Des ransomwares pour Noël et un serveur accessible avec les données de 267 millions d’utilisateurs de Facebook #veille (22 déc 2019)

Voici le rapport de veille de la semaine faisant le tour des actualités les plus intéressantes. Vous retrouverez un développement de certaines d’entre elles dans les prochains articles. Bonne lecture et belle semaine à vous !

un petit clic pour ma veille

Vol / perte de données

Data Leak Exposes 267 Million Facebook Users

A database of 267 million Facebook user IDs, phone numbers, and names was left exposed online for a fortnight thanks to another cloud misconfiguration, according to researchers. The trove was likely to have been the result of an illegal scraping operation carried out by cyber-criminals, according to consultant Bob Diachenko and researchers at Comparitech.

170m passwords stolen in Zynga hack, monitor says

More than 170m usernames and passwords were stolen from the company behind Words With Friends in a hack this year, according to a breach monitoring site. Zynga, a social game developer that made its name with Farmville a decade ago and acquired Words With Friends a year later, admitted to the hack in September, telling users that cyber-attacks were « one of the unfortunate realities of doing business today ».

15 Million Patient Records Exposed Attack on Canadian Lab

A cyberattack against LifeLabs exposed personal information on patients in Ontario and British Columbia. A cyberattack against LifeLabs, Canada’s largest medical testing provider, left personal information of more than 15 million individuals exposed before the company paid a ransom to retrieve the data.

Honda Leaks Data of 26K North American Customers

The leaky database was online for about a week, exposing customers’ vehicles information and personal identifiable information. An exposed database was discovered leaking the personal information of 26,000 North American Honda owners and their vehicles. The Elasticsearch database in question is owned by the American Honda Motor Co., a North American subsidiary of the Honda Motor Co.

Cyber-attaques / fraudes

En Allemagne, 38 000 étudiants font la queue pour recevoir leur mot de passe… sur une feuille en papier

Touchée par une cyberattaque, l’université de Giessen en Hesse a été contrainte de réinitialiser tous les mots de passe de messagerie. Et pour distribuer les nouveaux codes secrets, elle n’a pas trouvé d’autre moyen qu’une remise en main propre.

Ce malware vous invite à une fête de Noël : n’y allez surtout pas

Le logiciel malveillant Emotet profite da la période des fêtes pour infecter de nouveaux ordinateurs. Ne vous laissez pas berner par cette proposition alléchante qui arrive par courrier électronique.

Frankfurt shuts down IT network following Emotet infection | ZDNet

Frankfurt, one of the largest financial hubs in the world and the home of the European Central Bank, has shut down its IT network this week following an infection with the Emotet malware. Frankfurt is the fourth German entity that shut down its IT network in the past two weeks because of Emotet.

New Jersey hospital pays ransomware attackers to avoid jeopardizing lives

Ransomware reports keep piling up in the United States, with a new incident in New Jersey adding to a long string of cyber-attacks targeting government institutions and critical infrastructures across North America. Hackensack Meridian Health, the largest hospital system in New Jersey, fell victim to a ransomware attack early last week but was advised by experts not to disclose the hack until Friday, December 13.

LifeLabs pays hackers to recover data of 15 million customers | ZDNet

LifeLabs, Canada’s leading provider of laboratory diagnostics and testing services, admitted today to paying hackers to retrieve data stolen during a security breach last month. « We did this [paying the hackers] in collaboration with experts familiar with cyber-attacks and negotiations with cyber criminals, » the company said today in a press release.

Epilepsie : spectaculaire attaque sur un compte Twitter

Réseaux : Le compte Twitter de la Fondation canadienne de l’épilepsie a été attaquée par des trolls qui l’ont bombardé de contenu vidéo induisant des crises d’épilepsie afin de nuire aux victimes de cette maladie. Une plainte a été déposée.

100% Rise in Number of UK Businesses Paying Hacking Ransoms

New research into the attitudes and beliefs of cybersecurity professionals has identified a sharp rise in the number of businesses paying up when stung by a ransomware attack. The 2019 Global Security Attitude Survey Report by California cybersecurity technology company CrowdStrike shows that the number of global organizations paying ransoms from supply-chain attacks has more than doubled from 14 to 39 percent in the past year.

New Orleans to Boost Cyber Insurance to $10M Post-Ransomware

Mayor LaToya Cantrell anticipates the recent cyberattack to exceed its current $3 million cyber insurance policy. The city of New Orleans is planning to increase its cyber insurance policy to $10 million following a Dec. 13 ransomware attack that will likely exceed its current $3 million policy, Mayor LaToya Cantrell confirmed this week.

Researcher Releases Data on 100,000 Phishing Attempts to Teach You How to Not Get Hacked

Image: Anton Petrus/ Getty Images Do you have information on a cyberattack or data breach? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, OTR chat at lorenzofb@jabber.ccc.de, or email lorenzofb@vice.com

Failles / vulnérabilités

Apple’s Bug Bounty Opens for Business, $1M Payout Included

The tech giant is looking for full working exploits with any vulnerability submission. Apple has officially opened its historically private bug-bounty program to the public, while boosting its top payout to $1 million. Bounty hunters seeking that $1 million will need to provide a working exploit for a zero-click remote chain with full kernel execution and persistence on Apple’s latest shipping hardware.

Réglementaire / juridique

Hacker who blackmailed Apple in 2017 gets no prison time | ZDNet

A 22-year-old man was sentenced today in London for his involvement in an extortion attempt against Apple, during which the suspect and co-conspirators threatened to mass-hack iCloud accounts and factory reset 250 million iPhones and iPads. The man, Kerem Albayrak, was sentenced today to a two-year suspended jail term, 300 hours of unpaid work, and a six-month electronic curfew.

GozNym Gang Members Behind $100 Million Damages Sentenced

Three members of a cybercrime group that used the GozNym banking Trojan to steal millions from U.S. businesses were sentenced today in parallel and multi-national prosecutions in Pittsburgh and Tbilisi, Georgia. The GozNym group members were charged for stealing « an estimated $100 million from more than 41 000 victims, primarily businesses and their financial institutions » according to a Europol press release from May.

British Hacker Accused of Blackmailing healthcare Firms Extradited to U.S.

British Hacker, Nathan Francis Wyatt, accused of blackmailing healthcare and law firms extradited to the United States.

Divers

Une enquête du New York Times alerte sur ces smartphones qui nous traquent

Grâce à la base de données qu’un informateur anonyme leur a confié, les journalistes du New York Times ont pu recréer les déplacements de 12 millions de citoyens américains pendant plusieurs mois. Un flicage invisible à base de données de géolocalisation issues des applications de nos smartphones.

Veilleur et spécialiste en cybersécurité

Comments are closed.