Baby data breach, stolen business contact database for sale and cyber attack at the United Nations
Welcome to Cyber Security Today. It’s Wednesday January 15th. I’m Howard Solomon, contributing reporter on cyber security for ITWorldCanada.com.
To hear the podcast, click on the arrow below:
 |
 |
 |
The Internet allows people to share joyous moments in their lives. Unfortunately some companies enabling you to do that aren’t careful with their security, exposing people to possible danger. That’s the case with developer Bithouse Inc., creator of a mobile app called Peekaboo Moments. It allows parents to create video and still image scrapbooks of their little ones to share with family and friends. The company’s site says the images are stored securely. But a security researcher told the Information Security Media Group he discovered an open Peekaboo Moments database with links to subscriber images and their email addresses. The app also includes the ability for parents to record baby information like birthdays, as well as track locations. It isn’t known if anyone with criminal intent also found the database.
However, another company with sloppy security that left a database open was victimized. It’s a U.S. firm called LimeLeads, which sells lists of business contacts that can be used for sales pitches. The ZDNet news service reports that a database with contact information of some 49 million people held by LimeLeads has been put on sale by a hacker. Why? Because no one put a password on a company server holding the information, and the server was linked to the Internet. While the company was warned in September and the problem fixed, apparently a thief got in there first. The data appears to be mainly information that could be gleaned from public sources, like the contact’s name, company address, company revenue and estimated number of employees. But it also included email addresses, which could be used to launch email attacks.
You might think that malware is a problem mainly faced by companies with something to steal, like money or credit card data. But governments also have to worry about being attacked. According to a report from the Bleeping Computer news service, countries with offices at the United Nations were recently targeted with email pretending to be from the so-called “Permanent Mission of Norway.” The email asked recipients to look at an attached Microsoft Word agreement that Norway found a problem with. That document is infected with malware that among other things steals passwords and data. You can imagine how valuable stolen passwords of diplomats are. The malware could also be used to spread ransomware. One lesson for all listeners is to make sure their word processor is set to NOT allow automatic processes called macros to run when documents are opened. This particular malware asks users to enable editing and enable content in order to open. That’s a big sign a document may be infected. Get one of these and you should check with others before opening.
Compromised plugins to publishing software WordPress are a major way criminals get into systems. Another one was discovered last week. Those of you using a plugin called InfiniteWP should update to the latest version as soon as possible.
Finally, yesterday’s monthly Patch Tuesday security releases from Microsoft included a big fix for Windows 10. If you don’t have Windows set up to automatically find and install updates, make sure this set of patches is installed in the next few days.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.