Voici le rapport de veille de la semaine faisant le tour des actualités les plus intéressantes. Vous retrouverez un développement de certaines d’entre elles dans les prochains articles. Bonne lecture et belle semaine à vous !
Vol / perte de données
Marriott Warns Of A Security Breach Exposing Social Security Numbers
Marriott has once again suffered a cyber attack. This time, Marriott warns some of its associates about a security breach affecting their Social Security Numbers. What makes this incident tricky is that Marriott is facing trouble contacting some of the victims. Marriott International Inc. has recently warned of a security breach affecting some associates.
Trend Micro reveals rogue employee sold data of up to 120,000 customers | ZDNet
Update 15.51 GMT: A Trend Micro spokesperson told ZDNet that it appears approximately 70,000 customers have been impacted as a more concise estimate than « fewer than one percent » of Trend Micro’s 12 million customer base. Trend Micro has revealed a « security incident » leading to the theft of personal data from customers caused by a former employee.
Trend Micro Discloses Insider Threat
We recently became aware of a security incident that resulted in the unauthorized disclosure of some personal data of an isolated number of customers of our consumer product. We immediately started investigating the situation and found that this was the result of a malicious insider threat.
Un mystérieux hacker publie des profils d’utilisateurs du forum néonazi IronMarch
Technologie : Une aubaine pour les autorités de tous les pays, qui disposent désormais de plus d’éléments pour partir en chasse. La toile a également ses justiciers. Un mystérieux pirate informatique a publié ce jeudi une base de données de l’un des lieux de rencontre néo-nazis les plus célèbres d’Internet, le forum IronMarch.
Twitter & Trend Micro Fall Victim to Malicious Insiders
Two separate incidents reported this week have once again highlighted how insiders with legitimate access to systems and data can be far more dangerous to enterprise security than external attackers. On Thursday, the US Department of Justice announced indictments against two former Twitter employees for allegedly accessing private information tied to Twitter accounts belonging to several individuals of interest to the government in Saudi Arabia.
Cybersécurité : les données de millions d’utilisateurs de sites de camgirls exposées
À cause d’une grave erreur sur plusieurs sites de camgirls espagnols, les données personnelles de millions d’utilisateurs, mais aussi de travailleuses du sexe ont fuité. Ce scandale est loin d’être le premier dans le domaine des sites de rencontre ou pour adultes, et rappelle à quel point la protection des données personnelles sur Internet est fragile.
Cyber-attaques / fraudes
Japanese media giant Nikkei says $29 million lost in BEC scam – CyberScoop
Scammers fleeced the publishing conglomerate Nikkei out of $29 million by impersonating an executive at the international firm. Nikkei America, the U.S. subsidiary of the Japanese company, said on Oct. 30 that one of its employees transferred the funds, equivalent to roughly 3.2 billion Japanese yen, « based on fraudulent instructions by a malicious third party » posing as a corporate boss.
Brooklyn Hospital Loses Patient Data In Ransomware Attack
A ransomware attack hitting several computer systems at the Brooklyn Hospital Center in New York caused permanent loss of some patient’s data. The hospital tried to recover the data but all efforts were in vain. This indicates that a ransom for decrypting the files was not paid.
MegaCortex, le ransomware qui menace de publier vos données en plus de les chiffrer
Un nouveau mode opératoire particulièrement vicieux est peut-être en train de surgir dans le monde du rançongiciel. Les chercheurs en sécurité de MalwareHunterTeam ont mis la main sur une nouvelle version de MegaCortex, un ransomware qui a été découvert pour la première fois en mai dernier et qui cible avant tout les entreprises et organisations professionelles.
Indian gov’t confirms cyberattack on nuclear plant
Without much data on cybercrime losses, insurers who took an industry-standard hands-off approach to accept customers without much diligence on security practices were flying blind. Meanwhile, the risk environment changed from occasional data theft to rampant extortion, and the loss ratios ballooned. The result? Widespread acknowledgement that something has to change.
Ransomware attacks in Spain leave radio station in « hysteria »
A ransomware attack has ransacked at least two Spanish companies, leaving their employees without computer access. The ransomware hit radio broadcaster Sociedad Española de Radiodifusión (Cadena SER), which released a statement about the attack.
New Study: Hospital Breaches Could Be Killing Patients
Data breaches at hospitals appear to be having a serious impact on patient care, increasing mortality rates for years after an incident, according to new research. Researchers at Vanderbilt University and the University of Central Florida analyzed breach data for 3000 hospitals from 2012-2016 in an attempt to estimate the relationship between breach remediation efforts and care quality.
Google s’associe à des éditeurs antivirus pour nettoyer son Play Store
Le géant informatique va s’appuyer sur Eset, Lookout et Zimperium pour détecter les applications Android malveillantes qui arrivent dans sa boutique.
Failles / vulnérabilités
Les sonnettes vidéo Ring laissaient fuiter le mot de passe de votre réseau Wi-Fi
A n’importe quel moment, un pirate pouvait provoquer une réinitialisation de l’appareil et, durant cette phase, intercepter le nom et le mot de passe du réseau Wi-Fi domestique.
Most Fingerprint Scanners Vulnerable To Hack Within 20 Minutes
It seems the security experts need to work on developing some other technology for security considering the back-to-back threats to biometric authentication, particularly, the fingerprint scans. Recently, some Chinese hackers have claimed that they can hack any fingerprint scanners within minutes. This even applies to smartphones including iPhones that require fingerprint scans.
Ces hackers peuvent pirater des enceintes connectées… avec des lasers
Si vous possédez une enceinte connectée à commande vocale, telle que les Google Home, Amazon Echo ou Apple HomePod, ne la placez pas trop près d’une fenêtre… Un pirate situé aux alentours pourrait en effet injecter des commandes dans votre appareil en pointant un faisceau laser sur son microphone.
Réglementaire / juridique
Rien dans cette section cette semaine 🙂
Divers
Le DDPS renforce son partenariat avec l’ETH Zurich en matière de cyberdéfense
Berne, 07.11.2019 – Le Département fédéral de la défense, de la protection de la population et des sports DDPS et l’ETH Zurich intensifient leur partenariat. Le Campus cyberdéfense a été inauguré le 7 novembre à Zurich en présence de la conseillère fédérale Viola Amherd, cheffe du DDPS.
Google Announces App Defense Alliance
The industry partnership will scan apps for malware before they’re published on the Google Play Store. Google, in partnership with ESET, Lookout, and Zimperium, has announced the creation of the App Defense Alliance, which intends to analyze apps for security before they can be published on the Google Play Store.
Experts: Don’t reboot your computer after you’ve been infected with ransomware | ZDNet
Security experts don’t recommend that users reboot their computers after suffering a ransomware infection, as this could help the malware in certain circumstances. Instead, experts recommend that victims hibernate the computer, disconnect it from their network, and reach out to a professional IT support firm.
Cybersecurity Skills Shortage Tops Four Million
Global IT security skills shortages have now surpassed four million, according to . The certifications organization compiled its latest Cybersecurity Workforce Study from interviews with over 3200 security professionals around the world. The number of unfilled positions now stands at 4.07 million professionals, up from 2.93 million this time last year.
Here’s how to enable DoH in each browser, ISPs be damned | ZDNet
All six major browser vendors have plans to support DNS-over-HTTPS (or DoH), a protocol that encrypts DNS traffic and helps improve a user’s privacy on the web. The DoH protocol has been one of the year’s hot topics. It’s a protocol that, when deployed inside a browser, it allows the browser to hide DNS requests and responses inside regular-looking HTTPS traffic.
Mieux que Face ID ou le lecteur d’empreintes : déverrouillez votre smartphone avec vos os !
Des chercheurs ont trouvé une nouvelle méthode de déverrouillage aussi sécurisée que Face ID ou le lecteur d’empreintes : leur appareil sait identifier la signature bioacoustique de nos os avec une précision de 97%. Les chercheurs doivent encore améliorer la précision du système pour en faire une solution clé-en-main.
1 Comment
Comments are closed.
Pingback: Veille Cyber N257 – 18 novembre 2019 |