An embarrassing ransomware attack catches company off guard, new tactic for sextortion and be a caution to political parties to be careful with political apps.
Welcome to Cyber Security Today. It’s Friday April 5th. I’m Howard Solomon, contributing writer on cyber security for ITWorldCanada.com
 |
 |
 |
Arizona Beverages makes a lot of uplifting tea drinks. But today the company should be hanging its head after a ransomware attack exposed a lot of security weaknesses. According to a news story this week on TechCrunch, the attack hit more than 200 company servers and computers. What helped spread the attack is that many servers were running older versions of Windows that hadn’t received security patches in years. The hit left the company unable to process orders. That left one source to say the firm was losing millions of dollars until the computer system was rebuilt. On top of that, the backup system wasn’t configured properly so data couldn’t be retrieved for days.
Having old servers is a sign the IT department didn’t have a proper inventory of equipment. And the failed backup system meant it hadn’t been tested to make sure it worked in an emergency.
Sextortion is an ugly way of attacking people. It’s the attempt to blackmail people with little or no evidence they’ve done something wrong. The method is to send an email with a tiny bit of personal information, enough to make the victim think someone has something on them. The latest trick according to Trustwave, is to include your email address in the subject line and text of the message to make you pay up. Of course the hacker probably got your email address from a list of stolen data. Not only that, the latest twist is pretending the message comes from the CIA. After all, spooks have the goods on everyone, right? Nope. If you get one of these messages, delete it.
I’ve mentioned more than once how important it is that companies make sure their employees carefully protect any personal customer data they put on public Internet storage services. Two more clumsy companies surfaced this week. Security company UpGuard found a Mexican media company named Cultura Colectiva had stored a database with millions of records on Facebook users, including comments, likes, account names and Facebook IDs just sitting there in the open. And someone at a now defunct app called At The Pool stored unscrambled names, passwords and email addresses on 22,000 Facebook users. That company closed in 2014, but apparently no one cared to make sure all data was deleted.
Facebook gives developers lots of data to play with. However, to protect that data companies need to create cloud storage policies, and then enforce them.
Finally, it’s not only a federal election year in Canada, three provinces — British Columbia, Manitoba and Alberta — are voting as well. Meanwhile, in the U.S. come November there will be a number of gubernatorial and state legislature elections. That means political parties will be thinking of ways to communicate with voters, including creating mobile apps. So here’s some advice: It isn’t easy to create a secure app. Just ask political parties in Israel. There, Check Point Software recently analyzed Android mobile apps of three parties and found serious vulnerabilities. Sensitive information, including home addresses, emails credit card numbers contacts, phone numbers of not only the users but many party members could be gained from one app. Another app could be used to access the contact list on a person’s phone. So political party developers, be warned.
By the way, Canada’s privacy commissioner this week issued guidance to political parties on their responsibilities to protect the personal data of supporters they collect.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening.