.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The Target: General Motors, a U.S based automobile company.
The Take: Exposure of Personally Identifiable Information including: first and last names, email address, physical address, username, phone numbers, profile picture, and usable reward point balance.
The Vector: Through a credential stuffing attack, the threat actors leveraged customer’s unsecure passwords already exposed through other means and were able to access user’s GM customer accounts. While banking information was not exposed, customer reward-card balances were freely able to be accessed and were used by the attackers to fraudulently redeem rewards.
This breach is a stark reminder that credential hygiene is an important piece in an overall robust cybersecurity posture. Enforcing multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s customer base.
The Business Times: THE Monetary Authority of Singapore (MAS) has imposed an additional capital requirement of about S$330 million on OCBC Bank for its deficiencies in responding to a wave of spoofed SMS phishing scams in December 2021.
Mondaq: On February 9, 2022, the SEC released proposed rules relating to cybersecurity risk management, incident reporting, and disclosure for registered investment advisers ("RIAs") and funds that would impose sweeping new cybersecurity obligations for RIAs to private equity funds.
U.S. News: U.S. cybersecurity software firm Semperis said it has raised over $200 million in a funding round led by private equity firm KKR & Co Inc at a valuation substantially higher than in its previous round.
Cision: Agio, a leading cybersecurity and managed IT provider for financial services firms, published its inaugural 2022 Hedge Fund Cybersecurity Trends Report today. The survey was conducted in Q1 and captured the opinions and perceptions of recent, current, and future cybersecurity programs, readiness, and initiatives from 100 hedge fund practitioners across the technology, operations, cybersecurity, and compliance fields.
Yahoo News: Cloudflare CEO Matthew Prince is standing by the secure networking company's decision to keep operating in Russia even as most Western companies have pulled out of the country for its war on Ukraine.
Bleeping Computer: A report published today by U.S. Senator Gary Peters, Chairman of the Senate Homeland Security and Governmental Affairs Committee, says law enforcement and regulatory agencies lack insight into ransomware attacks to fight against them effectively.
ZDNet: It was one of the largest cyber-espionage attacks of recent times: hackers compromised several United States government federal agencies as well as big tech companies, and were inside networks for months before anyone spotted them.
The Target: Texas Department of Insurance.
The Take: 2 million records of Personally Identifiable Information affecting 1.8 million individuals were exposed, including: social security numbers, addresses, dates of birth, phone numbers, and worker injury information.
The Vector: A configuration error with an online web portal which manages worker’s compensation information was not properly secured, allowing members of the public to freely access pages of the site containing sensitive information.
This breach is a stark reminder of the importance of access control around public-facing web applications and the configuration of settings that control them. Sensitive information must be protected and ensuring proper authentication and credential management is being used is a key core of maintaining a robust cybersecurity posture.
Insurance Journal: The Department of Justice is changing its policy around a controversial anti-hacking law, addressing longstanding complaints from cybersecurity researchers that the law could criminalize good-faith efforts to improve technology.
Bleeping Computer: Security researchers are warning that external remote access services continue to be the main vector for ransomware gangs to breach company networks but there's a notable uptick in exploiting vulnerabilities.
Financial Post: India will not change upcoming cybersecurity rules that force social media, technology companies and cloud service providers to report data breaches swiftly, despite growing industry concerns, the government said.
SC Media: The firm, which launched last year, is headed by Ted Schlein, formerly of Kleiner-Perkins, who is also on the board of trustees of the non-profit national security venture capital group In-Q-Tel and the board of the CISA Cybersecurity Advisory Committee.
Bleeping Computer: The advisory, jointly released by agencies from the United States, Canada, New Zealand, the Netherlands, and the United Kingdom, includes guidance to mitigate these routinely exploited weak security controls, poor security configurations, and bad practices.
Money Management: Appearing at FINSIA's ‘The Regulators’ event, ASIC commissioner, Cathie Armour, said the case of RI Advice has brought cybersecurity into the public eye as it was the first of its kind in Australia.
ZDNet: KELA's security team published a report examining the cybersecurity issues and attacks that surfaced in 2021 and early 2022, specifically focused on the United Kingdom's banks and other financial services.
The Target: MM.Finance, the largest decentralized finance platform on the Cronos blockchain.
The Take: $2 Million
The Vector: A DNS (domain name service, a server that directs users to the appropriate website upon entering the name of a site) vulnerability allowed attackers to inject a malicious website address into the code on the front-facing website as a redirected destination. When users visited the site to make transactions, they were instead sent to a bad website address where the threat actor was able to steal the funds being transacted.
This breach is an important reminder of the critical nature of user-facing website security. Any method which allows public access must be secured to the highest standard and regularly audited for potential breaches. Furthermore, monitoring and updating, if necessary, configurations of key infrastructure like DNS servers is part of maintaining a robust cybersecurity posture.
Irish Examiner: The European Union’s “fragmented” approach to cybersecurity and the “patchy” capabilities of member states is creating several problems in terms of combating State-level attacks and criminal hacks, according to an international expert.
Bleeping Computer: The U.S. Department of Justice (DoJ) has charged Idris Dayo Mustapha for a range of cybercrime activities that took place between 2011 and 2018, resulting in financial losses estimated to over $5,000,000.
Dark Reading: The National Security Administration (NSA), along with a coalition of international cybersecurity authorities, today issued an advisory warning managed service providers (MSPs) of an escalating threat of attack from both everyday cybercriminals and state-sponsored threat actors.
Help Net Security: The significantly oversubscribed fund is the largest seed stage cybersecurity-focused fund ever raised, bridging Israeli innovation and the US market. The fund will continue the firm’s long-standing strategy of supporting Israeli founders from inception through every critical stage of building a category-leading company and bolstering its position in the global market.
ZDNet: A record number of scams have been removed from the internet as part of a scheme to help protect people from fraud and cybercrime. The National Cyber Security Centre (NCSC) says it removed a total of 2.7 million scams, illicit domains and phishing services during 2021, nearly four times more than during 2020.
Yahoo Finance: ThoughtLab, a leading global research firm, today announced the findings of its 2022 cybersecurity benchmarking study, Cybersecurity Solutions for a Riskier World.
Bleeping Computer: The United Kingdom's National Cyber Security Centre (NCSC) has announced a new email security check service to help organizations identify vulnerabilities that could allow attackers to spoof emails or lead to email privacy breaches.
The Target: Heroku, a cloud platform as a service with support for several programming languages.
The Take: Exposure of customer passwords, file storage, and internal source code.
The Vector: The threat actor used previously exposed GitHub authorization tokens, general use tokens issued to third-party integration software firms by GitHub to allow them to integrate with their platform, and exploited these to connect to Heroku’s internal systems, allowing the attackers to exfiltrate and download the data from their database of customer accounts.
This breach is an important reminder of the danger of pivot attacks. While initially the authorization tokens which were stolen provided access only to customer accounts of Heroku who made use of the tokens, the attackers were able to pivot through these exposed accounts and access Heroku’s internal systems. No matter which level the breach takes place, it’s critical to evaluate all possible avenues of attack and take appropriate precautions.
Money Management: The Federal Court has found Australian Financial Services licensee, RI Advice, breached its license obligations to act efficiently and fairly when it failed to have adequate risk management systems to manage its cybersecurity risks.
ESG Clarity: Cybercrime has become an increasingly harmful threat to businesses over the past few decades, and the frequency and scale of attacks rose significantly during the pandemic. But many people think only of the technological disruption, or economic cost a cyberattack could cause their investments, failing to appreciate wider ESG implications.
Bleeping Computer: The Federal Bureau of Investigation (FBI) said today that the amount of money lost to business email compromise (BEC) scams continues to grow each year, with a 65% increase in the identified global exposed losses between July 2019 and December 2021.
CNBC: The Securities and Exchange Commission announced that it will almost double its staff responsible for protecting investors in cryptocurrency markets.
ZDNet: According to Cybereason, the Chinese advanced persistent threat (APT) group Winnti is behind the campaign, which has gone undetected for years.
CNN: A year-long Pentagon pilot program found an array of software vulnerabilities at dozens of defense contractors as Russian and Chinese hackers continue to try to steal sensitive data from the US defense industrial base.
CSO: Cybersecurity pros interested in metrics and measures frequently ponder and pontificate on what measures would be best to show the board of directors.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
84 Chain Lake Drive, Suite 501
Halifax, NS
Canada, B3S 1A2
+1-902-429-8880
Manila
Ground Floor, Three E-com Center
Mall of Asia Complex
Pasay City, Metro Manila
Philippines 1300
Sydney
Level 36 Governor Phillip Tower
1 Farrer Place Sydney 2000
Australia
+61 (2) 8823 3370
Abu Dhabi
Floor No.15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy