the delivery of prescriptions, were affected by the breach. 

In addition to this, information regarding patient prescriptions is stored in this database. According to the authors of this evaluation, which was published on July 18, a detailed analysis of healthcare identifiers for individuals was conducted. The dataset consists of a wide variety of information related to both personal and health issues, some of which are sensitive by nature. 

Name, title, date of birth, gender, e-mail address, home address, and phone number are the personal information requested. Individual healthcare identifiers (IHI); Medicare card number; Commonwealth Seniors card number and expiration date; Healthcare Concessions card number and expiration date; Health care concessions card number and expiration date; Department of Veterans Affairs (DVA) card number and expiration date; prescription medication, including the name of the drug, the strength, the quantity, the number of repeats and the reason for the prescription. 

It has now been announced in a statement by the Department of Home Affairs that certain details about the system breach have been revealed. There have also been several links that have been provided that give victims information on how to identify scammers and protect their personal information as well as where they may find guidance. A support program is also in place to assist those who may be distressed by the nature of the attack; mental health care is also available to those affected. 

Nevertheless, it is important to emphasize that prescriptions were not affected by this change and healthcare providers were still able to prescribe and dispense medicines accordingly. There have been further breaches at another major healthcare provider, this time in the US, so the overall cost of the breach is still being calculated. A third of Americans may be impacted by the ransomware attack that took place on Change Healthcare. 

In this case, there would be 110 million individuals who would be affected by this catastrophe. There is no doubt that this attack dwarfed the Anthem attack suffered in 2015, which involved the personal records of 78.8 million people. According to The HIPAA Journal, the projected cost of addressing the cyberattack on Change Healthcare that occurred in February is estimated to be between $2.3 billion and $2.45 billion. 

This figure, however, does not account for the expenses associated with notifying all affected customers. These cyberattacks have left millions of individuals justifiably worried that their personal information may be accessible to malicious entities who could repeatedly exploit it for fraudulent purposes.

Additionally, these incidents have significantly undermined public trust in medical providers, who are entrusted with some of the most sensitive personal details. The ramifications of these breaches extend beyond financial losses, eroding confidence in the security measures of healthcare institutions tasked with safeguarding patient information.
Read more »
iCabbi
Data Breach Data Currency Data Exposure Global Reach iCabbi

Data Exposure Incident: iCabbi’s Security Breach

Data Exposure Incident

Data is the new currency, but what happens when the guardians of our privacy mess up? The recent incident involving iCabbi, a taxi software vendor, brings notice to the delicate balance between convenience and security.

The Breach Unveiled

On a seemingly ordinary day, the walls of iCabbi’s security were compromised, revealing a treasure trove of personal data. Nearly 300,000 individuals found themselves unwittingly thrust into the spotlight. Their names, email addresses, phone numbers, and user IDs were laid bare, like fragile artifacts in an open museum. But this was no ordinary museum; it was the vast expanse of the internet, where information travels at the speed of light.

The Cast of Characters

Among the affected were individuals with high-profile roles. Imagine the BBC’s senior executives, their email addresses now exposed. Picture the corridors of power in the UK Home Office, where officials grappled with the aftermath. 

Even former Members of Parliament (MPs) and an EU ambassador were caught in the data facade. It’s a curious mix—a blend of media, government, and diplomacy—all ensnared by a single vulnerability.

Academic Curiosities

But wait, there’s more. Approximately 2,000 academic email addresses (those with the revered .ac.uk domain) were also part of the leak. Academia, often seen as a sanctuary of knowledge, suddenly found itself on the wrong side of the firewall. Professors, researchers, and students—each represented by a string of characters—now had their academic pursuits intertwined with the chaos of compromised data.

iCabbi’s Global Reach

Dublin-based iCabbi isn’t a household name, but its impact reverberates across 15 countries. With software powering more than 800 taxi fleets, it’s the silent conductor orchestrating the movement of cabs through bustling streets. 

Their suite of services includes fleet dispatching, consumer-facing ride-hailing apps, and tools for managing account-based customers. In the digital dance of supply and demand, iCabbi plays a crucial role.

The Anatomy of Exposure

How did this happen? The exposed data appears to be linked to the customer-facing apps powered by iCabbi’s technology. Staff details remained hidden, like backstage crew members in a theater production. 

But the curtain was drawn, and the audience—the cybercriminals—had a front-row seat. Fortunately, a security researcher stepped in, offering a responsible disclosure notice instead of a ransomware demand. It was a race against time, a battle fought in the shadows of cyberspace.

Lessons Learned

The following lessons have surfaced:

Vigilance: No system is impervious. Regular security audits and vulnerability assessments are our shields against unseen threats.

Data Minimization: Collect only what’s necessary. The more data we hoard, the more we expose ourselves to risk.

Encryption: Encrypt sensitive information. It’s the digital equivalent of locking the vault.

Responsible Disclosure: Researchers and hackers alike can be allies. Responsible disclosure channels pave the way for remediation.

Read more »
Traders
Cybersecurity Data Breach Data Exposure Direct Trading Technologies Fintech Security Breach Traders

Direct Trading Technologies Exposes Data of 300K Traders in Major Security Breach

 

Direct Trading Technologies (DTT), an international fintech enterprise, has compromised the security of more than 300,000 traders by inadvertently exposing their confidential information and trading histories, potentially exposing them to the risk of unauthorized account access.

On October 27th, the research team at Cybernews identified a misconfigured web server containing backups and development code believed to be associated with Direct Trading Technologies. The company, which operates globally and specializes in providing trading platforms for various financial instruments, including stocks, forex, precious metals, energies, indices, Contracts for Difference (CFDs), and cryptocurrencies, also extends its services through white-label solutions. 

While its primary clientele is situated in Saudi Arabia, Direct Trading Technologies maintains offices in multiple countries, including the UK, Lithuania, UAE, Kuwait, Colombia, Turkey, Bahrain, Lebanon, and the Republic of Vanuatu. Within the identified directory, several database backups were found, each containing substantial amounts of sensitive information concerning the company's users and partners. The breach introduces a spectrum of potential risks, ranging from identity theft to the takeover and unauthorized withdrawal of funds from traders' accounts.

Upon discovery, Cybernews promptly notified the company of their findings. Although the identified issues were rectified, an official response from Direct Trading Technologies is still pending.

The leaked data encompasses the trading activities of more than 300,000 users spanning the last six years, including names, email addresses, correspondence sent by the company, and IP addresses. Notably, individuals using the company's email addresses, possibly employees, had their passwords exposed in plaintext. Hashed passwords for accessing user accounts on the DTT trading platform were also among the leaked information. Furthermore, certain clients had their home addresses, phone numbers, and partial credit card details exposed.

The comprehensive list of leaked data includes:
  • Trading account activity
  • Contents of emails sent by DTT
  • User IP addresses, emails, usernames, and plaintext passwords
  • Notes on outreach calls
  • Names
  • Email addresses
  • Phone numbers
  • Home addresses
  • Hashed passwords
  • Database endpoints and plaintext credentials of white-label customers (endpoints were protected by IP whitelists)
  • Locations where KYC documents are stored, filenames, types, expiration dates, and other metadata
While the KYC documents themselves were not compromised, the leaked files disclosed the locations where the documents are stored and additional metadata.

The credentials of clients utilizing the white-label service were exposed in plaintext, alongside details regarding database locations and negotiated commission percentages. The leaked information also contained internal comments from the company's outreach team, including derogatory terms used to categorize certain clients in the company's system.

Given the rapid growth of the fintech industry, this breach serves as a stark reminder of the crucial importance of robust cybersecurity measures. Fintech companies, entrusted with managing highly sensitive customer data, become prime targets for threat actors, especially considering the substantial value held in traders' accounts. 

With access to leaked data from a trading platform, attackers possess ample information to launch various malicious activities, including account takeovers, phishing, identity theft, and malware exploits based on leaked IPs. The potential threat is heightened by the fact that Direct Trading Technologies offers white-label services to numerous firms, storing credentials for clients' databases. While this could pose an additional threat, accessing these databases would require attackers to compromise a trusted network, adding an extra layer of complexity to the potential threat.
Read more »
Vulnerability and Exploits.
Cloud Platform Critical Flaws Data Exposure Digital World Malicious actor Salesforce Sensitive data Third Party Apps Vulnerability and Exploits.

ServiceNow Data Exposure Flaw Raises Concerns

ServiceNow, a popular enterprise cloud platform, was found to have a serious data exposure vulnerability. Concerns concerning the security of sensitive data in cloud-based systems have been highlighted by this occurrence, which has shocked the cybersecurity community.

According to reports from cybersecurity experts and firms, the vulnerability in ServiceNow's infrastructure could potentially lead to unauthorized access to sensitive data. The flaw, if exploited, could allow malicious actors to gain access to confidential information stored within the platform, posing a significant risk to organizations relying on ServiceNow for their day-to-day operations.

Enumerated, a cybersecurity firm, was among the first to identify and report the flaw. They disclosed that the issue stemmed from a misconfiguration in ServiceNow's security settings, leaving a gap that could be exploited by cybercriminals. This revelation has prompted immediate action from ServiceNow, as they work tirelessly to rectify the situation and implement robust security measures.

Salesforce, a leading cloud-based customer relationship management platform, was also mentioned in connection with the data exposure issue. While the exact nature of the link between Salesforce and ServiceNow remains unclear, experts speculate that this incident might highlight a broader concern regarding the security of cloud-based platforms and the need for enhanced vigilance in safeguarding sensitive data.

The cybersecurity community, along with industry experts, has been vocal about the importance of regular security audits and assessments for cloud-based platforms. This incident serves as a stark reminder of the potential risks associated with relying on third-party providers for critical business functions.

As the investigation into this data exposure flaw continues, organizations using ServiceNow are advised to review their security protocols and take immediate steps to mitigate potential risks. This includes ensuring that access controls and permissions are configured correctly and conducting thorough vulnerability assessments to identify and address any potential security gaps.

The ServiceNow data exposure vulnerability highlights how important it is for cloud-based platforms to have strong cybersecurity safeguards. It acts as a wake-up call for businesses, encouraging them to give security first priority and take preventative measures to protect sensitive data in an increasingly linked digital world.

Read more »
Ghana
Data Breach Data Exposure Data Leaked Ghana

Ghana’s National Service Secretariate Exposed 700K Individuals Data Due to Cloud Misconfiguration

 

Noam Rotem and Ran Locar researchers for VPNMentor stated that Ghana's National Service Secretariat – NSS – has encountered a significant database malfunction that compromised data of up to 700,000 individuals from and around the country, totaling 55GB of data. 

According to researchers, this leak poses a serious risk to Ghanian government employees affiliated with the organization as well as thousands of its people. The exposed database was identified on September 29, 2021, and the NSS and CERT-GH were contacted between October 6th and 12th, 2021. 

NSS is essentially a government initiative that oversees a year of mandatory public service for Ghana-based graduates of selected educational institutions. Every year, thousands of students enroll in this program to work in various public areas such as healthcare. 

As per the VPNMentor research, the NSS used Amazon Web Services (AWS) to store approximately 3 million files from its various applications. 

Although some of the documents in the cloud storage account were password-protected, the majority of the files were still accessible to the public as well as the database. 

“While the NSS had password-protected many documents stored on the S3 bucket, the bucket itself was left completely open, leaving the contents totally exposed and easily accessible to anyone with a web browser and technical skills,” VPNMentor’s report read. 

This breach exposes the personal information of at least 700,000 people, leaving them vulnerable to fraud, identity theft, and hacking scams. Furthermore, employees working for the government agency have become subject to a variety of threats. 

The compromised database contains participants' program membership cards and identity documents, such as the Ghana National Health Insurance Scheme, professional IDs based on the candidate's placement industry, and so on. 

Moreover, the organization saved several types of passport photographs submitted by participants. The Computer Emergency Response Team of Ghana (CERT-GH) has acknowledged that the database was compromised and has stated that the problem will be resolved as soon as possible.
Read more »
Vulnerabilities and Exploits
API Bug Data Exposure Germany Scoolio Vulnerabilities and Exploits

400,000 German Students Data Exposed due to API Flaw

 

A newly found API issue in Scoolio, a school software used by 400,000 German students, has exposed the personal information of those kids. Lilith Wittmann of the IT security collective Zerforchung discovered the issue and notified the applications team immediately. 

Scoolio employs targeted advertising based on data collected from users, the majority of whom are students, without their knowledge or permission. It does, however, assert that it does not collect any user information. 

Scoolio's API shortcomings, as per Wittmann's report, facilitate information extraction based on the user ID. Anyone who uses this technique can obtain the user's username, email address, GPS history, school name and class, interests, UUID data, and personal information such as origin, religion, gender, and so on. 

Furthermore, the researcher also gave a fake representation of the data types affected by the issue. 

The researcher also noted that the API patch to avoid data leak was relatively straightforward and that it arrived in 30 days, on October 25, 2021, after they were notified of the issue on September 21, 2021. She goes on to say that it is impossible to say how many students were affected as Scoolio inflates user statistics. The app's creators have produced an official paper outlining the patch and have confirmed it. 

Scoolio provides users with tools for managing time, homework planning, staying in touch with friends, and even contacting firms for job vacancies or internship options. The business behind this one collaborated with several German schools and marketed it as a remote teaching support software. It was created with funding from three state-owned investment groups: SIB Innovations und Beteiligungsgesellschaft mbH, Technologiegründerfonds Sachsen, and Kreissparkasse Bautzen, so many students are compelled to use the software as a result of collaborations and government initiatives endorsing the same. 

The fundamental issue is that no security flaws are being audited. An initiative dubbed "EduCheck Digital" (EDCD) that began in August is attempting to evaluate which instructional media fulfills German data protection requirements and have the green signal for usage in schools. 

"I would like to thank Ms. Wittmann for the information and the SDS for the exchange and thank you for your feedback on our security measures," Danny Roller, CEO, and founder of the Scoolio app shared in a statement. 

"Fortunately, after extensive testing, we can confirm that No user data was intercepted by third parties before the investigation by Ms. Wittmann and we have successfully closed the gaps found."
Read more »
User Privacy
Data Breach Data Exposure User Data User Privacy

Confidential Terrorist Watchlist With 1.9Mn Records Exposed Online

 

Cyber security researcher Bob Diachenko has unearthed an unsecured ElasticSearch server containing nearly two million terrorist watchlist records, including "no-fly" list indicators, which were left exposed for a period of three weeks between July 19th and August 09th. 

Earlier this week, Diachenko posted a message and said, “On July 19, I discovered a terrorist watchlist containing 1.9 million records online without a password or any other authentication required to access it." The unprotected server had a Bahrain IP address but it remains unclear whether the server was owned by the US or any other country.

Diachenko immediately reported his discovery to the US Department of Homeland Security, but the records weren't taken down until August 09. The leaked records contained passport details, full name, dates of birth, citizenship, gender, TSC watchlist, country of issuance, and no-fly indicator. 

“The watchlist came from the Terrorist Screening Center, a multi-agency group administered by the FBI, which maintains the country's no-fly list, a subset of the larger watchlist. A typical record in the list contains full name, citizenship, gender, date of birth, passport number, no-fly indicator, and more,” he informed. 

No-fly list

The exposed data belongs to the people who are suspected as terrorists but have not necessarily been charged with any crime. "If it falls in wrong hands, this list could be used to oppress, harass or persecute people mentioned on the list and their families. It could cause any number of personal and professional problems for innocent people whose names are included in the list," Diachenko said. 

Prior to 2015, the terrorist watchlist was completely confidential. Then the US government modified its policy and began privately informing US citizens who were added to the list, but foreigners still often can't find out whether they're on the no-fly list until they try to board a plane. 

Several media reports suggest that the US officials are recruiting informants in exchange for keeping their names off the no-fly list. Some past or present informants' identities could have been exposed. The Terrorist Screening Center (TSC) was set up by the US Federal Bureau of Investigation (FBI) in 2003.

The discovery of the exposed records comes just a month after the DHS, the Department of Justice, and other federal agencies -- launched a new website with the sole motive of combating the threat of ransomware.
Read more »
Whitehat Jr
Byjus Cyber Security Data Exposure data security Whitehat Jr

Indian Startup Exposed Byju's Compromised Server Data

 

Salesken.ai, an Indian-based technology secured a compromised server that was leaking out private and sensitive data on one of its clients, Byju's, a startup and one of the leading educational startups. The server was left uncompromised since June 14, says Shodan, who provide the historical data. Shodan is a search engine for compromised devices and databases. Anyone could access the server data as it was left without the password. 

The compromised server was discovered by security researcher Anurag Sen, who also asked for assistance from Tech Crunch. "WhiteHat Jr. spokesperson Sameer Bajaj said the company is currently communicating with Salesken.ai about the incident and will take appropriate action in accordance with our rigorous security policies," reports Tech Crunch. Salesken.ai offers companies like Byjus customer-relationship technology. It is a Bangalore-based start-up that recently raised $8 Million in Series. 
Funding from Sequoia Capital India in 2020, after two years of its founding. 

Most of the data stored in the compromised server containing information related to an online school that teaches coding to students in India and the U.S. Byjus bought Whitehat for $300 Million last year. The server had the names and addresses of the students and the email addresses and contact numbers of the parents and teachers. Besides this, the exposed server contained other data related to students, such as chat logs between parents and staff, and remarks given by teachers to their students. The compromised server also contained email copies that had reset codes for restoring accounts and other data pertaining to Salesken.ai. 

Co-founder and chief executive at Salesken.ai, Surga Thilakan says the company is currently investigating the issue but didn't disclose any information related to what kind of data was exposed in the compromised server. "Our assessment suggests the exposed device appears to be a non-production, staging instance of one of our integration services having access to less than 1% of India-based end-of-life sales logs for a fortnight." Salesken.ai follows stringent data security norms and is certified under the highest standards of global security and safety. We have, in an abundance of caution, immediately severed access to the cloud device," reports Tech Crunch.
Read more »
Misconfiguration
Censys Cloud Cloud data violation Cyber Security Data Exposure database Misconfiguration

Cloud Misconfiguration is Still the Leading Source of Cloud Data Violations

 

Almost everybody by now is workings from home and 84 percent are worried that new security vulnerabilities have been generated with the quick move towards 100 percent remote working. 

Cloud service providers built their administration panels' user interface purposefully to mislead consumers and charge for more services than originally intended. 

Although it was never demonstrated as a systematic business strategy, reports and alerts of a data breach have overwhelmed the internet in recent years since a cloud-based database has indeed been misconfigured and confidential information ultimately leaked. 

Throughout the past month, Censys, a security company that specializes in census-like inspections on the internet, looked closely at the cloud-based services, hoping to uncover what the best potential origin of misconfiguration might be for cloud-based businesses. As per the study, Censys has found over 1.93 million cloud server databases that have been displayed publicly without even any firewall or other authentication measures. The security company arguments that threat actors will discover and target these databases utilizing older vulnerability exploits. In addition, if the database was unintentionally leaked, it could also use a weak or even no password at all, disclosing it to all those who have detected its IP address. 

Censys reported having been used to scan MySQL, Postgres, Redis, MSSQL, MongoDB, Elasticsearch, Memcached, and Oracle and that nearly 60 percent of all disclosed servers were MySQL databases which represent 1.15 million of the 1.93 million overall exposed DBs. 

The security agency also searched to find ports that could also be exposed by clouds service as they are normally used for remote management applications like SSH, RDP, VNC, SMB, Telnet, Team Viewer, and PC Anywhere. Censys retained that access to all these remote managing port must not be easily discovered but rather secured by Access Control Lists, VPN tunnel, or other traffic filtering solutions, although the underlying cause of these applications is that the systems can be remotely logged into. 

Another very significant discovery was indeed the virtual exposure of the RDP login screens by more than 1.93 million servers. 

Microsoft and several others have also indicated that many violations of security have also been caused by attackers obtaining access to an enterprise through compromised RDP credentials. Which included attacks on a broad range of actors, including DDoS botnets, crypto mining activities, ransomware gangs, and government-funded actors. 

Most organizations do not operate internally with just one cloud services provider infrastructure, but instead use several solutions, many of which might not have the same access or default settings, allowing several systems to become accessible even though IT personnel are not supposed to do so. While some cloud providers have taken measures to improve their dashboards and to clarify how those controls operate, the wording of each cloud provider is still substantially different, and some system administrators are still often confused. 

Censys said, “it expects the issue of misconfigured services to remain a big problem for companies going forward.”
Read more »
User Privacy
Cyber Security Data Exposure European Telco Sensitive data Tala User Privacy

Tala Research Shows that European Telecommunication Websites Expose Sensitive Customer Data

 

In 7 EU countries, Tala assessed the websites of the leading MSPs for the European top mobile providers, data exposure is a major unacknowledged concern. Analysis of Europe's leading mobile providers' websites by Tala Security shows that critical information has been at risk of over-sharing and attack — with few appropriate security measures in place to discourage it. Tala Security's recent study reveals that data exposure is a real concern for Europe's leading mobile companies and by extension for more than 253 million customers who register up and share personal information. The main issue is the insecure website supply chains. 

For many valid reasons, European Telecommunication companies collect sensitive information as part of the digital sign-up procedure, including passport numbers, payment slips, and bank account details. The analysis by Tala shows that European Telco sites do not have enough protection against third-parties risk but also uncover them to other serious risks by using numerous third-party JavaScript integrations. Without command, all websites that have JavaScript code from each owner's website including the supply chain vendor can alter, grab, or release information via JavaScript facilitated client-side attacks. The average JavaScript integration among Telecommunications companies was 162 in the group; this is a very high risk of over-sharing and data visibility. If website owners do not protect sensitive data when entered on their websites, they actually do not leave it suspended; the only reason why it is not stolen is that criminals did not use it. 

“In many cases, data sharing or exposure takes place via trusted, legitimate applications on the allow list —often without the website owner's knowledge,” said Deepika Gajaria, VP of Products at Tala Security. 

Forms used to collect credentials, banking information, passport numbers, etc. are revealed to an average of 19 third parties at considerable risk through form data exposure. No responsive website protection was established on any of the sites. On a scale of 100 with a score of 50 at an average, the website average was only 4.5. 100 percent of the most widespread website attack that frequently led to a significant sensitive leakage in the data is cross-site scripting (XSS). 

“European Telco’s routinely collect sensitive data like passport scans, banking details, address, and employment information. When website owners fail to effectively secure data as it is entered into their websites, they’re effectively leaving it hanging, an accident waiting to happen,” said Gajaria.
Read more »
Webcams
Adorcam Cyber Security Data Exposure Webcams

Adorcam Leaks Thousands of Webcam Accounts

 

A webcam application installed by a huge number of clients left an uncovered database loaded with client information on the internet without a password. The Elasticsearch database belonged to Adorcam, an application for viewing and controlling a few webcam models including Zeeporte and Umino cameras. Security researcher Justin Paine found the data exposure and reached Adorcam, which secured the database. Adorcam application is specially built for the P2P IP camera series. The clients just need to enter the camera ID and password to watch real-time video from any bought IP camera on their cell phone and no complicated IP or router settings are required. 

Paine said in a blog post shared, that the database contained around 124 million rows of information for the several thousand clients, and included live insights concerning the webcam —, for example, its location, whether the microphone was active, and the name of the WiFi network that the camera is connected to — and information about the webcam owner, such as email addresses. Paine additionally discovered proof of the camera uploading captured stills from the webcam to the application's cloud, however, he was unable to confirm since the links had expired. 

He likewise discovered hardcoded credentials in the database for the application's MQTT server, a lightweight messaging protocol often used in internet-connected devices. Paine didn't test the credentials (as doing so would be unlawful in the U.S.), yet alerted the application creator about the vulnerability, who at that point changed the password. Paine checked that the database was updated live by signing up with a new account and looking for his data in the database. Albeit the information was restricted in sensitivity, Paine cautioned that a malevolent hacker could create persuading phishing emails, or utilize the data for extortion. 

In his report on the matter, Paine pointed out that the data contained in the database distinguished between Adorcam's Chinese clients and its clients outside of China, saying, “One interesting detail about this database was that the user information was split between Chinese users and "abroad" users. For example: request_adorcam_cn_user vs. such as request_adorcam_abroad_user. Adorcam almost certainly has breach disclosure obligations based on what appeared to be a global user base. If they had users within the EU they absolutely have an obligation.”
Read more »
Russian Cyber Security
Data Breach Data Exposure Database Dumped Moscow Russia Russian Cyber Security

Personal data of one million Moscow car owners were put up for sale on the Internet


On July 24, an archive with a database of motorists was put up for sale on one of the forums specializing in selling databases and organizing information leaks. It contains Excel files of about 1 million lines with personal data of drivers in Moscow and the Moscow region, relevant at the end of 2019. The starting price is $1.5 thousand. The seller also attached a screenshot of the table. So, the file contains the following lines: date of registration of the car, state registration plate, brand, model, year of manufacture, last name, first name and patronymic of the owner, his phone number and date of birth, registration region, VIN-code, series and number of the registration certificate and passport numbers of the vehicle.

This is not the first time a car owner database has been leaked.  In the Darknet, you can find similar databases with information for 2017 and 2018 on specialized forums and online exchanges.
DeviceLock founder Ashot Hovhannisyan suggests that this time the base is being sold by an insider in a major insurance company or union.

According to Pavel Myasoedov, partner and Director of the Intellectual Reserve company, one line in a similar archive is sold at a price of 6-300 rubles ($4), depending on the amount of data contained.
The entire leak can cost about 1 bitcoin ($11.1 thousand).Information security experts believe that the base could be of interest to car theft and social engineering scammers.

According to Alexey Kubarev, DLP Solar Dozor development Manager, knowing the VIN number allows hackers to get information about the alarm system installed on the car, and the owner's data helps to determine the parking place: "There may be various types of fraud involving the accident, the payment of fines, with the registration of fake license plates on the vehicle, fake rights to cars, and so on."

Against the background of frequent scandals with large-scale leaks of citizens data, the State Duma of the Russian Federation has already thought about tightening responsibility for the dissemination of such information. "Leaks from the Ministry of Internal Affairs occur regularly. This indicates, on the one hand, a low degree of information security, and on the other — a high level of corruption,” said Alexander Khinshtein, chairman of the State Duma Committee on Information Policy.
Read more »
Subscribe to: Posts (Atom)