Nigel Stork

Alleged Amazon Data Breach Days Before Black Friday

Reports about an Amazon data breach are spreading fast and furiously, although the online retailer denies that what happened was actually a breach. At least one expert is siding with Amazon on this, but to the average consumer, it may seem like splitting hairs.

Black Friday is only days away, so many shoppers are making decisions about where to spend their hard-earned cash. This could be one reason the company is being so secretive about this alleged data breach.

Amazon data breach reports stem from emails

Amazon emailed a number of shoppers on Tuesday to report that its website had “inadvertently disclosed” their name and email address “due to a technical error.” The online retailer also said it has fixed the issue, so users don’t have to do anything else.

Social media users were quick to start posting about the email and expressing concern about this potential Amazon data breach. Some even questioned whether the email they had received was genuine, pointing out details about the email which made it look like a phishing message. However, the online retailer has confirmed to multiple media outlets and news blogs that the email was real. However, beyond those generic statements, Amazon is remaining tight-lipped.

News outlets and tech blogs have been trying to get more details from the company about the data leak, but spokespeople are refusing to say anything more about it. They won’t say how many customers were infected, what caused
the leak, or how long it took them to realize there was a problem.

Amazon data breach may not have been a breach at all

Amazon’s U.K. office denies that there was a breach, in the technical sense of the word, and the founder of a web security company agrees, although he admits that more details are needed. High-Tech Bridge CEO and founder Ilia Kolochenko advised against drawing “premature conclusions” about the alleged Amazon data breach until more technical information is available, but he also urged the company to stop being so tight-lipped about the issue.

“Based on the information currently available, it is technically incorrect to call this incident a ‘data breach,’ he said in a statement. “This rather looks like an inadvertent programming error that made some details of Amazon’s profiles publicly available to random people… Amazon’s reaction seems to be quite prompt, however an official statement would certainly be helpful to prevent any speculation and unnecessary exaggeration of the incident and its scope.”

For those who like splitting hairs, the incident may be considered more of a data leak than a data breach, in that Amazon appears to have accidentally exposed users names and email addresses. A breach, on the other hand, involves someone hacking into a database or network and gaining unauthorized access.

Nonetheless, consumers will likely see this incident as an Amazon data breach because at the end of the day, the average shopper cares only that their information was exposed. It matters little whether their data was exposed thanks to a hacker or an accidental leak.

Shoppers prepare for Black Friday

The reported Amazon data breach comes just two days before Black Friday, one of the busiest shopping days of the year. This could be one reason the company is trying to keep a tight lid on information about the incident. Because of the data leak, shoppers may hesitate to spend money on Amazon on Black Friday or even later in the holiday shopping season.

Ref: Author: Michelle JonesMichelle Jones was a television news producer for eight years. She produced the morning news programs for the NBC affiliates in Evansville, Indiana and Huntsville, Alabama and spent a short time at the CBS affiliate in Huntsville. She has experience as a writer and public relations expert for a wide variety of businesses. Michelle has been with ValueWalk since 2012 and is now our editor-in-chief. Email her at Mjones@valuewalk.com.

Cybercrime is everywhere, and is out of control and we hear about it every single day.

Cybercrime is to reach 6 trillion dollars in 2021 as against 3 trillion in 2016.

How would you know if your security is already compromised?

In most of the recent cases, no one even knew that their data were stolen until months passed. That means todays cyber criminals are very much organised, coordinated and work according to a certain standard. 

What if the door to your key is already cut and kept by a thief and you are not aware of it?

What if your employees are already accessing information which they are not supposed to access in your database?

Today, security has become digital, and the criminals are white collar workers who have bachelor degrees in ICT who go to work from 9 to 5 like most of us do.

Yes, todays career criminals don’t look scary, and they don’t carry weapons, they don’t;

The only weapon in their pocket is the vulnerability in your locket. 

According to the United Nations, 80% of the cybercrime are a result of ultra organised, highly sophisticated crime group’s activities.

Cyber criminals made an estimated illegal profits up to 445 billion dollars last year which is larger than the GDP of 160 nations, and most of these incidents were a result of internal breaches which were done by employees of companies.

Sri Lankan companies are at higher risk as either most of the ICT security specialists are either not competent or unaware of the security threats which are prevalent in the Sri Lankan ICT infrastructure.

For instance many Sri Lankan financial institutions don’t have basic two factor authentication, and that means, the financial data of the customers could be easily breached without any serious hacking attempts.

 

Another security hole is that the websites of many financial institutions which give access to customers online for transactions can be easily hacked through browser level trojans and malware which are designed to steal online information.

These issues have been rather neglected or not highlighted as these will scare away customers from using online facilities.

Most financial institutions do not share information on breaches as this could lead to legal issues or may give competitive advantage to their counterparts.

For instance there is no public record or archive of breaches for other financial institutions to learn from breaches due to fear of being legal action taken against them from customers.

Just like the telecommunication industry steal money from unsuspecting customers due to various VAS features which customers don’t enable, financial institutions are also sometimes unable to disclose important security failures occurring from their end which may illicit very smaller amounts of money from customers accounts without anyones awareness.

In such instances what ever the industry dealing with peoples intimate financial details must strengthen their belts on security to be ahead of organised cyber criminals by implementing advanced security protocols which are rather difficult to breach.

We live in an era in which what ever the the security measure we take to protect is important.

After all, its just not about business anymore, its our life and the lives of our loved ones we protect.

Exire Technologies Sri Lanka Signs Technology Distributions Partnership with High-Tech Bridge, Geneva

Exire Technologies Sri Lanka Signs
Technology Distributions Partnership
with High – Tech Bridge, Geneva

Exire Technologies Sri Lanka CEO Nishan Wimalachandra and High-Tech Bridge, Switzerland CEO Ilia Kolochenko in
Geneva

12 October 2018 marked the 8th Geneva ‘Information Security Day’ which was conducted at the Mandarin Oriental Hotel, Geneva. Experts from around the world flew to Geneva to address the cybersecurity need of the hour and preparedness against future cyber threats. 

The Conference emphasised the importance of adopting Statistical and Artificial Intelligence as well as the importance of Machine Learning and Cyber Incidence Responses required to battle the future Artificial Intelligence based cyber threats. High-Tech Bridge of Geneva is an award winning organisation for Application Security, Web Application security, Mobile Application security and Application Discovery, utilising Machine Learning and Artificial Intelligence technologies.

Exire Technologies which is an innovative technology distribution firm in Sri Lanka and High-Tech Bridge in Geneva, Switzerland commenced operations in South Asia with the signing of the distribution partnership. The CEOs of both companies are committed to addressing the applications security needs of the South Asian Region.

The signing of this document once again proves the high level of trust between the two countries. It reflects the spirit of genuine strategic partnership that is typical of Swiss-South Asian region relations. The agreement shows the striving of both parties to the agreement to expand bilateral cooperation on one of the most important aspects of maintaining international and national security.

The products of High-Tech Bridge addresses security flaws of web and mobile based applications which are static as well as dynamic, and also provides reports on vulnerability of applications security and how attractive these are to hackers based on hackability and attractiveness score.

All solutions of High-Tech Bridge, Switzerland could be accessed through Exire Technologies Ltd. 

British Airways Apologizes after 380,000 Customers hit in Cyber Attack

  • BA says contacted customers as soon as possible

  • Details of 380,000 card payments compromised

  • BA says attack was ‘very sophisticated’.

     

London (Reuters): British Airways was forced to apologise on Friday after the credit card details of hundreds of thousands of its customers were stolen over a two-week period in the worst ever attack on its website and app.

The airline discovered on Wednesday that bookings made between 21 August and 5 September had been infiltrated in a “very sophisticated, malicious criminal” attack, BA Chairman and Chief Executive Alex Cruz said. It immediately contacted customers when the extent of the breach became clear.

Around 380,000 card payments were compromised, the airline said, with hackers obtaining names, street and email addresses, credit card numbers, expiry dates and security codes – sufficient information to steal from accounts.

The attack came 15 months after the carrier suffered a massive computer system failure at London’s Heathrow airport, which stranded 75,000 customers over a holiday weekend.

Cruz said the carrier was “deeply sorry” for the disruption caused by the sophisticated crime, which was unprecedented in the more than 20 years that BA had operated online.

He said the attackers had not broken the airline’s encryption but did not explain exactly how they had obtained the customer information.

“There were other methods, very sophisticated efforts, by criminals in obtaining the data,” he told BBC radio. “It was having access to our systems in an illicit way, it was very sophisticated.”

 

British Airways informed customers affected by the attack on Thursday, Cruz said. It advised them to contact their bank or credit card provider and follow their recommended advice. It also took out ads in national newspapers on Friday.

Cruz said anyone who lost out financially would be compensated by the airline.

“The moment we found out that actual customer data had been compromised that’s when we began an all-out immediate communication to our customers, that was the priority,” he said.

Data security expert Trevor Reschke said that like any website which sees large volumes of card transactions, British Airways was a ripe target for hackers.

“It is now a race between British Airways and the criminal underground,” said Reschke, head of threat intelligence at Trusted Knight. “One will be figuring out which cards have been compromised and alerting victims, whilst the other will be trying to abuse them while they are still fresh.”

IAG said the data breach had been resolved and the website was working normally, and that no travel or passport details were stolen.

The airline had launched an investigation and notified police and other relevant authorities.

Play Video

Germany Concerned about possible ‘SLEEPER’ Cyber Sabotage

President of Germany's Federal Office for the Protection of the Constitution Hans-Georg Maassen attends a news conference in
Berlin, Germany – REUTERS

Berlin (Reuters): A growing number of countries can hack into private computer networks and install malicious software to sabotage another country’s infrastructure, Germany’s domestic spy chief said last week.

China, Russia and other countries continued to try to break into German companies’ computers to steal industrial information, Hans-Georg Maassen, head of the BfV domestic intelligence agency, told a security conference.

But intelligence officials are increasingly worried about so-called “cyber bombs” that could be planted in the network of an unsuspecting company and detonated later.

“In the case of China, Russia, we clearly see measures like espionage, but it could also be sabotage with the goal of attacking companies in Germany – infrastructure firms in the widest sense – at some future point,” Maassen said. “That is a scenario that we view with concern.”

Cyber experts warn that Germany – with its high level of technology expertise – is a particularly attractive target for cyber attackers of all kinds, including state actors.

A company could be oblivious to a cyber-attack that had been used to plant malware, Maassen said. Such a “cyber bomb” could then shut down power networks, for example, perhaps during a time of geopolitical tension.

He said such attacks could come from a range of countries. In its annual report, the agency cited rapid strides in Iran’s cyber capabilities, although it did not specifically spell out concerns about such sleeper attacks.

 

Germany is worried that China is also trying to gain dominant positions in technology sectors by taking stakes in the German firms, Maassen said.

“That is a political project on which the government is spending a lot of money, not just to invest, but to buy information for its own technical progress, or to gain a position in specific areas that will make it impossible for others to continue developments there,” he said.

Torsten Becker, managing director of BOGEN Electronic, a German robotics supplier that also sells to China, said his firm had rebuffed repeated takeover attempts by Chinese firms, and had also seen its products duplicated in the Chinese market.

BOGEN had stopped hiring Chinese engineers or interns, and was taking increased measures to protect its know-how, but Becker said Chinese rivals benefited from government support that gave them advantages in the global market.

Burkhard Even, who heads the BfV’s counterespionage unit, told the conference the amount of know-how ceded to Chinese through takeovers in the past two years already exceeded the damage from espionage.

He said there was “a very clear connection” between cyber-attacks and takeover bids, with many companies often targeted in cyber-attacks before any M&A activity.

Germany and other European Union states are overhauling their investment rules to protect sensitive technologies from Chinese takeovers. In December, the BfV also warned about efforts by China to use fake LinkedIn accounts to recruit German business executives and researchers as spies.

Source: DailyFT

 

TACKLING THE INTERNET

With the advent of the digital age, it is imperative, now more than ever, for individuals of all ages to become digital-savvy in order to leverage the opportunities of tomorrow. Be it in school, your job or even to run a home business, tech capability is a vital node in one’s skillset. This learning curve now begins at tender ages, where children are taught digital skills in classrooms, making a computer or network-enabled device a part of their day-to-day life.

The Internet is a precarious playground. Today, with accessing online content is easier than ever before, parents have to be very careful when it comes to kids’ online activity due to increasing child predators, pornography, cyberbullying, online drug peddling, social media misuse and incidents of online grooming. According to a survey done by many international agencies, the teenage suicide rate is increasing due to cyberbullying; and many crimes related to child exploitation take place through the Internet. However, with ICT being taught in schools as a vital subject, not having access to the Internet at home is out of the question. So What is the solution?

Marketed and distributed by Exire Technologies, Fingbox is the most awaited solution for parents of growing children. Today, Internet access for children is a must as schools demand online research for assignments and projects. However, by giving full access to the Internet, parents will expose children to unknown dangers and unlimited cyber roaming. Fingbox allows parents to control their home Internet from anywhere in the world via their mobile: they can limit Internet access, block smart-phone, tabs, games consoles and unwanted websites, check who is using the Internet most, and see what other devices are trying to access the network through digital fencing.?

 

Fingbox can also give reports to parents on what websites their children are accessing and how often and how long they are on the Internet. Fingbox not only protects your home from online dangers but can also guard small businesses against intruders and unauthorized devices trying to access classified information or use your networks. The productivity of many small businesses is drastically diminishing due to unnecessary social media use and cyber threats. This technology can prevent such problems from occurring.

A noteworthy point of Fingbox operation is that everything can be controlled and monitored from a mobile phone. Fingbox is a plug-and-play system that can be installed by anyone. It’s just a matter of plugging the unit to your everyday router and using the features from the mobile application.

The effect of crime has multiplied with the access of internet, with children being mostly in danger. We must protect what matters most to us. Fingbox solution can help us save our children. As a company, Exire Technologies is committed to addressing the growing social need for protecting children online, which is often unnoticed by the telecommunication industry.

 

MORE INFO VISIT FING.LK

Indian Co-Operative Bank Loses $13.5m in Cyber Attack

MUMBAI (Reuters): Cybercriminals hacked the systems of India’s Cosmos Bank and siphoned off nearly 944 million rupees ($13.5 million) through simultaneous withdrawals across 28 countries over the weekend, the bank has told police.

SWIFT, whose messaging system is used to transfer trillions of dollars a day, said it did not comment on individual cases.

Cosmos Bank, based in the western city of Pune, said in a press statement that its main banking software receives debit card payment requests via a “switching system” but it was bypassed in the attack.

The co-operative bank said unidentified hackers stole customer information through a malware attack on its automated teller machine (ATM) server, withdrawing 805 million rupees in 14,849 transactions in just over two hours on Aug. 11, mainly overseas.

Apart from the ATM withdrawals, the hackers transferred 139 million rupees to a Hong Kong-based company’s account by issuing three unauthorized transactions over the SWIFT global payments network, the bank said in a police complaint, a copy of which was seen by Reuters.

 

“During the malware attack, a proxy switch was created and all the fraudulent payment approvals were passed by the proxy switching system,” the bank said.

The bank declined to reveal the countries, citing security risks.

Police said they were investigating the theft.

A police official, who declined to be named, said they had enlisted the help of experts to find out how authorized transactions were conducted simultaneously in various countries.

India’s City Union Bank Ltd reported in February that it had suffered three “fraudulent remittances” of nearly $2 million that had been pushed through the SWIFT financial platform.

In 2016, unknown hackers stole more than $81 million from the Bangladesh central bank’s account with the Federal Reserve Bank of New York. Investigators have made little progress in the case.

“While there is growing awareness to regularly update an organization’s cyber preparedness and defense mechanisms, a large number of institutions wake up to this reality only post an incident which often leads to a loss of reputation and/or financial misappropriation,” said Nikhil Bedi, a partner with Deloitte India.

Daily FT

 

25th May 2018. Marks the Day GDPR comes into Effect

25TH MAY 2018

TODAY MARKS THE GDPR COMES INTO EFFECT

DAMAGES TO YOUR ORGANIZATION FOR NON-COMPLIANCE IS IRREVERSIBLE

GDPR is a new EU legislation introducted affecting
190+ countries including sri lanka

If your organization is providing any type of service to EU citizens  residents and dealing with their personal data including contact information, if non complaint with GDPR you are liable to be fined.

An organization must brace itself in Technological and process angles utilizing advanced Data Leak Prevention technologies to safeguard EU citizens personal data. A company must be able to safely store, retrieve, and delete any data held in their possession with the full consent of the data owner.

Our solutions addresses the Articles 25, 30, 32, 33, 34 & 37 of the GDPR requirements dealing with Data Protection by Design and by Default, Records Processing, Security of Processing, Notification of Personal Data Breach (to Supervisory Authority and Personal Data Subject), Designation of the Data Protection Officer and thereby strengthens any organization from breach and ensures compliance.

 

GDPR IS HERE ARE YOU READY?

General Data Protection Regulation is here are you ready?

If your organization is dealing with any EU citizens’ personal data, if non complaint with GDPR you could be liable. Failure to comply with the new rules could result in fines of €20m (or 4% of total annual global turnover) which ever is higher.

If you are now aware of GDPR, and your organization or your partners deal with the data of EU citizens or residents, your organization is in danger.

Talk to us. We are able to help your organization to comply
+94 723 100 200  |  info@exiretechnologies.com

WannaCry AGAIN? Cyber Crime Is Everywhere and Is Out of Control

The UN estimates that Cybercrime will cost $2 trillion by 2019. WannaCry Ransomeware
recently affected 200,000 computers and affected 150 countries.

Cybercriminals made estimated illegal profits of up to $445 billion last year, which is larger than the GDP of 160 nations,
including countries like Ireland, Finland and Denmark, and most of these incidents were a result of internal breaches.

Ransomware is a malicious software designed to block access to a computer until a sum of money is paid by the victim. Although Ransomware has thus far been targeted at individuals, at present, it is being targeted at many large businesses worldwide.

Due to the recent catastrophic digital security threat the world faced, Echelon met Nishan Wimalachandra CEO of Exire Technologies along with their Security Specialist Livan Jayasekara to discuss how Exire Technologies could help prevent similar future incidents; according to them, many Sri Lankan Companies could have prevented this attack if the right technology, which was already in Exire Technologies’ possession, was deployed.

What is at stake due to Ransomware?

Nishan Wimalachandra: We believe the most terrifying experience is that the hacker could destroy all the data in that computer including emails, images, documents, login credentials, banking data, passwords, electronic certifications, credit card details, and even intimate details if the victim does not pay the hacker. What id the most important memories your computer held of your family and friends were gone in a few hours if the ransom is not paid (this includes your cloud-based backups as well)?

What is the worst-case scenario?

Even if the ransom was paid to get your life back and access to your computer data. there is no guarantee that your privacy will remain private. After a Ransomware attack, your privacy is no longer private.

How are businesses affected by Ransomware?

A Ransomware attack may steal everything a business has built in a lifetime. Once attacked, everything the company had been working on will be gone forever, including R&D, Blueprints, customer details, intimate financial details, the patent-worthy technology that is not yet registered, recipes, pricing, marketing strategies, vendor details, contracts, legal documents and confidential dealings with other corporate or government agencies.Once a business is affected, there is no point going ahead with existing strategies and tactical business plans as the hacker may sell the stolen data to the highest bidder regardless whether or not you pay the ransom. Ransomware can take away a company’s competitive advantage and bring it to ruins within a few hours.

Q: Can Exire Technologies help protect businesses from Ransomware?

Yes, NetSHIELD of SnoopWall Inc. introduced by us secures mission-critical and highly valuable confidential information behind firewalls with an award-winning patented NetSHIELD appliance, and WinSHIELD on Windows and MobileSHIELD on Google Android and Apple iOS mobile devices. This next generation technology detects and blocks all remote control, eavesdropping and spying. NetSHIELD provides critical IntraNet security that firewalls and antivirus systems are not designed to address.

Q: How do you know if a system has critical vulnerabilities that are easily exploitable?

Livan Jayasekera: NetSHIELD possesses security features that could detect critical vulnerabilities of systems, and its scalable solution allows you to harden your network and cover your assets with ironclad network access control and vulnerability management.  

Q: Are Sri Lankan businesses vulnerable to Ransomware, and what is the way out?

Yes, Ransomware is a global threat, therefore any computing device that connects to the internet should be frequently hardened.

NetSHIELD runs a comprehensive internal network evaluation that can help businesses understand the following:

Baseline Security – ensures to inform you who and what is really on your network, this also helps to build a trust list to identify unknown and unwanted assets.

Threat Prevention – identifies zero-hour malware not detected with Anti Virus and strengthens security infrastructure by capturing real-time phishing attacks with no false positives.

Vulnerability Assessment and Compliance Reporting – enables the discovery of vulnerabilities, prioritizes them on your network and runs compliance assessments for PCI – ISO etc.

Q: What is the solution given by NetSHIELD to battle Cybercrime?

The human attack surface is to reach 4 billion people by 2020. As the world goes digital, humans have moved ahead of machines as the top target for cybercriminals. Hackers smell blood now, not silicon. Up to 200 billion IoT devices will need security by 2020. Regardless of which estimate proves right, the bottom line is that the digital attack surface will grow massively over the next five years. With the expansion of IoT, from home appliances to security monitoring systems, new security challenges are becoming pervasive. Without proactive testing, networks are more vulnerable than ever before. Hackers have new entry points via which they cannot only gain unauthorized access into our homes or business network but also intrude our privacy.

Corporates can take charge of their corporate network(s) with a highly scalable, affordable and simple-to-manage network access control (NAC) solution, NetSHIELD, introduced by Exire Technologies. They can gain control and confident oversight of trusted LAN(s), manage compliance reporting, audit assets, identify vulnerabilities, and defend against malicious insiders, rogue access, zero-day malware, phishing attacks and data exfiltration. In a world of digital catastrophes, there are only winners and losers.

Strengthening your IT infrastructure is critical to be ahead of the game. Talk to Exire Technologies; they are able to help you secure your business.

Source: ECHELON Magazine June 2017

Exire Technologies is a member of the European Chamber of Commerce Sri Lanka
Facebook Twitter Google-plus Instagram
© Exire Technologies