Tag Archive for Cyberwarfare

Marriott Data Breach One Of Biggest Ever

Updated July 17, 2019 – The Brits slapped Marriott with a £99m ($124m) fine for “infringements of the GDPR.” The Information Commissioner’s Office said that Marriott failed to undertake sufficient due diligence when it bought Starwood, and should also have done more to secure its systems prior to the data breach.

___

Marriott Data Breach One Of Biggest EverThe internet is a dangerous place for data. Hotel chain Marriott (MAR) proved that once again. Marriott revealed that hackers stole personal information from 500 million Starwood Preferred Guest program participants. The data stolen in the data breach included sensitive personally identifiable information (PII).

Marriott

Marriott said it got an alert on September 8, 2018, about an attempt to access the Starwood database and enlisted security experts to assess the situation. During the investigation, Marriott claims to have discovered that the unauthorized access to the Starwood network started in 2014.

Investigators found that an unauthorized party had copied and encrypted information from the database and had taken steps toward removing it. The company was able to decrypt the information on November 19, 2018, and found that the contents were from the Starwood guest reservation database. The hotel chain then waited until November 30, 2018, to tell its customers of the data theft.

What was lost on the data breach

personally identifiable informationFor about 327 million Marriott customers, the compromised information includes some combination of name, address, phone number, email address, passport number, Starwood Preferred Guest (‘SPG’) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences. Marriott added that the data breach included payment card information. About 170 million impacted Marriott customers only had their names and basic information like address or email address stolen.

Marriott says that about 20.3 million encrypted passport numbers and approximately 8.6 million encrypted payment cards were compromised in the breach.

Chinese hackers Several sources report that state-sponsored Chinese hackers working for the intelligence services and the military were behind the attack. The stolen data would be an espionage bonanza for government hackers. Sources point out that the Starwood attacks began in 2014, shortly after the attack on the U.S. government’s Office of Personnel Management (OPM) compromised sensitive data on tens of millions of employees, including application forms for security clearances.

Sadly, the 500 million records Marriott hack only ranks as the third-largest known data breach to date. This list of fails illustrates, no matter what you’re doing online every time you put your information on the internet, you risk it being stolen.

RankCompanyAccounts HackedDate of Hack
1Yahoo3 BillionAugust 2013
2River City Media1.3 BillionMay 2017
3Aadhaar1.1 BillionJanuary 2018
4Marriott500 Million2014 - 2018
5Yahoo500 MillionLate 2014
6Adult Friend Finder412 MiltonOctober 2016
7MySpace360 MillionMay 2016
8Exactis340 MillionJune 2018
9Twitter330 MillionMay 2018
10Experian200 MillionMarch 2012
11Deep Root Analytics198 MillionJune 2017
12Adobe152 MillionOctober 2013
13Under Armor150 MillionFebruary 2018
14Equifax145.5 MillionJuly 2017
15Ebay145 MillionMay 2014
16Heartland Payment Systems134 MillionMay 2008`
17Alteryx123 MillionDecember 2017
18Nametests120 MillionJune 2018
19LinkedIn117 MillionJune 2012
20Target110 MillionNovember 2013
21Quora100 millionNovember 2018
22VK100 MillionDecember 2018
23Firebase100 MillionJune 2018

rb-

There is something else fishy here. Reports claim that the data was encrypted using AES-128 but not all the stolen data. Attackers were able to steal nearly 20 million passport numbers, and 8.6 million encrypted payment cards.

Marriott says that the attackers were able to gain access to 5.25 million unencrypted passport numbers and 2,000 unencrypted payment card numbers.

I’m sure that regulators (GDPR) and lawyers will ask why unencrypted sensitive info like passports and credit card numbers lying around waiting to be stolen?

 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Russia Trolls Public Health

Everything you see on the Internet is trueHey here is a surprise – things on Facebook are fake. GovInfo Security is reporting that social media trolls sponsored by Russia have been actively stirring up the mindless vaccination debates. Researchers from George Washington University and Johns Hopkins University published their findings on (08/23/2018). They published a report, “Weaponized Health Communication: Twitter Bots and Russian Trolls Amplify the Vaccine Debate,” in the American Journal of Public Health. In the article, they based studied social media tweets collected from 2014 to 2017 on the vaccine debate.

Facebook profited from Russia-backed accounts trying to sway the 2016 U.S. presidential election

According to the research the Internet Research Agency, a company backed by the Russian government is at the center of the dis-information. The known Russian social media troll which specializes in online influence operations is linked to the spread of “polarized and anti-vaccine” misinformation via social media. The social media posts appear designed to undercut trust in vaccines. Such information could lead to lower vaccination rates and further contribute to a rise in mass outbreaks of measles, mumps, and rubella among children, among other viral infections.

How do anti-vaccine messages spread?

From 2014-2017, Twitter bots and Russian trolls disseminated anti-vaccine messages in trying to erode public consensus on vaccination in the U.S.

From 2014-2017, Twitter bots & Russian trolls disseminated anti-#vaccine messages in an attempt to erode public consensus on #vaccination in the US

The researchers’ review of anti-vaccine messaging on Twitter found the sources of disinformation are automated. There appears to be a steady stream of vaccine discussion being undertaken by social media bots. Social media bots are automated accounts. The researchers also identified and social media cyborgs’, that are hacked accounts taken over by bots. There are also social media trolls. Social media trolls are people who often disguise their identity and seek to sow discord.

The researchers also identified “content polluters.” Content polluters used anti-vaccine messages as bait to entice their followers to click on advertisements and links to malicious websites. The researchers contend that content polluters collate to high levels of anti-vaccine content. In the case of Russian trolls, however, their “messages were more political and divisive” and included both pro-vaccine and anti-vaccine content.

Trolls tied to Russia

Examples of Russian troll commentsTo identify accounts controlled by Russian trolls, the researchers used previously published information on Twitter accounts that intelligence agencies have tied to Russian government disinformation campaigns. As an example, CNN reports that one Russian troll account sent 253 tweets containing the #VaccinateUS hashtag among their sample. Among those tweets with the hashtag;

  • 43% were pro-vaccine,
  • 38% were anti-vaccine,
  • 19% were neutral.

By posting a variety of anti-, pro-, and neutral tweets and directly confronting vaccine skeptics, trolls, and bots “legitimize” the vaccine debate, the researchers wrote in the study. The researchers noted,

This is consistent with a strategy of promoting discord across a range of controversial topics, a known tactic employed by Russian troll accounts … One commonly used online disinformation strategy, amplification, seeks to create impressions of false equivalence or consensus through the use of bots and trolls.

amplification, seeks to create impressions of false equivalence or consensus through the use of bots and trollsThe prevalence of social media bots, trolls, and cyborgs – accounts in online discourse about vaccines threatens to skew discussions.  Researchers warn. “This is vital knowledge for risk communicators, especially considering that neither members of the public nor algorithmic approaches may be able to easily identify bots, trolls, or cyborgs.

The researchers found that the trolls, bots, and cyborgs goal is to create open-ended discussions designed to amplify online debates and disagreements. One tact cited in the article is rehashing discredited research published 20 years ago with fake claims of risks that have led to some parents opting to not vaccinate their children.

Threats from online misinformation

The threat from online misinformation is that even fewer parents will vaccinate their children against measles, mumps, and rubella. The researchers wrote that vaccine-hesitant parents are more likely to turn to the internet for information and less likely to trust healthcare providers and public health experts on the subject … Exposure to the vaccine debate may suggest that there is no scientific consensus, shaking confidence in vaccination. The researchers warn,

Recent resurgences of measles, mumps, and pertussis and increased mortality from vaccine-preventable diseases such as influenza and viral pneumonia underscore the importance of combating online misinformation about vaccines.

Russian troll use Facebook to amplify online disagreementsAmplifying debates over vaccines appear to be part of what ambassador John B. Emerson described as the Kremlin’s 4D campaigns – for dismiss, distort, distract and dismay. In a 2015 speech, Mr. Emerson warned that the Russian government was becoming more expert at running these types of propaganda campaigns.

Intelligence experts in the U.S. and Europe have warned that these Kremlin campaigns continue. In February, U.S. Director of National Intelligence Dan Coats warned the Senate Intelligence Committee that the intelligence community expected Russia to attempt to amplify existing divisions in U.S. society to spread chaos for strategic effect. Ambassador Coats warned,

At a minimum, we expect Russia to continue using propaganda, social media, false-flag personas, sympathetic spokespeople and other means of influence to try to exacerbate social and political fissures in the United States.

Anti-Bot research

Little research has gone into researching how to identify social media trolls or bots that influence online discussions. (rb- I covered some of the efforts underway to detect bots in 2016.) In 2015, DARPA ran a contest in which it asked researchers to classify whether a stream of tweets it had harvested about vaccines in 2014 were bots. Researchers were given a data set with more than 4 million messages harvested from 7,000 accounts, of which 39 were bots.

MIT Technology Review reported the winner, data science and social analytics firm SentiMetrix, correctly identified all the bots, with only one false positive. SentiMetrix was able to use an algorithm to  look for “linguistic cues” the poster was fake, like

  • Little research has gone into researching how to identify social media trolls or botTweets that used bad grammar,
  • Output was similar to other chatbots like Eliza,
  • Profile pictures that used stock images,
  • Numbers of tweets posted over time,
  • Unusual posting patterns,
  • Female username with a profile photo of a bearded man. (rb- Sound familiar? I wrote about some of these same steps in 2016)

The research led SentiMetrix to identify 25 bots, which enabled it to train a machine-learning algorithm to pinpoint 10 more. Despite such work, “the public health community largely overlooked the implications of these findings,” the Johns Hopkins and George Washington researchers say.

The impact of social media bots on the vaccine debates is not an abstract concern. The U.S. Centers for Disease Control and Prevention reports they are investigating 124 cases of measles across 22 states and DC, including Michigan. That’s already more than the 118 cases counted in the U.S. during all of 2017.

Spreading measles in Michigan

WOODTV in Grand Rapids reports that cases of measles in Michigan have hit a two-decade high. Angela Minicuci with the MDHHS told WOODTV the state has “tallied 10 cases of measles so far this year — the highest case count since 1998.

The CDC says low vaccination rates are to blame for recent measles outbreaks. They report the majority of those who contract measles, which is highly contagious, have not been vaccinated.

One reason so many are at risk of spreading measles is that 18 states allow parents to opt-out of vaccinating their schoolchildren for non-medical reasons. In June 2018 researchers found  multiple “hotspot” areas,” at high risk for vaccine-preventable pediatric infection epidemics.” Included in these hotspots are Detroit, Troy, and Warren, Michigan. The DetNews reports these areas had more than 400 kindergartners receive the non-medical vaccination exemptions.

Grand Traverse AcademyIn 2017 an outbreak of measles and whooping cough forced Grand Traverse Academy in Traverse City Michigan to close for a week. Grand Traverse County has one of Michigan’s highest rates of schoolchildren opting out of vaccines — twice the state average and six times the national rate for kindergartners in 2013-14.

The problem is not limited to the United States. In Europe, there’s been a “dramatic increase” in measles infections. WHO says there were 23,927 cases of measles in Europe during 2017 and 5,273 in 2016.

rb-

They want you to ignore the truthRenée DiResta, who researches disinformation online at Data For Democracy, pointed out the obvious,  “This isn’t just happening on Twitter. This is happening on Facebook, and this is happening on YouTube, where searching for vaccine information on social media returns a majority of anti-vaccine propaganda,”

She says. “The social platforms have a responsibility to start investigating how this content is spreading and the impact these narratives are having on targeted audiences.

The Russians want us focused on our own problems so that we don’t focus on them. 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Anthem Data Breach Hits BCBSM Users

Anthem Data Breach Hits BCBSM UsersThe recent cyber-attack on the second-largest health insurance company in the U.S., Anthem Insurance was allegedly pulled off by Chinese hackers. Now the attack, which I covered here has spread to Michigan. Emily Lawler at MLive is reporting that Michigan residents are caught up in the national healthcare insurance data breach.

The Anthem health insurance company compromised data includes an estimated 80 million people, of which 636,075 Blue Cross Blue Shield of Michigan users. According to the article, some of the compromised information could have come from BCBSM customers. A BCBSM spokesperson told MLive there was a “strong possibility” some BCBSM customer data had been caught up in the data breach.

BCBSM is an affiliate of the compromised company, so the Michigan firm shared critical customer information with Anthem. The affiliation allowed the attackers to gain access to Michigan BCBSM users. Ms. Lawler cites information from Anthem’s initial investigation, which found that compromised Michigan personally identifiable information (PII) that could have been compromised includes names, dates of birth, social security numbers, addresses, phone numbers, email addresses and employment information.

Data theftReassuringly (snark) BCBSM and Michigan’s Department of Insurance and Financial Services have been monitoring the data breach and its potential effect on Michiganders. BCBSM External Affairs Manager Stephanie Beres told MLive numbers from Anthem say 636,075 Michigan residents are impacted. That includes 410,990 Anthem members, and 225,745 customers of Blue Cross Blue Shield, Ms. Beres said.

rb-

Anthem is sending letters to those impacted their oopsie who will offer two years of free credit monitoring and identity theft repair. According to Anthem’s website AllClear ID will provide credit monitoring services. Those who think they may be affected are encouraged to visit a website Anthem has set up to distribute information about the hack, www.anthemfacts.com.

Related articles
  • Connecticut bill requires insurers to encrypt personal data (newsday.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Anthem Data Breach Allows Phish of US Cyber Forces

Anthem Data Breach Allows Phish of US Cyber Forces– Updated 10/25/2018 – Anthem, Inc. has agreed to pay a $16 million HIPAA fine to the U.S. Department of Health and Human Service, Office for Civil Rights. The OCR found that the data breach between December 2, 2014, and January 27, 2015, cyber-attackers stole the electronic protected health information of almost 79 million people. The stolen information in the data breach included names, social security numbers, medical identification numbers, addresses, dates of birth, email addresses, and employment information.

The $16 million settlement is the largest HIPAA settlement.

Anthem Breach Allows Phish of US Cyber ForcesMany online believe that the Anthem (ANTM) hack was a strategic cyber-war strike by China. Stu Sjouwerman at CyberheistNews writes that PII thefts would normally be a Russian operation. However, the Anthem data breach appears to be a Chinese attack. CNN reports that Chinese hackers tend to target trade, economic, and national security secrets that could help the Chinese economy. Mr. Sjouwerman says he received an insider tip that most of the three-letter U.S. Government agencies have their employees insured through Anthem’s Blue Cross Blue Shield. Anthem also provided health insurance defense contractors Northrop Grumman and Boeing.

Anthem Bluse Cross logoKnowbe4’s Sjouwerman speculates that the Chinese now own the identities of all the people fighting them. The stolen data can now be used in a multitude of social engineering scenarios. Dmitri Alperovitch, co-founder of security firm CrowdStrike told CNN that the attack fit the profile of a hacking group believed to be Chinese government spies called “Deep Panda.”

The objective of the “Deep Panda” data breach according to the CrowdStrike CTO is to amass a large collection of Americans’ personal information to find citizens willing to spy for the Chinese and find potential U.S. spies operating in China. Mr. Alperovitch told CNN that’s why Chinese hackers broke into U.S. federal employee network last year. They also broke at least three hospital chains and two insurance providers the public hasn’t yet heard about.

PhishingKnowbe4 speculates that many people in the Government have steam coming out of their ears about the Anthem hack. Cyberwar has suddenly become very personal to them. This may be why President Obama recently signed an executive order that will nudge private companies to share data about cybersecurity threats between each other and with the federal government.

Apart from the cost of the Anthem data breach are likely to smash $100 million barrier, it’s surprising that Anthem did not encrypt SSN’s which allowed wholesale identity theft of thousands of American cyber-warriors.

Deep Panda is amassimg a large collection of Americans' personal informationCEO Sjouwerman explains that hackers are going after healthcare records because they are much more valuable. He points out that healthcare records stay active for several months after a hack, as opposed to credit card numbers which quickly get nixed after a few days. Since Anthem is a healthcare company, you would expect them to take HIPAA compliance to the max and even top the required controls with higher standards. As we all know, compliance does not equal security, but it establishes a baseline at the very least.

rb-

There is enough blame to go around.

Time to go back to a cash society and barter.

Say, Doc Johnson, I’ll trade you two chickens for measles vaccination.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Investigating Internet Liability Insurance

Investigating Internet Liability InsuranceEnterprises now face the question of determining the right kinds of cyber insurance to buy in addition to the other traditional insurance that covers the risk of doing business. Internet Evolution asks, “What would you pay to be insured against data loss or theft“? While cyber insurance of all kinds has been around for a while, more firms than ever are seriously considering it, as data breaches, Web fraud, and security breaches continue to make headlines.

chubb_logoTracey Vispoli, global financial fidelity manager for Chubb, told Internet Evolution, “Although I would still characterize business interest in cyber insurance as emerging, we saw a 40 percent growth in firms securing some form of Internet liability insurance in 2009.” Chubb provides Internet liability and other insurance coverage for businesses worldwide. “I’ve been talking with several insurance companies now about entering the cyber-insurance area,” says Paul Sop, CTO for computer security and consulting firm Prolexic Technologies Inc.

For insurers like Chubb, the Internet provides an opportunity to develop new products to meet emerging business needs. For potential business clients, Internet insurance plugs gaps in coverage that current business insurance policies don’t address. The article says the gaps include:

  • Website-related losses,
  • Website copyright infringements,
  • Cyber-attacks and
  • Unauthorized online access to customer information.

We encourage companies to think not only about their Web-based assets but also about their entire technology base when they consider insurance,” Ms. Vispoli told Internet Evolution. This includes not only cyber-attacks that directly target the Website from the Internet but also breaches of confidential corporate data such as customer and employee records. Ms. Vispoli explained that at least 45 states require a company whose data is compromised to send out official notifications to all those affected.

Someone from the outside can hack into your employee or customer information, and then there’s the financial pressure of not only fixing the breach and taking action, but also of notifying potentially hundreds of thousands of individuals whose information has been compromised.

The article says that the cost of notification alone can be worth insuring, but there are other costs as well. As recently as five years ago, companies were not required to send out notices nor did they spend the amount of money that it takes today to bring in a forensics team to analyze a cyber breach and find the hack.

The cost of Internet liability and other e-commerce-related insurance varies, depending on the risk factors a given organization presents. Internet Evolution says one of the variables is the amount of online sales it books each year. Common types of cyber-insurance that are available today include:

  • Technology professional liability,
  • Media errors and omissions,
  • Telecommunications professional liability and
  • Computer information and data security liability.

We are seeing an aggressive trend in businesses subscribing to cyber-insurance, especially in industry sectors like healthcare, financial services, retail, services companies like hotel chains and media,” Ms. Vispoli said in the article. “Depending on the size of the organization, we might be contacted for coverage information by a Chief Security Officer, or possibly by a CFO or CIO.” All of them see growing exposures from e-theft, e-fraud, compromise of critical data, loss of goodwill, e-threats, and vandalism, denial of service, copyright infringement, and regulatory compliance issues.

What do you think?

Does your organization have cyber insurance?

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.