Why is "misconfiguration" becoming a common theme for data exposure. New story - Sysadmins have left thousands of Redis instances exposed on the Internet without setting authentication. (here is the bad news , Redis is designed to be accessed inside trusted environments, it should not be exposed on the Internet)

Redis, or REmote DIctionary Server, is an open source, widely popular data structure tool that can be used as an in-memory distributed database, message broker or cache. Since it is designed to be accessed inside trusted environments, it should not be exposed on the Internet.

A massive malware campaign designed to target open Redis servers, about which researchers warned almost two months ago, has now grown and already hijacked at least 75% of the total servers running publicly accessible Redis instances.

Out of total compromised servers, 68 percent systems were found infected using similar keys, named "backup1, backup2, backup3," which were attacked from a medium-sized botnet located at China (86% of IPs), according to the data Imperva collected.

Moreover, the attackers have now found using the compromised servers as a proxy to scan and find vulnerabilities, including SQL injection, cross-site scripting, malicious file uploads, and remote code executions, in other websites



https://thehackernews.com/2018/06/redis-server-hacking.html

Having a Twitter account for your company is good. but, ensure that it does not get compromised. Here is a story about Buffalo wild wings

Around 7:30 pm ET an unknown hacker managed to send six tweets from the company's verified account including one referencing Wendy's and a bigoted attack toward media personality Tariq Nasheed using a racial slur, before either dropping the account or losing access.

The tweets were up for about 20 minutes before they were deleted.

https://www.scmagazine.com/buffalo-wild-wings-apologizes-after-racist-tirade-from-hacked-account/article/770919/

Interesting dual purpose SCAM - Steal and also use the victim to create fake testimonies on YouTube.

Remote-access scammers trick their victims into handing over big money — as well as control of their computers — in return for fake fixes for technical problems that never existed.

The scammers then post the videos to their YouTube page, using them as testimonials to convince future targets that their services are legitimate.


http://www.abc.net.au/news/2018-06-03/australian-web-cams-hacked-to-make-secret-recordings-online/9807960

Along with the "Weakest link", do not forget the "high-risk link" (your cloud app admin) in your security chain. Example - Misconfigured Google Groups can leak sensitive info.

Google Groups are private by default. Many businesses have this configured to "Public on the Internet." As a result, Google Groups can leak emails and expose passwords, financial data, and employee names, addresses, and email addresses.

More than 9,600 institutions - including hospitals, universities, media companies, government agencies, and Fortune 500 organizations - have public Google Groups settings. Of these, researchers found 3,000 are currently leaking some form of sensitive email

It's not just customer data at risk. Google Groups configured to Public can also leave corporate data and internal resources open to the Internet. Kenna's investigation unearthed real emails with GitHub credentials, password recovery, invoices, and suspension documents.

https://www.darkreading.com/cloud/google-groups-misconfiguration-exposes-corporate-data/d/d-id/1331951

Old but Useful - If you are a victim of Identity theft - What should you do next?

A 12-point checklist for victims of identity theft:

1. Change all account passwords
2. Notify affected creditors or bank
3. Put a fraud alert on your credit report
4. Check your credit reports
5. Consider putting a credit freeze on your reports
6. Contact the FTC - https://www.identitytheft.gov/
7. Go to the police
8. Send creditors a copy of your ID theft report
9. Contact credit reporting agencies
10. Contact the Social Security fraud hot line -  1-800-269-0271 / https://www.socialsecurity.gov/fraudreport/oig/public_fraud_reporting/form.htm
11. Get a new driver’s license
12. Contact your telephone and utility companies

https://www.bankrate.com/finance/credit/steps-for-victims-of-identity-fraud.aspx

Blockchain and smart contracts - 6 Common Misconceptions

1. THE MAIN BENEFICIARIES OF BLOCKCHAIN TECHNOLOGY ARE CRIMINALS
2. BLOCKCHAIN IS UNHACKABLE AND UNMODIFIABLE
3. A BLOCKCHAIN NETWORK CAN BE SHUT DOWN BY THE GOVERNMENT
4. SMART CONTRACTS ARE LEGALLY BINDING CONTRACTS
5. SMART CONTRACTS OPERATE WITH COMPLETE AUTONOMY
6. ALL SMART CONTRACTS HAVE THE SAME FEATURES

https://www.tripwire.com/state-of-security/risk-based-security-for-executives/connecting-security-to-the-business/6-common-misconceptions-about-the-security-of-blockchain-technology-and-smart-contract/

You worry about "weakest link in security chain" how about, "high-risk link", your cloud app admin. Need evidence?

(1)Universal Music Group contractor neglected to protect an Apache Airflow server 

(2) Honda affiliate in India left two Amazon S3 buckets misconfigured for more than a year


The Honda mistake affects 50,000 users of the Honda Connect App, which is used to manage automobile service and maintenance. It can also pair with the car to offer vehicle health monitoring, “find my car” capability, trip analysis and an SOS function for emergencies.

A cybercriminal could know “where someone’s car is currently located, where they went, where they typically drive, how they drive, and where they start and stop


https://threatpost.com/honda-universal-music-group-expose-sensitive-data-in-misconfig-blunders/132451/