Search This Blog

Showing posts with label Data Privacy. Show all posts

How Tracking Pixels are Collecting Personal Data, 5 On Your Side Reveals


Have you been Christmas shopping on the internet, and later have advertisement of similar items following you all across your online pathway for days? 

This is no coincidence, for you are being tracked and it is not a virus or malware doing so, but the companies and applications deceiving you. 

In a recent report, the personal and protected medical data of thousands of local patients may have been exposed to Facebook, by tracking pixel. 5 On Your Side unveils the details of this pixel and what else are they set to expose of the victims. 

Alex Ondrick is one of the WakeMed patients who received a letter from the hospital this October. The letter apparently mentioned that some of his medical information may have been exposed on Facebook.

"Interestingly, my mother also got the letter, my step-dad got the letter, several of my friends also got the letter," Ondrick said. 

According to news outlet, the Markup, WakeMed and Duke University Hospital were found to be employing the Meta Pixel, a tracker, on their websites. While we are referring to a pixel, like the millions of pixels that make up an image on your television or computer screen. 

"Those pixels can also be used to house code, to house information […] In this particular case, it’s a very unique piece of code that takes information regarding whoever is using that website at the time, and sends that back to the web server of whoever is implementing that. In the case at hand, it’s Meta or Facebook," says Former CIA Cyber Threat Analyst Clark Walton. 

Walton further tells 5 On Your Side that the code can gather detailed information about your browsing habits, user preferences and what you click on. The owner of the pixel, such as Meta, gets that raw data. The information is then reduced to marketing data and forwarded to the website's owner. 

"The technology is not specific to Meta, certainly could be anybody," Walton said. 

The pixels present on the websites are of varying kinds and utilized by organizations of all sizes. They are invisible and unlike “cookies,” you could not block these pixels. 

"There’s not necessarily, to my knowledge, a way to opt out of if you go to a private website that’s using that pixel technology," Walton added. 

While neither agreed, 5 On Your Side contacted both Duke Health and WakeMed to interview in regards to the subject matter. 

Duke Health officials sent a statement stating, “Duke University Health System values the privacy of its patients’ medical information. DUHS has investigated the use of the Meta Pixel on our website and patient portal and has determined that DUHS did not transmit its patients’ protected health information to Meta. We continue, however, to study the issue and may share additional information if and when appropriate given pending litigation and ongoing external investigations into these matters.” 

WakeMed, on the other hand said that they directly communicated the information with individuals who might have been affected and dedicated a phone line and email address to handle any further inquiries or concerns.  

UGC Offers Cyber Security Program for UG&PG Students

 

The University Grants Commission (UGC) has released the undergraduate (UG) and postgraduate (PG) cyber security course syllabus as part of Cyber Jaagrookta Diwas 2022. UGC Chairman M. Jagadesh Kumar remarked.
 
Cybersecurity as a discipline needs to be included at the undergraduate and graduate levels in all streams, according to Professor M. Jagadesh Kumar. The curriculum of these courses seeks to develop aware, receptive, and responsible digital citizens, thereby enhancing a robust ecosystem and posture for cyber security.

Higher Education Institutions (HEIS) may invite qualified professors or industry professionals/subject matter experts to take the lectures, practicals, and tutorials for these courses at the UG and PG levels in the classroom.

According to the UGC's syllabus, undergraduate students should learn fundamental and intermediate concepts, while graduate students should study intermediate and advanced concepts.

UG Cyber Security Course
  • Cybersecurity Introduction
  • Law and Cybercrime
  • Overview and security of social media
  • Online shopping and digital payments
  • Cybersecurity tools, techniques, and protection for digital devices
PG Syllabus for Cybersecurity
  • Introduction to Cyber Security
  • Online Crimes
  • Data Privacy & Security under Cyber Law
  • Management, compliance, and governance of cybersecurity
Vice-chancellors, principals, faculty members, and students from HEIs around the nation attended the occasion.

Additionally, Deepak Virmani, Deputy Secretary, Indian Cyber Crime Coordination Centre (14C), Ministry of Home Affairs, gave a lecture on cybercrime prevention and the adoption of cyber hygiene. Among the subjects covered in the presentation were cyber hygiene, safeguarding digital personal funds, appropriate social media use, projected future cyberattacks, email security, mobile and internet security, and computer security.

Students will also be able to comprehend the cyber security threat landscape and have a greater grasp of numerous cyberattacks, cybercrimes, vulnerabilities, and cures after completing the degree program.

The purpose of the Syllabus is to produce more responsible, responsive, and aware digital citizens. The fundamentals of cyber security and the threat landscape should be taught to students. Technical training and expertise for implementing and maintaining cyber security measures will be given to students. Students will learn more about and be more familiar with different kinds of cyberattacks.

Universities and colleges will offer the courses as elective or optional courses. It will also feature exercises on how to set privacy preferences on social media sites, file complaints about social media sites, and create password policies for computers and mobile devices, among several other things.



Information Commissioner Office Made a Regulatory Fine of $27 Million on Tiktok

 

The information commissioner's office of the United Kingdom recently fined Tiktok $29 million, having provisionally discovered that Tiktok had breached the laws of child data protection for two years. 
 
The privacy regulatory body of the United Kingdom reported the exploitation of protection laws of the country’s data. There was an investigation that concluded that TikTok may have breached the laws of data protection from May 2018 to July 2020. 
  
The fine is determined by the calculation of 4% of TikTok’s annual turnover globally. The ICO issued TikTok with a “notice of intent” with a fine of up to $27 million, which is considered the highest in ICO’s history as the largest amount paid till now is $20 million to British Airways. 
 
The Information Commissioner's office has pointed out in regard to Tiktok that it may breach privacy by processing data of minors under 13 years old without parental consent, failing to provide complete information to users "in a concise, transparent, and easily understandable manner" and processing unsuitable "special category" data without legal authority. 
 
The ICO defines “special category data” as any use of sensitive personal data including sexual orientation, religious beliefs, culture and nationality, political perspective, and biometric data. 
 
The information commissioner, John Edwards commented on TikTok’s failure in fulfilling its legal duties of protecting the privacy of data of its young users. He stated, "we all want children to be able to learn and experience the digital world, but with proper data privacy protection.” 
 
In John’s opinion, digital learning is essential for children, but the companies offering the digital services should be legally responsible for ensuring that reasonable protection measures are incorporated into these services, as during the investigation of TikTok it was found to be provisionally lacking in these measures.  
 
ICO added to its statement that the findings from the investigation are provisional and no final conclusions can be drawn at this time. A spokesperson from Tiktok in a conversation with TechCrunch shared that they do respect the concerns expressed by the ICO about security and protection laws, but that they disagree with the ICO's views regarding Tiktok's privacy policies.

Evil Colon Attacks: A Quick Guide

 

The high-tech era has made the emergence of new cyber attacks more common than social media trends. One such case of a rapidly evolving threat is the Evil-Colon attack, which shares similarities with Poison-NULL-byte attacks. Despite the fact that poison-NULL-Byte attacks are now non-functioning, it has been suggested that they could have led to new versions of hacking and malware on your systems in case of inappropriate handling. 

In one of his articles, Leon Juranic, a security researcher at Mend, detailed his encounter with the Evil-colon attack. He mentioned that during auditing a source code he discovered a case where an Evil-Colon could be used to evade the path sanitization process. By using novel strategies, the threat actors were able to exploit the vulnerabilities in applications running on Windows operating systems. The analysis concluded that as Evil-Colon is a specific issue in windows-based services, it is more likely to affect any Windows servers. 

When applications or servers use path-based operations, such as using user input when forming the file path, the information stored in that file can be modified by external code flows, which can cause severe security issues like arbitrary data injection, etc. Leon illustrated the working of Evil-Colon with the example of the Java application WriterFile.jsp source code. 

He stated that the working of Evil-Colon includes creating a file in the directory whereas, with sanitization, the new files will append .txt. After passing a colon character at the end of the user’s input, the file gets created as an Altered Data Stream with an arbitrary file extension. 

Later the file is again created in the directory, but as a colon character was added at the end of the filename and it stripped off the rest of the filename string into Alternate Data Stream, the file is recreated with the .jsp extension. 

He furthermore described how the possibility of altering the files that are created earlier in the applicating workflow can lead to serious security threats. When malicious actors can edit the existing files later in code, it will also allow them to modify the .jsp file content into anything they want. On further searching of the modified file in-depth, you will find a string named EVIL-CONTENT. 

Leon concluded his example by warning that, in real-world scenarios, JSP webshell scripts can allow threat actors to remotely execute codes on vulnerable servers or applications. 

To protect your files and data from the Evil-Colon attacks, it is important to remove colon characters from any possible path operations. The elimination of colon characters can be done by using filters, string check operations, etc.

Predatory Sparrow's Assault on Iran's Steel Industry

 

Predatory Sparrow, also known as Gonjeshke Darande, has accepted full responsibility for last month's cyberattacks on various Iranian steel factories and has now posted the first batch of top-secret papers on its Twitter account. 

The group distributed a cache of around 20 terabytes of data. It includes company paperwork revealing the steel plants' links to Iran's strong Islamic Revolutionary Guard Corps. The group stated in a series of tweets in both English and Persian that the cache was only the beginning of what will be disclosed. 

While claiming responsibility for the June 27 attack, the group also posted a photo and video purportedly showing damage to equipment at the state-owned Khouzestan Steel Company, one of Iran's biggest steel manufacturing factories. Although both the steel firm and the Iranian government denied any serious impact, sources suggest that the attack hampered industrial operations. 

The Predatory Sparrow group explained that the attacks were carried out with caution in order to safeguard innocent people. The group also stated that the hacks were in reaction to the Islamic Republic's actions. The group goes on to say that the enterprises were targeted by international sanctions and that they will continue to operate despite the limitations. 

Regardless of Predatory Sparrow's insistence that the attacks are autonomous, it is suspected that the Israeli government is supporting the hacktivist group, given the sophistication of the operation, the nature of the attacks, and the message preceding, during, and after what looks to be an attack. Aside from the steel facilities attack, the Predatory Sparrow group has claimed responsibility for other digital attacks on key Iranian targets, including the one that crippled Iran's state-controlled gasoline distribution in October 2021 and the one that hit the Iranian railway system in August 2021. While the Iranian government continues to deny the group's accusations, each cyber strike raises new concerns.

HackerOne Employee Stole Data From Bug Bounty Reports for Financial Advantages

 

HackerOne has revealed information on a former employee who it alleges accessed company data for personal financial benefit. The unknown individual received information from bug bounty platform security reports and attempted to reveal the same vulnerabilities outside of the site. 

According to HackerOne, he had access to the data between April 4 and June 23, 2022. On June 22, 2022, HackerOne was notified of the problem by a suspicious client who had received similar bug reports from the platform and the person. 

“This is a clear violation of our values, our culture, our policies, and our employment contracts,” the platform stated. 

“In under 24 hours, we worked quickly to contain the incident by identifying the then-employee and cutting off access to data. We have since terminated the employee, and further bolstered our defences to avoid similar situations in the future.” 

According to HackerOne, the submitter of this off-platform disclosure "reportedly used intimidating language in conversation with our customer," and the actor's intent was to collect more bounties. HackerOne also stated that, after consulting with lawyers, it will determine if a criminal referral of this situation is necessary. 

A HackerOne spokesperson informed The Daily Swig: “Since the founding of HackerOne, we have honoured our steadfast commitment to disclosing security incidents because we believe that sharing security information is essential to building a safer internet. 

“At HackerOne, we value the trusted relationships with our customers and the hacking community. It’s important for us to continue to demonstrate transparency as a core tenant of Corporate Security Responsibility and therefore shared this Incident Report.” 

The spokesperson added: “Our Code of Conduct sets the foundation for building trust. We will continue to prioritize coordinated disclosure and to act fast to ensure we uphold these strong standards.”

ATC Healthcare, Community of Hope & The People Concern Disclose Data Breaches

 

ATC Healthcare in New York made a news statement disclosing a breach in December 2021. Their press statement is not as clear or extensive as an updated notice on their website, thus this description is based on the website notice: 

ATC noticed strange behaviour with various staff email accounts on December 22, 2021. The email accounts were accessed without authorisation at various occasions between February 9, 2021, and December 22, 2021, according to the investigation. 

At the time of the incident, the compromised email accounts contained the following data: names, Social Security numbers, driver's licence numbers, financial account information, usernames and passwords, passport numbers, biometric data, medical information, health insurance information, electronic/digital signatures, and employer-assigned identification numbers. 

As is typically the case, investigators were unsure exactly what data had been accessed, thus notifications were made to all individuals who may have been affected. They do not appear to be providing any free services and highlight that there is no conclusive proof that any data was read, copied, or exfiltrated. 

Community of Hope D.C. (COHDC) 

COHDC learnt of a data security problem involving unauthorised access to one of its employees' email accounts on February 7, 2022. According to reports, the issue was uncovered after the account's authorised user saw spam messages being sent from the account. 

An investigation indicated that between January 27 and February 7, 2022, an unauthorised actor may have accessed specific files and data housed within a single Outlook 365 email account. Individuals' Social Security numbers, driver's licence numbers, financial information, health insurance information, and health diagnostic information may have been obtained. COHDC appears to have made arrangements with IDX to assist and serve the individuals affected. The complete notification is available on the COHDC website.   

The People Concern 

The People Concern (TPC) in California discovered that an unauthorised user accessed workers' email accounts on various days between April 6, 2021, and December 9, 2021, however, they do not identify when they initially detected an issue. 

As in previous incidents, investigators were unable to identify whether emails or data in the email accounts were accessed. TPC gathers information on community members and staff such as their name, date of birth, Social Security number, health insurance information, and medical information about the care they may have gotten in one of their programmes. TPC is giving IDX services to people whose SSN or driver's licence information may have been compromised. 

Advocates, Inc. 

Advocates, Inc. in Massachusetts published a news release on June 28. 

"According to the release, on October 1, 2021, Advocates was informed that Advocates' data had been copied from its digital environment by an unauthorized actor. Investigation revealed that an unknown actor gained access to and obtained data from the Advocates network between September 14, 2021, and September 18, 2021. The unauthorized individual was able to acquire personal and protected health information including name, address, Social Security number, date of birth, client identification number, health insurance information, and medical diagnosis or treatment information."

A further look at their website notice suggests that the identification of additional impacted persons was ongoing until June. As they put it:

"Advocates is not aware of any evidence of the misuse of any information potentially involved in this incident. However, beginning on January 3, 2022, Advocates mailed notice of this incident to potentially impacted individuals for which Advocates had identifiable address information. Advocates then worked diligently with experts to review the impacted data set and identify any additional potentially impacted individuals with address information. That process was completed on June 9, 2022, and on June 28, 2022, Advocates provided notice of this incident to those individuals."

Researchers: Wi-Fi Probe Requests Leak User Data

 

A team of academic researchers from the University of Hamburg in Germany discovered that Wi-Fi investigation requests from mobile devices expose identifiable information about their owners via Wi-Fi investigation requests. 

When a probe response is received, mobile devices use it to obtain information about nearby Wi-Fi access points and connect to them. According to the researchers, attackers who can sniff network traffic can use these probing requests to monitor and identify devices, as well as determine their position. 

According to them, nearly a quarter of probe requests contain the Service Set Identifiers (SSIDs) of previously connected networks, which might be exploited to expose home addresses or visited places. Furthermore, the researchers highlight that the probe requests may be used to trilaterate the position of a device with an accuracy of up to 1.5 metres or to "trace the movement of a device to effectively monitor its owner.

“This is in fact employed in 23% of the stores already. Companies and cities that conduct Wi-Fi tracking take the legal position that only the MAC address contained in probe requests is considered personal data according to GDPR Article 4(1), which protects personal data from unlawful collection and processing,” the researchers stated in their paper. 

Experiment findings:

According to the academics, information gathered during a November 2021 experiment focusing on the analysis of probe requests should be sufficient to deem these queries personal data, based only on SSIDs recorded in the devices' preferred network lists (PNLs). 

As part of the trial, the researchers travelled to a pedestrian area in a German city and recorded probe requests three times in one hour using six off-the-shelf antennas. SSIDs were found in 23.2 per cent of the 252,242 total requests. 

The researchers also determined that some of the submitted probe requests with SSIDs revealed password data and that around 20% of the transmitted SSIDs were likely typos of the genuine SSID. The probe requests also revealed 106 separate first and/or last names, three email addresses, the SSIDs of 92 distinct vacation houses or lodgings, and the name of a nearby hospital. 

The academics claim that they ran all SSIDs using WiGLE's geolocation lookup API, which allowed them to determine the actual networks' locations within a 1-kilometre radius. 

The researchers added, “Considering the wealth of personal and sensitive information we observed in SSID fields, they can constitute identifying information and thus require due consideration. We argue that at least for as long as there are still devices broadcasting SSIDs, probe requests should be considered personal data and not be used for monitoring without legal basis.” 
 

Cyber Agencies: Beware of State Actors Levelling up Attacks on Managed Service Providers

 

The United States, the United Kingdom, Australia, and Canada's cybersecurity agencies issued a second advisory this week, stating that cyberattacks against managed service providers (MSPs) are expected to escalate. 

According to the advice, if an attacker is able to access a service provider's infrastructure, ransomware or espionage activity could be carried out against the provider's customers. 

The nations advised, "Whether the customer's network environment is on-premises or externally hosted, threat actors can use a vulnerable MSP as an initial access vector to multiple victim networks, with globally cascading effects." 

"NCSC-UK, ACSC, CCCS, CISA, NSA, and FBI expect malicious cyber actors -- including state-sponsored advanced persistent threat groups -- to step up their targeting of MSPs in their efforts to exploit provider-customer network trust relationships." 

The MSP definition covers IaaS, PaaS, SaaS, process and support services, as well as cybersecurity services, for the purposes of this advice. The first piece of obvious advice is to avoid getting compromised in the first place. Beyond that, users should follow standard suggestions such as improving monitoring and logging, updating software, having backups, employing multi-factor authentication, segregating internal networks, using the least privilege approach, and removing old user accounts. Users should verify contracts for clauses that ensure MSPs have adequate security safeguards in place.

Further, the advisory stated, "Customers should ensure that they have a thorough understanding of the security services their MSP is providing via the contractual arrangement and address any security requirements that fall outside the scope of the contract. Note: contracts should detail how and when MSPs notify the customer of an incident affecting the customer's environment."
 
"MSPs, when negotiating the terms of a contract with their customer, should provide clear explanations of the services the customer is purchasing, services the customer is not purchasing, and all contingencies for incident response and recovery."

NIA Starts Probe into Malware Attacks on Social Media of Defense Personnels

NIA (National Investigation Agency) has started an inquiry into the use of fake Facebook profile through which various defense personnel was contacted and their devices hacked using malware for personally identifiable information. NIA suspects that the main account was being handled from Pakistan. Vijaywada Counter Intelligence Cell first found the spying campaign in 2020, after which it registered a case under several provisions of IPC, Official Secrets Act, Information Technology Act, and UAPA (Unlawful Activities Prevention Act). 

According to the allegation, confidential information related to national security was hacked via remotely deploying a hidden malware into electronic devices, which includes mobile phones and computers, belonging to defense personnels and other defense agencies via a FB account with the profile name "Shanti Patel." Actors handling the account added concerned personnel via private Facebook messenger chats on the web. 

The victims' devices were hacked using malware to get unauthorized access to confidential data of computer resources and steal sensitive information with an aim to carry out acts of terrorism and threaten the unity, integrity, and sovereignty of India. As per the report from Counter Intelligence Cell, the threat actors distributed the malware by sending a folder that contained photos of a woman to the defense personnels. The evidence suggests that malware originated somewhere from Islamabad. A similar case happened last year where the police arrested army personnel in Rajasthan, the accused was posted in Sikkim. 

The Hindu reports "on October 31, 2020, following a tip-off from the Military Intelligence, the Rajasthan police nabbed one Ramniwas Gaura, a civilian working with a Military Engineering Services (MES) unit. The accused had been contacted using a Facebook profile by someone using pseudonyms Ekta and Jasmeet Kour. They then remained in touch on Whatsapp. "In the recent years, multiple attacks targeting defense agencies using social media have surfaced." The handlers usually send money to the information providers through the ‘hawala’ channel. Several preventive measures have been taken by the agencies concerned,” an official said," says the Hindu.

Mental Health Apps Fail Privacy Guidelines Spectacularly, Says Mozilla

An inquiry into mental health and prayer apps disclosed a problematic lack of concern around user security and privacy. Last Monday, Mozilla published the findings of new research about these kinds of apps, which mostly deal with sensitive issues like depression, anxiety, mental health awareness, PTSD, domestic violence, etc., and religion-based services. Mozilla's recent "Privacy Not Included," guide says that even though these apps manage personal information, they regularly share data, allow easy passwords, pick vulnerable users via targeted ads, and show poorly written and vague privacy policies. 

In a study consisting of 32 applications focused on mental health and religion, Mozilla identified 25 apps that failed to meet its Minimum Security Standards. The privacy standards work as the main highlight for the Privacy Not Included reports. The unauthorized sharing and selling of user data, poor data management services, poor encryption, weak password guidelines, inaccurate vulnerability management system, and different lax privacy policies can lead to the downgrading of a vendor product in accordance with Mozilla's standards. 

Once an app fails to touch these minimum standards, they are labeled with a "the privacy not included" warning tag. Mental health and healing-related applications have received an accolade, but they can't be covered. To protect users' privacy and security, these applications are the worst in any product category that Mozilla experts have investigated or reviewed in the past six years. The examined apps include Better Help, Talkspace, Calm, 7 Cups, Glorify, Wysa, Headspace, and Better Stop Suicide. 

As a result, every one of these apps now has a dedicated slot that users can access to know more about the app's privacy and security rating. According to ZDNet, "while the app gathers some personal information and says that users can reach out to them if they have further queries, they did not respond to Mozilla's attempts at contact and did not mention who "trusted partners'" were when data sharing. Only two applications on the list, PTSD Coach and the AI chatbot Wysa seemed to take data management and user privacy seriously."

Anonymous Hacks Russian Energy Companies, Leaking 1Million+ Emails

 

Anonymous claims to have hacked into Russian energy businesses in order to expose emails and continue its cyberwar on Ukraine. On Twitter, the hacker collective claimed to have exposed over 1 million emails from ALET, a Russian customs broker for gasoline and energy firms. 

The tweet stated, "NEW: #Anonymous hacked nearly 1.1 million emails (1.1 TB of data) from ALET, a Russian customs broker for companies in the fuel and energy industries, handling exports and customs declarations for coal, crude oil, liquefied gases and petroleum products."

DDoSecrets, an organisation co-founded by Emma Best and dedicated to comprehensive data transparency in the public interest, disclosed the breach. 

What is ALET? 

ALET is a customs broker based in Russia. It manages exports and customs declarations for petroleum products, coal, liquefied gases, and crude oil for enterprises in the fuel and energy industry. It has worked with 400 businesses and filed 119,000 customs declarations since 2011 with oil products accounting for the majority of its revenues. Gazprom, Gazprom Neft, and Bashneft have all recommended it.

Anonymous has threatened to fight a cyberwar against Putin since the start of the Russia-Ukraine conflict. So far, it has lived up to that promise. Not only has the organisation disclosed Russian information, but it has also infiltrated Russian organisations in order to inform citizens about what is happening outside the nation. 

Anonymous is best known for hacking Russian streaming sites and TV networks in order to show Russian residents what was going on in Ukraine. Last week, the group hacked Enerpred, Russia's largest hydraulic equipment manufacturer dealing in the energy, coal, gas, oil, and construction industries, and stole 645,000 emails (up to 432GB of data).

The company's headquarters are in Irkutsk, Eastern Siberia's capital, and offices in major Russian cities including Moscow and St. Petersburg. DDoSecrets' (Distributed Denial of Secrets) website has the leaked data.

All Organisations Must Report Cybersecurity Beaches Within 6 Hours: CERT-In

 

CERT-In, India's computer, and emergency response team released new guidelines on Thursday that mandate that service providers, intermediaries, data centres, and government institutions disclose cybersecurity incidents, including data breaches, within six hours.

The government said in a release, "Any service provider, intermediary, data center, body corporate and Government organization shall mandatorily report cyber incidents [...] to CERT-In within six hours of noticing such incidents or being brought to notice about such incidents."

Compromise of critical systems, targeting scanning, unauthorised access to computers and social media accounts, website defacements, malware deployments, identity theft, DDoS attacks, data breaches and leaks, rogue mobile apps, and attacks against servers and network appliances such as routers and IoT devices are among the types of incidents covered.

The government stated  it was taking these steps to ensure that the required indicators of compromise (IoC) associated with security events are easily accessible to "carry out the analysis, investigation, and coordination as per the process of the law”

Concerned organisations are also required to synchronise ICT system clocks to the National Informatics Centre (NIC) or National Physical Laboratory (NPL) Network Time Protocol (NTP) Server, maintain ICT system logs for a rolling period of 180 days, and necessitate VPN service providers to maintain data such as names, addresses, phone numbers, emails, and IP addresses of subscribers for a minimum of five years, according to the guidelines.

The guidelines also require virtual asset service, exchange, and custodian wallet providers to preserve records on Know Your Customer (KYC) and financial transactions for a period of five years, starting in 60 days.

India's Ministry of Electronics and Information Technology (MeitY) said in a statement, "These directions shall enhance overall cyber security posture and ensure safe and trusted Internet in the country."

DDoS Attacks Hit Ukrainian Government Websites

 

DDoS attacks are causing havoc for the Ministry of Defense and the Armed Forces of Ukraine, as well as two of the country's state-owned banks, Privatbank (Ukraine's largest bank) and Oschadbank (the State Savings Bank). 

Bank customers got text messages saying that bank ATMs were down today, according to Ukraine's Cyberpolice, who added that the messages were "part of an information attack and do not correspond to reality." 

The Ukrainian Ministry of Defense, whose website was taken down as a result of the attacks, stated their website was most likely assaulted by DDoS: an excessive number of requests per second was observed. 

"Starting from the afternoon of February 15, 2022, there is a powerful DDOS attack on a number of information resources of Ukraine," Ukraine's State Service for Special Communication and Information Protection added. 

"In particular, this caused interruptions in the work of web services of Privatbank and Oschadbank. The websites of the Ministry of Defense and the Armed Forces of Ukraine were also attacked."

While the Ukrainian defence ministry's website is down, Oschadbank and Privatbank's websites are still up and running, albeit users are unable to access their online banking. Privatbank users have been experiencing problems with payments and the bank's mobile app, according to the Ukrainian Center for Strategic Communications and Information Security. Some stated that they couldn't get into their Privat24 internet banking accounts, while others said they observed inaccurate balances and recent transactions. 

A traffic geofencing rule was added to Privatbank's web application firewall (WAF), which automatically removed the website's contents for IP addresses outside of Ukraine and displayed a "BUSTED! PRIVATBANK WAF is watching you)" message. 

The Security Service of Ukraine (SSU) stated on Monday that the country is being targeted in a "massive wave of hybrid warfare" aimed at instilling fear in Ukrainians and undermining their faith in the state's ability to safeguard them. The SSU further stated that it has already blocked many such attempts related to hostile intelligence agencies, as well as dismantled bot farms aimed at spreading fear in Ukrainian residents through bomb threats and fake news.  

Attacks on Ukrainian authorities are being coordinated by the Gamaredon hacking organisation (connected to Russia's Federal Security Service (FSB) by Ukrainian security and secret agencies), according to the country's Computer Emergency Response Team. 

A day later, the SSU announced that it has prevented more than 120 cyberattacks aimed at Ukrainian governmental institutions in January 2022. 

Gamaredon has been directing a wave of spear-phishing emails targeting Ukrainian businesses and organisations relevant to Ukrainian issues since October 2021, according to Microsoft.

Washington State Database Breach May Expose Personal Data

 

The Washington State Department of Licensing stated that the personal information of possibly millions of licenced professionals may have been compromised, after discovering unusual activity on the online licencing system.

According to agency spokesperson Christine Anthony, the agency licences around 40 types of enterprises and professionals, ranging from auctioneers to real estate agents, and it temporarily shut down its web platform after discovering the activities in January. 

Social Security numbers, birth dates, and driver's licences could be among the information held on the POLARIS system. According to Anthony, the agency does not yet know whether such data was accessed or how many people may have been compromised. 

As per The Seattle Times, Anthony stated the agency has been working with the state Office of Cybersecurity, the state Attorney General's Office, and a third-party cybersecurity firm to determine the magnitude of the issue. 

Meanwhile, the POLARIS system's shutdown is creating problems for some professionals and businesses who need to apply for, renew, or update their licences. The outage occurs at a busy period for real estate brokers, appraisers, and home inspectors as the state's real estate market begin to recover from its seasonal slowdown. 

The extent of the breach is undetermined. POLARIS processes data from 23 state-licensed professions and business kinds, according to Anthony. The agency has roughly 257,000 active licences in its system, including bail bonds brokers, funeral directors, home inspectors, and notaries, according to Anthony. He added that there are likely more records that will be uncovered while doing our investigation. 

The State Auditor's Office has set up a website with more details on the security breach as well as links to additional guidance and resources for protecting the identity and credit. That website will be updated with the most recent information on a regular basis. If anyone has any queries, they can contact the Auditor's Office dedicated call centre at 1-855-789-0673 from Monday to Friday, 8 a.m. to 5 p.m. Pacific Time.

Experts Named the Most Popular Passwords of Russians

 

Passwords consisting of simple sequences of letters and numbers became the most popular passwords in Runet in 2021. Combinations qwerty123, qwerty1 and 123456 take top lines of the rating, the fourth place goes to a11111 and fifth place to 123456789. It is noted that among Cyrillic passwords, the most common are "password", "love", "hello" and "natasha". 

Analysts have studied 35.5 billion unique pairs of logins and passwords, including 250 million new ones. According to their data, only 3.5 percent of passwords can be called complex, and 16.5 percent are long. 

According to Alexei Drozd, head of information security at SerchInform, users risk losing access to their pages and personal accounts on various resources using easy passwords in the absence of two-factor authentication. He warned that it's especially dangerous if fraudsters gain access to a person's main mailbox. Then attackers will have an opportunity to take possession of more information, resetting the password from other services. 

For example, passwords are checked for security every time users enter them to access Yandex services: a database of 1.2 billion compromised credentials is used for this purpose. The same check is carried out in VKontakte. Google said that they are advised to think up a password length of at least 12 characters, such as a quote from a movie or a line from your favorite poem. 

Sergei Ivanov, Director of Product Strategy at T1 Group, said that the most common password-guessing technique is called brute force, which has long been used by cybercriminals. It is when anthologies of popular passwords and word directories are attached to the software code. He specified that a combination of six Latin letters of the same case can be found in 31 seconds, assuming the search speed of 10 million passwords per second. It would take only 95 minutes to crack a password consisting of six symbols (letters in different registers and numbers). If the password contains 10 symbols, it will take 2.5 years.

DDoSecrets Published 1.8 TB of Surveillance Footage From Helicopters on the Internet

 

Surveillance drones have been increasingly popular among law enforcement agencies across the United States in recent years, drawing criticism from privacy advocates. However, freshly obtained aerial surveillance footage from the Dallas Police Department in Texas and what appears to be the Georgia State Patrol highlights the range and quality of footage captured by helicopters. 

On Friday, the transparency activist group Distributed Denial of Secrets, or DDoSecrets, released a 1.8-terabyte archive of police helicopter footage on its website. DDoSecrets cofounder Emma Best said her organization doesn't know who shared the material and that no affiliation or purpose for disclosing the files was given. The source just stated that the data was being stored in insecure cloud infrastructure by the two police departments. 

In June 2020, DDoSecrets made headlines when it revealed a massive leak of law enforcement data taken by a hacker linked to Anonymous. Emails, audio, video, and intelligence documents from more than 200 states, municipal, and federal agencies around the US were included in the data, called BlueLeaks. DDoSecrets was banned from Twitter, and Reddit banned the r/blueleaks subreddit. 

The report merely stated that the law enforcement agencies responsible for keeping the video secure were sorting the data in an insecure cloud infrastructure when the bad actor obtained access and posted the video online. WIRED examined the material that was posted online, and according to their article, the samples included footage of a helicopter being piloted during the day and at night, recording everything from an aerial view. 

“This is exactly one of the things that people are constantly warning about, especially when it comes to government surveillance and corporate data mining,” Best told WIRED in a text message interview. “Not only is the surveillance itself problematic and worrisome, but the data is not handled in the ideal conditions we're always promised." 

Police drones have gained a lot of attention recently because they represent a new generation of aerial vehicles capable of stealthy surveillance and novel behaviors, such as flying indoors. Law enforcement forces, on the other hand, have been using helicopters for aerial surveys and monitoring for decades. However, DDoSecrets' footage shows how successful helicopter-mounted cameras are in capturing extremely crisp and detailed video near to the ground. 

Given that such footage could be helpful in a variety of ways for stalkers, assailants seeking materials for blackmail, domestic or international terrorist groups, or those conducting espionage operations, privacy advocates underline the importance of safeguarding aerial police surveillance data.

FBI: Fake Government Websites Used to Steal Private & Financial Data

 

The FBI has alerted the public in the United States that threat actors are proactively capturing sensitive financial and personal information from innocent victims via phoney and fraudulent unemployment benefit websites. 

Websites used in these assaults are built to seem just like official government platforms in order to deceive victims into giving over their information, infecting them with malware, and claiming unemployment benefits on their behalf. 

The federal law enforcement agency stated in a public service announcement published on Internet Crime Complaint Center's site, "These spoofed websites imitate the appearance of and can be easily mistaken for legitimate websites offering unemployment benefits. The fake websites prompt victims to enter sensitive personal and financial information. Cyber actors use this information to redirect unemployment benefits, harvest user credentials, collect personally identifiable information, and infect victim's devices with malware.” 

"In addition to a loss of benefits, victims of this activity can suffer a range of additional consequences, including ransomware infection and identity theft." 

As per the FBI, 385 domains were detected, with eight of them spoofing government sites related to official unemployment benefits platforms. Domain and status are listed below:
  • employ-nv[.]xyz:  Active 
  • employ-wiscon[.]xyz: Inactive 
  • gov2go[.]xyz : Active 
  • illiform-gov[.]xyz : Active 
  • mary-landgov[.]xyz : Active 
  • Marylandgov[.]xyz: Inactive 
  • newstate-nm[.]xyz:  Active 
  • Newstatenm[.]xyz: Inactive 
There is also a possibility that the data obtained through these fake sites will end up in the hands of identity fraudsters, who would use it in different benefit fraud schemes. The US Federal Trade Commission (FTC) reported in February 2021 that the overall number of identity theft reports doubled in 2020 compared to 2019, with 1.4 million reports in a single year. 

The FTC stated, "2020’s biggest surge in identity theft reports to the FTC related to the nationwide dip in employment. After the government expanded unemployment benefits to people left jobless by the pandemic, cybercriminals filed unemployment claims using other people’s personal information." 

For example, the FTC received 394,280 reports of government benefits fraud attempts last year, the majority of which were connected to unemployment benefit identity theft fraud, compared to 12,900 reported in 2019. 

The Internal Revenue Service (IRS) also issued taxpayer guidelines in January on recognizing theft activities involving unemployment payments. The US federal revenue service stated, "The Internal Revenue Service today urged taxpayers who receive Forms 1099-G for unemployment benefits they did not actually get because of identity theft to contact their appropriate state agency for a corrected form." 

"Additionally, if taxpayers are concerned that their personal information has been stolen and they want to protect their identity when filing their federal tax return, they can request an Identity Protection Pin (IP PIN) from the IRS." 

The FBI also offered some advice on how to safeguard yourself against identity theft in the release and a few are listed below: 
  • To identify limitations, the spelling of web addresses should be verified. 
  • Check that the website you're visiting has an SSL certificate. 
  • Software upgrades are required; 
  • It is recommended that two-factor authentication be utilized. 
  • Avoid phishing emails at all costs.

Acer Confirms Breach After Cyber Attack on Indian Servers

 

A hacker group has claimed to have hacked Acer India's servers, with about 60GB of confidential information belonging to several million of the company's customers. 

According to a post on a prominent hacker site noticed by Privacy Affairs researchers, the group known as Desordern claimed to have acquired consumer information, business data, financial data, and information linked to recent company audits. 

According to the hackers, the breach includes information on several million Acer customers, the majority of which are from India. It appears to have happened on October 5, according to the most current date stated in the leaked databases. Desordern also stated that it will provide Acer with access to the database in order to substantiate the data and show the breach is legitimate. 

A sample of the data released for free which included information on over 10,000 people, was confirmed to be accurate and real by Privacy Affairs researchers, who were able to contact some of those impacted. Data belonging to millions more Acer customers will be available for a fee at a later date, as per the group. 

An Acer spokesperson told IT Pro, “We have recently detected an isolated attack on our local after-sales service system in India.” 

“Upon detection, we immediately initiated our security protocols and conducted a full scan of our systems. We are notifying all potentially affected customers in India.” 

The issue has been reported to local law enforcement and the Indian Computer Emergency Response Team, according to the spokesman, and there has been no substantial impact on the company's activities or business continuity. 

In March of this year, Acer was the victim of a $50 million ransomware assault carried out by the notorious ransomware group REvil. The group disclosed the Acer breach on its website, where it displayed photos of allegedly stolen information such as financial spreadsheets, bank communications, and bank balances. The vulnerability was thought to be connected to a Microsoft Exchange cyber-attack conducted by at least 10 hacker groups.