Tag: cybercrime

Posted on

UK mobile and broadband carriers face fines of $117K/day, or 10% of sales, if they fail to follow new cybersecurity rules

More than three years in the making, the UK government today announced a new, sweeping set of rules it will be imposing on broadband and mobile carriers to tighten up their network security against cyber attacks — aimed at being “among the strongest in the world” when they are rolled out, said the Department for Digital, Culture, Media and Sport.

The new requirements cover areas such as how (and from whom) providers can procure infrastructure and services; how providers police activity and access; the investments they make into their security and data protection and the monitoring of that; how providers inform stakeholders of resulting data breaches or network outages; and more. The rules will start to get introduced in October, with carriers expected to fully implement new procedures by March 2024.

Critically, those who fail to comply with the new regulations will face big fines: non-compliance can result in up to 10% of annual revenues; continuing contraventions will see fines of £100,000 ($117,000) per day. Communications regulator Ofcom, which worked with the National Cyber Security Centre to formulate the new regulations and code of practice, will enforce compliance and fines.

The rules are the first big enforcement directives to come out of the Telecommunications (Security) Act, which was voted into law in November 2021. 

“We know how damaging cyber attacks on critical infrastructure can be, and our broadband and mobile networks are central to our way of life,” Digital Infrastructure Minister Matt Warman said in a statement. “We are ramping up protections for these vital networks by introducing one of the world’s toughest telecoms security regimes which secure our communications against current and future threats.”

The emergence of the new security laws and enforcement process comes at a crossroads.

On one hand, as security breaches continue to grow in scope and frequency, one of the most significant battlegrounds that has emerged in the fight against cybercrime has been  network infrastructure — the mobile and broadband rails that all of our apps and device need to function. For the most part broadband and mobile providers have set their own standards and processes, although the government today pointed out that a Telecoms Supply Chain Review that it carried out “found providers often have little incentive to adopt the best security practices.”

On the other, there have been a number of breaches over the years that point not just to the sitting duck that is network infrastructure, but the failure to protect it. These have included incidents that threaten to reveal carriers’ source code; exposure of lax security policies to gain network access; and creating targets out of their customers by not being stronger on security. The state of play was particularly laid bare a few years ago as 5G networks were starting to take shape, when there were question marks over not just how those networks would be secured, but whether the very equipment that was being procured — Chinese vendors being a key issue at the time that the legislation was first taking shape — was safe.

The aim of the new rules is meant to be all-encompassing, covering not just how networks are being built and run, but the services that run on them.

As the government lays out, they “protect data processed by their networks and services, and secure the critical functions which allow them to be operated and managed; protect software and equipment which monitor and analyze their networks and services; [require providers to] have a deep understanding of their security risks and the ability to identify when anomalous activity is taking place with regular reporting to internal boards; and take account of supply chain risks, and understand and control who has the ability to access and make changes to the operation of their networks and services to enhance security.”

Notably the new laws do not lay out any specific names of companies, nor of countries, which gives the government license to change course, but might be seen as a way to further politicize the process.

“We increasingly rely on our telecoms networks for our daily lives, our economy and the essential services we all use,” said NCSC Technical Director Dr Ian Levy in a statement. “These new regulations will ensure that the security and resilience of those networks, and the equipment that underpins them, is appropriate for the future.”

Posted on

Twilio says breach also compromised Authy two-factor app users

U.S. messaging giant Twilio has confirmed hackers also compromised the accounts of some Authy users as part of a wider breach of Twilio’s systems. Authy is Twilio’s two-factor authentication (2FA) app it acquired in 2015.

Twilio’s breach earlier this month, which saw malicious actors accessing the data of over 100 Twilio customers after successfully phishing multiple employees, keeps growing in scale. Researchers this week linked the attack on Twilio and others to a wider phishing campaign by a hacking group dubbed “0ktapus,” which has stolen close to 10,000 employee credentials from at least 130 organizations since March.

Now, Twilio has confirmed that Authy users were also impacted by the breach.

In an update to its incident report on August 24, Twilio said that the hackers gained access to the accounts of 93 individual Authy users and registered additional devices, effectively allowing the attackers to generate login codes for any connected 2FA-enabled account.

The company said it has “since identified and removed unauthorized devices from these Authy accounts” and is advising affected Authy users, which it has contacted, to review linked accounts for suspicious activity. It’s also recommending that users review all devices tied to their Authy accounts and disable “allow Multi-device” in the Authy application to prevent new device additions.

While using any two-factor authentication is better than none, hackers are increasingly devising new ways to trick users into handing over app-based codes, which is generally far more difficult to obtain than codes sent by text message.

Twilio also said in the update that the number of compromised Twilio customers has increased from 125 to 163, with hackers accessing data at these organizations for a “limited period of time.” Twilio has not named its impacted customers, but some — like encrypted messaging app Signal — have notified their own users that they were affected by the Twilio breach.

Identity giant Okta on Thursday also confirmed it was compromised as a result of the Twilio breach. The company said in a blog post that the hackers — which it refers to as “Scatter Swine” — spoofed Okta login pages to target organizations that rely on the company’s single sign-on service. Okta said that when the hackers gained access to Twilio’s internal console, they obtained a “small number” of Okta customer phone numbers and SMS messages that contained one-time passwords. This marks the second time Okta has reported a security incident this year.

In its analysis of the phishing campaign, Okta said that Scatter Swine hackers likely harvested mobile phone numbers from data aggregation services that link phone numbers to employees at specific organizations. At least one of the hackers called targeted employees impersonating IT support, noting that the hacker’s accent “appears to be North American.” This may align with this week’s Group-IB investigation, which suggested one of the hackers involved in the campaign may reside in North Carolina.

DoorDash on Thursday also confirmed this week that it was compromised by the same hacking group. The food delivery giant told TechCrunch that malicious hackers stole credentials from employees of a third-party vendor that were then used to gain access to some of DoorDash’s internal tools. The company declined to name the third-party, but confirmed the vendor was not Twilio.

DoorDash hit by data breach linked to Twilio hackers

Posted on

DoorDash hit by data breach linked to Twilio hackers

Food delivery giant DoorDash has confirmed a data breach that exposed customers’ personal information.

In a blog post shared with TechCrunch ahead of its publication at market close, DoorDash said malicious hackers stole credentials from employees of a third-party vendor that were then used to gain access to some of DoorDash’s internal tools.

DoorDash said the attackers accessed names, email addresses, delivery addresses and phone numbers of DoorDash customers. For a “smaller subset” of users, hackers accessed partial payment card information, including card type and the last four digits of the card number.

For DoorDash delivery drivers, or Dashers, hackers accessed data that “primarily included name and phone number or email address.” Users of Wolt, the Helsinki-based online ordering and delivery company acquired by DoorDash last year, are unaffected.

DoorDash says that a “small percentage” of users were affected by the incident but declined to say how many users it currently has or provide an accurate number of affected users.

The company said it cut off the third-party vendor’s access to its systems after discovering “unusual and suspicious” activity.

DoorDash did not name the third-party vendor, which “provides services that require limited access to some internal tools,” according to DoorDash spokesperson Justin Crowley, but confirmed to TechCrunch that the vendor breach is linked to the phishing campaign that compromised SMS and messaging giant Twilio on August 4. Researchers linked these attacks to a wider phishing campaign by the same hacking group, dubbed “0ktapus,” which has stolen close to 10,000 employee credentials from at least 130 organizations, including Twilio, Signal, internet companies and outsourced customer service providers, since March.

DoorDash would not say when it discovered it was compromised, but its spokesperson said that the company took time to “fully investigate what happened, what users were impacted and how they were impacted” before disclosing the data breach.

DoorDash says that since discovering the compromise the company hired an unnamed cybersecurity expert to help with its ongoing investigation and is taking action to “further enhance DoorDash’s already robust security systems.”

This isn’t the first time that hackers have stolen customer data from DoorDash’s systems. In 2019, the company reported a data breach affecting 4.9 million customers, delivery workers and merchants who had their information stolen by hackers. It also blamed the breach on an unnamed third-party service provider.

Read more:

From the archives:

Posted on

Twilio hackers breached over 130 organizations during months-long hacking spree

The hackers that breached Twilio earlier this month also compromised over 130 organizations during their hacking spree that netted the credentials of close to 10,000 employees.

Twilio’s recent network intrusion allowed the hackers access the data of 125 Twilio customers and companies — including end-to-end encrypted messaging app Signal — after tricking employees into handing over their corporate login credentials and two-factor codes from SMS phishing messages that purported to come from Twilio’s IT department. At the time, TechCrunch learned of phishing pages impersonating other companies, including a U.S. internet company, an IT outsourcing company and a customer service provider, but the scale of the campaign remained unclear.

Now, cybersecurity company Group-IB says the attack on Twilio was part of a wider campaign by the hacking group it’s calling “0ktapus,” a reference to how the hackers predominantly target organizations that use Okta as a single sign-on provider.

Group-IB, which launched an investigation after one of its customers was targeted by a linked phishing attack, said in findings shared with TechCrunch that the vast majority of the targeted companies are headquartered in the U.S. or have U.S.-based staff. The attackers have stolen at least 9,931 user credentials since March, according to Group-IB’s findings, with more than half containing captured multi-factor authentication codes used to access a company’s network.

“On many occasions, there are images, fonts, or scripts that are unique enough that they can be used to identify phishing websites designed with the same phishing kit,” Roberto Martinez, a senior threat intelligence analyst at Group-IB, told TechCrunch. “In this case, we found an image that is legitimately used by sites leveraging Okta authentication, being used by the phishing kit.”

“Once we located a copy of the phishing kit, we started digging deeper to get a better understanding of the threat. The analysis of the phishing kit revealed that it was poorly configured and the way it had been developed provided an ability to extract stolen credentials for further analysis,” said Martinez.

While it’s still not known how the hackers obtained phone numbers and the names of employees who were then sent SMS phishing messages, Group-IB notes that the attacker first targeted mobile operators and telecommunications companies and “could have collected the numbers from those initial attacks.”

Group-IB wouldn’t disclose the names of any of the corporate victims but said the list includes “well-known organizations,” most of which provide IT, software development and cloud services. A breakdown of the victims shared with TechCrunch shows that the threat actors also targeted 13 organizations in the finance industry, seven retail giants, and two video game organizations.

During its investigation, Group-IB discovered that code in the hacker’s phishing kit revealed configuration details of the Telegram bot that the attackers used to drop compromised data. (Cloudflare first revealed the use of Telegram by the hackers.) Group-IB identified one of the Telegram group’s administrators who goes by the handle “X,” whose GitHub and Twitter handles suggest they may reside in North Carolina.

Group-IB says it’s not yet clear if the attacks were planned end-to-end in advance or whether opportunistic actions were taken at each stage. “Regardless, the 0ktapus campaign has been incredibly successful, and the full scale of it may not be known for some time,” the company added.

The Moscow-founded startup Group-IB was co-founded by Ilya Sachkov, who was the company’s chief executive until September 2021 when Sachkov was detained in Russia on charges of treason after allegedly transferring classified information to an unnamed foreign government, claims Sachkov denies. Group-IB, which has since moved its headquarters to Singapore, maintains the co-founder’s innocence.

Posted on

Mudge’s report helps Musk’s legal fight over $44B Twitter deal; says there are ‘millions’ of accounts that could be spam bots

Elon Musk has been handed a fat golden goose to feed his legal battle over ending his acquisition of Twitter. The tech mogul has been trying to cancel his Twitter-approved $44 billion bid because he believes Twitter has not been transparent about the number of bots on the platform. Twitter’s taken him to court to get him to honor his deal saying it’s honored all requests. Now, however, Musk can cite data from the company’s former head of security, renowned hacker Peiter “Mudge” Zatko, to bolster his claim.

But if Musk is still looking for an actual number of bots, he won’t find that here.

The information comes from an explosive whistleblower complaint that Mudge made earlier this year to the U.S. SEC, FTC and DOJ over Twitter’s cybersecurity and data protection mismanagement, which was made public for the first time earlier today.

That complaint includes a pretty extensive rundown on the subject of bots on Twitter.

To be clear, Mudge has stated that he hadn’t previously shared information with Musk about the topic of bots:

“Mudge began preparing these disclosures in early March 2022, well before Mr. Musk expressed any interest in acquiring Twitter, and has not communicated these disclosures to anyone with a financial interest in Twitter,” the report notes. And to be sure, bots are a huge part of Twitter and have been a topic of discussion for at least a decade at this point. Nevertheless, the complaint as published today by the non-profit Whistleblower Aid includes a specific reference to the spat between Musk and Twitter, with the evidence supplied playing directly into Musk’s hand. (Note: The Washington Post reports that even if Mudge didn’t disclose this information to Musk directly, he was allegedly contacted by Musk for a deposition before this report became public in connection with Musk’s legal case.)

The complaint runs to some 84 pages, with a section of about 11 pages dedicated to the bot issue, centering on how Twitter has repeatedly misrepresented bots on the platform, not just with Musk.

Mudge alleges that not only does Twitter not care about the number of bots on the platform but that “executives are not incentivized to accurately ‘detect’ or report total spam bots on the platform.”

The attempt to move the discussion away from bots at Twitter, he said, was directly related to the creation of a new user metric at the company, monetizable daily active users (mDAUs). Until 2019, the complaint notes, Twitter reported total monthly users, “but stopped because the number was subject to negative swings for a variety of reasons, including situations such as the removal of large numbers of inappropriate accounts and botnets.”

The mDAU metric, which covered “valid user accounts that might click through ads and actually buy a product” has been a subject of criticism precisely for the reason Mudge’s complaint notes: Twitter basically defined the metric to fit a rosier picture of the company. It “could internally define the mDAU formula, and thereby report numbers that would reassure shareholders and advertisers,” it notes.

Executives are incentivized to avoid counting spam bots as mDAU, it continues, “because mDAU is reported to advertisers, and advertisers use it to calculate the effectiveness of ads.” Put simply, it’s not been disclosing or counting bots as part of mDAU because to do so would present a bad picture to advertisers: they’re paying to reach an audience that will never click on ads.

Importantly, the bullseye is never hit here, either. There are “many millions” of active accounts that are not considered as part of mDAU, Mudge’s complaint notes — “either because they are spam bots, or because Twitter does not believe it can monetize them.

“Musk is correct,” he goes on. “Twitter executives have little or no personal incentive to accurately ‘detect’ or measure the prevalence of spam bots.”

The explanation for how hard it is to figure out how many bots are on the platform speaks to how the company does try to avoid this topic at an executive, as well as organizational, level.

When Mudge describes talking to the former Head of Site Integrity about spam bot numbers, the response was simple: “We don’t really know.”

The company could not even provide an accurate upper bound on the total number of spam bots on the platform, he continues, citing three reasons for this: (1) no ability to measure; (2) could not keep up with bots and platform abuse; (3) no appetite to know from senior management, and therefore de-prioritized. His claim is that revealing the actual numbers would harm the company’s reputation and business.

One very interesting detail in the report is about a tool Twitter has called ROPO, short for read-only, phone-only. ROPO is a script that identifies and blocks spam bots based on how little accounts engage in content versus tweet it. The activity imbalance prompts a text message to be sent by Twitter with a one-time code, so that if the account is just a natural lurker, it can verify that is the case. Or if it’s a bot and doesn’t respond, the account switches to read-only.

Mudge notes that an executive during his time there proposed disabling ROPO altogether, claiming that it brought up too many errors. The Site Integrity exec teamed up with Mudge to try to prevent it from getting disabled, since “ROPO was effectively blocking more than 10-12 million bots each month with a surprisingly low rate (<1%) of false positives.”

There is also an extensive rundown of wordplay from the current CEO Parag Agrawal over how many bot accounts there are on the platform. The long and short is that the complaint dances around numbers but never lands on them, which effectively proves the point that Twitter does not have a grip on this number, or at least doesn’t have a grip that it’s willing to disclose.

Twitter ex-security head says the social network has ‘deficient moderation’ for Spaces

Posted on

LockBit ransomware group downed by DDoS after claiming Entrust breach

The LockBit ransomware gang is claiming responsibility for the July cyberattack against cybersecurity giant Entrust, but with a twist — the group is also accusing its latest victim of a counterattack.

Entrust, which describes itself as a global leader in identities, payments and data protection, said in late July that an “unauthorized party” accessed parts of its network, but declined to describe the nature of the attack or say if customer data was stolen. Entrust’s customers include a number of U.S. government agencies, including the Homeland Security, the Department of Energy and the Treasury.

On Friday, LockBit, a prominent ransomware operation that’s previously claimed attacks on Foxconn and Accenture, took responsibility for the July cyberattack by adding Entrust to its dark web leak site. The gang began leaking the company’s internal data this weekend, suggesting Entrust may have refused to meet the group’s ransom demands.

But soon after, an apparent distributed denial of service (DDoS) attack forced LockBit’s dark web leak site offline.

Azim Shukuhi, a security researcher at Cisco’s Talos, cited a LockBit member going by the handle “LockBitSupp,” who claimed the site was receiving “400 requests a second from over 1,000 servers.” While the perpetrators of the DDoS attack remain unknown, the same LockBit member told Bleeping Computer that the attack “began immediately after the publication of data and negotiations,” and separately told malware research group VX-Underground that they believed the attack was launched by someone connected to Entrust, referencing junk internet traffic that said “DELETE_ENTRUSTCOM_MOTHERFUCKERS.”

LockBit’s site remains largely inaccessible Monday, but briefly showed a message warning that the gang plans to upload Entrust’s stolen data to peer-to-peer networks, making the data almost impossible to take down.

TechCrunch asked Entrust to confirm or deny any knowledge of, or any connection to, the DDoS attack. Ken Kadet, vice president of communications at Entrust, declined to respond to multiple emails sent prior to publication.

Offensive cyberattacks — or “hacking back” against cybercriminals, such as launching DDoS attacks against unwilling participants — are illegal under U.S. law and could be classified as a federal criminal offense under the Computer Fraud and Abuse Act. Hacking back has been subject to intense debate for years as a possible alternative to protecting U.S. companies from international threats, though critics say allowing private companies to engage in cyberwarfare risks escalating diplomatic tensions and destabilizing state relations.

Or, as one security researcher puts it: “The idea that a cybersecurity company would be yeeting a DDoS around would set a dangerous precedence [sic].”

Cybersecurity vendor Entrust tells customers data was stolen during June cyberattack

Posted on

DigitalOcean says customer email addresses were exposed after latest Mailchimp breach

Cloud giant DigitalOcean says that some customers’ email addresses were exposed because of a recent “security incident” at email marketing company Mailchimp.

In a scant blog post dated August 12, just two days after the company’s co-founder and long-time CEO Ben Chestnut stepped down, Mailchimp said a recent but undated attack saw threat actors targeting data and information from “crypto-related companies” using phishing and social engineering tactics. Mailchimp hasn’t yet shared any further details about the incident — or responded to TechCrunch’s questions — just months after hackers compromised an internal Mailchimp tool to access information on 300 accounts.

While Mailchimp is keeping quiet, DigitalOcean is not, after confirming it also fell victim to the attack.

In a blog post, DigitalOcean’s head of security Tyler Healy said the company discovered its Mailchimp account was compromised on August 8 after finding its emails, like account confirmations and password resets delivered via Mailchimp, stopped reaching its customers. Its investigation found that DigitalOcean’s Mailchimp account was suspended without warning or explanation. An automated email from Mailchimp said the account had been temporarily disabled due to a “terms of service” violation. Mailchimp sent the same message to others working in the crypto industry, fueling speculation that the company had dropped crypto content creators from its service.

At the same time, Healy says DigitalOcean’s security team was made aware by one of its customers who claimed their password was reset without their consent.

DigitalOcean says it took two days for the company to receive a response from Mailchimp, confirming on August 10 that DigitalOcean’s account was compromised and that Mailchimp suspended the account as a result. DigitalOcean said it understands that an attacker “compromised Mailchimp internal tooling.”

Healy said a “very small number” of DigitalOcean customers experienced an attempted compromise of their accounts through password resets. TechCrunch asked DigitalOcean how many users were affected but has yet to receive a response.

In its short explanation of the incident, Mailchimp says it took “proactive measures to temporarily suspend account access for accounts where we detected suspicious activity while we investigate the incident further,” adding: “We took this action to protect our users’ data, and then acted quickly to notify all primary contacts of impacted accounts and implement an additional set of enhanced security measures.”

In an email sent to one affected customer that TechCrunch has seen, Mailchimp said it became aware of “potential unauthorized activity” in the users’ account and advises “letting your contacts know they should be extra vigilant about any phishing attacks that appear to come from your company or company’s account.”

Mailchimp said it has notified affected customers directly. DigitalOcean said it has migrated its email service away from MailChimp.

DigitalOcean noted that the use of two-factor authentication saved a handful of customers targeted by the attacker from complete account compromise and, as such, the company is planning to implement two-factor security by default for all DigitalOcean accounts.

“The ecosystem is fragile, and chains of trust, when broken, can have significant downstream consequences,” said Healy.

News of Mailchimp’s breach lands not long after encrypted messaging app Signal said it was affected by the recent breach of Twilio. a provider of SMS and voice communications. Signal said attackers accessed phone numbers and SMS verification codes for 1,900 users.

Read more:

Posted on

What you might have missed at Black Hat and Def Con 2022

Hackers, researchers, cybersecurity companies, and government officials descended on Las Vegas last week for Black Hat and Def Con, a cybersecurity double-bill that’s collectively referred to as “hacker summer camp.”

This year’s cyber gathering was particularly exciting: not only did it mark Black Hat’s 25th anniversary, but also the first time since the start of the pandemic that the attendees have fully returned to the carpeted hallways of the popular security conferences. This meant that amid the mask confusion and subsequent influx of positive tests, there was a lot for the hacking community to catch up on.

We’ve rounded up some of the best announcements from the two shows.

Starlink hacked with $25 homemade modchip

A cybersecurity researcher revealed it’s possible to hack into Starlink terminals using a $25 device. Belgian security researcher Lennert Wouters took to the stage at Black Hat on Thursday to showcase how he was able to hack StarLink’s user terminals — referred to as “Dishy McFlatface” by Elon Musk’s SpaceX employees — using a homemade circuit board, or “modchip.” This gadget permits a fault injection attack that bypasses Starlink’s security system and allows access to control functions that Starlink had intended to keep locked down. Wouters revealed the vulnerability to SpaceX last year, earning his place in the company’s bug bounty hall of fame. Following his talk, SpaceX responded with a six-page paper explaining how it secures its systems along with a firmware update that “makes the attack harder, but not impossible, to execute.”

Zoom installer flaw enables root access on macOS

Thanks to the widespread shift to remote and hybrid working witnessed over the past couple of years, Zoom has become an essential communications tool for many organizations and is installed on millions of devices worldwide. But security researcher Patrick Wardle revealed during a talk at Def Con that a flaw in Zoom’s installer for macOS could allow attackers to gain the highest level of access to the operating system, including system files and sensitive user documents. Wardle discovered the Zoom macOS installer has an auto-update function that runs in the background with elevated privileges, allowing an attacker to run any program through the update function and gain those privileges. Although the flaw was not patched at the time of Wardle’s presentation, Zoom fixed the issue in an update released over the weekend.

Ukraine’s cyber chief makes surprise appearance

Victor Zhora, Ukraine’s lead cybersecurity official, made an unannounced visit to Black Hat, where he spoke to attendees about the state of cyberwarfare in the country’s conflict with Russia. Zhora, who serves as deputy chairman of Ukraine’s State Service of Special Communications and Information Protection, revealed that cyber incidents in the country have tripled since Russia’s invasion in February, adding that Ukraine had detected over 1,600 “major” cyber incidents so far in 2022, including the discovery of the Industroyer2 malware that can manipulate equipment in electrical utilities to control the flow of power.

U.S. unmasks alleged Conti ransomware operative

Also making a surprise appearance was the U.S. Department of State, which used the opportunity to announce a $10 million reward for information leading to the identification and location of five alleged members of the notorious Russia-backed Conti ransomware gang. The reward is offered as part of the State Department’s Rewards for Justice (RFJ) program, which on Thursday shared an image of a known Conti ransomware operator known as “Target,” marking the first time the U.S. government has publicly identified a Conti operative.

Virtru reveals encrypted period-tracking app prototype

The recent overturning of Roe v. Wade sparked fears that period and ovulation-tracking apps could be used to prosecute people who seek an abortion or medical care for a miscarriage and those who assist them. In response, Virtru, best known for its email encryption service for enterprises and consumers, showcased a prototype period-tracking app at Def Con that claims to give users complete control of their private information. SecureCycle, built by a team of Virtru employees in three days during a recent company hackathon, leverages open-source end-to-end encryption offered by OpenTDF and will notify the data owner if any third party attempts to access their data.

‘Basic’ security flaws create major 5G risks

5G commercial networks are starting to roll out, promising exciting new use cases like automated cars, more intelligent healthcare, and smart sensor networks. But Altaf Shaik, a researcher at the Technical University of Berlin, said these 5G networks could also present new security challenges. Shaik and his colleague Shinjo Park examined the APIs offered by 10 mobile carriers that make Internet of Things data accessible to developers and found “basic” API vulnerabilities in every one. Shaik told Wired that though these flaws are simple, they could be abused to reveal SIM card identifiers, SIM card secret keys, billing information and the identity of who purchased which SIM card.

Read more on TechCrunch:

Posted on

US unmasks alleged Conti ransomware operative, offers $10M for intel

The U.S. government said it will offer up to $10 million for information related to five people believed to be high-ranking members of the notorious Russia-backed Conti ransomware gang.

The reward is offered as part of the U.S. State Department’s Rewards for Justice (RFJ) program, which on Thursday shared an image of a known Conti ransomware operator known as “Target,” marking the first time the U.S. government has publicly identified a Conti operative. The program, which specifically seeks information on national security threats, is offering up to $10 million for information leading to the identification and location of Target, along with four other alleged Conti members known as “Tramp,” “Dandis,” “Professor,” and “Reshaev.”

The RFJ said it would also pay out up to $5 million “for information leading to the arrest and/or conviction of any individual in any country conspiring to participate in or attempting to participate in a Conti variant ransomware incident.”

The State Department said Conti has carried out more than 1,000 ransomware operations targeting U.S. and international critical infrastructure, including law enforcement agencies, emergency medical services and 911 dispatch centers. Most recently, the gang infiltrated 27 government institutions in Costa Rica and demanded a $20 million ransom, which saw the country’s newly-elected President Rodrigo Chaves declare his country “at war” with the ransomware group.

The gang rebranded from Ryuk to Conti in 2020, and later sided with Russia in its war against Ukraine, pledging to respond to any cyber attacks on the Russian government or the country’s critical infrastructure. But this backfired when a disgruntled Conti member leaked over 170,000 internal chat conversations between other Conti members and the source code for the ransomware itself.

This breach led to the eventual shutdown of the Conti ransomware brand in June this year, though it’s believed members of the gang have quietly moved into other ransomware operations including Hive, AvosLocker, BlackCat, and Hello Kitty.

“The only goal Conti had wanted to meet with this final attack was to use the platform as a tool of publicity, performing their own death and subsequent rebirth in the most plausible way it could have been conceived,” according to a May report by Advanced Intel.

The RFJ’s bounty program was initially launched to gather information on national security threats and terrorists targeting U.S. interests and has expanded to offer rewards for information on cyber criminals. It’s also offering bounties for information on the Russia-backed REvil and Evil Corp hacking groups.

State previously offered $10 million for information leading to the identification or location of those who held a “key leadership position” within Conti.

Fears grow for smaller nations after ransomware attack on Costa Rica escalates

Posted on

Luta Security and Emsisoft discuss how to fight ransomware at Disrupt

Ransomware is an exponentially growing global threat. Here are just a few examples from 2022: Costa Rica declared a national emergency after a $20 million ransomware attack; ransomware caused one of the biggest U.S. health data breaches; and ransomware topped CSO’s list of nine hot cybersecurity trends.

To hammer the point home, 14 of the 16 critical infrastructure sectors in the U.S. experienced ransomware attacks during 2021, according to a February 2022 report from the Cybersecurity & Infrastructure Security Agency.

The urgent threat ransomware presents is why we’re excited to announce that Katie Moussouris, the founder and CEO at Luta Security, and Brett Callow, a threat analyst at Emsisoft, will join us onstage at TechCrunch Disrupt on October 18–20 in San Francisco.

In a conversation called “Winning the war on ransomware,” Moussouris and Callow will talk about why ransomware is escalating at such an alarming rate, define what “winning the war” looks like, and share what startup founders need to know — and what steps they can take — to protect their customers and their business.

A self-described computer hacker with more than 20 years of professional cybersecurity experience, Moussouris has a distinct perspective on security research, vulnerability disclosure, bug bounties and incident response. She serves in three advisory roles for the U.S. government as a member of the Cyber Safety Review Board, the Information Security and Privacy Advisory Board, and the Information Systems Technical Advisory Committee.

Moussouris worked with the U.S. Department of Defense where she led the launch of Hack the Pentagon, the government’s first bug bounty program. During her tenure with Microsoft, she worked on initiatives such as Microsoft’s bug bounty programs and Microsoft Vulnerability Research.

Moussouris serves as an advisor to the Center for Democracy and Technology, and she is also a cybersecurity fellow at New America and the National Security Institute.

A Vancouver Island–based threat analyst for cybersecurity company Emsisoft, Brett Callow lives life with an ear to the ground, monitoring emerging cyberthreat trends and developments.

Emsisoft, a partner in Europol’s No More Ransom project, has worked on some of the most high-profile ransomware incidents of recent years to help companies and individuals avoid hundreds of millions of dollars in ransom demands.

TechCrunch Disrupt takes place on October 18–20 in San Francisco. Buy your pass now and save up to $1,100. Student, government and nonprofit passes are available for just $295. Prices increase September 16.

Is your company interested in sponsoring or exhibiting at TechCrunch Disrupt 2022? Contact our sponsorship sales team by filling out this form.