Did you enjoy your Stay at Marriott or Sheraton in last 4 years - Now, here is some bad news - Marriott said that a massive data breach of its guest reservation system has left up to 500 million guests’ data. the attackers may have had access to the systems for at least FOUR YEARS BEFORE BEING DISCOVERED.

Another  Example for "Prevention is Ideal but Detection is a MUST".

The hotel company said in a statement on its website that hackers gained access to the Starwood reservation database. Starwood, which includes hotels like St. Regis and Sheraton, was bought by Marriott in 2016.


Marriott said that hackers stole data like name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences for 327 million of these guests.

https://threatpost.com/2014-marriott-data-breach-exposed-500m-guests-impacted/139507/

Have you observed that sometimes (with some online app ) your perfectly valid password will fail and you have to contact their support to reset it. Here is one reason.

The computer maker reported yesterday meaning , 20 days later (No wonder GDPR  mandates less than72 hours for notification)  that it detected and disrupted unauthorized activity on Dell.com on Nov. 9. Dell, automatcially  reset the passwords WITHOUT INFORMING THE POTENTIAL VICTIMS.

This might sound good but we know people reuse the same login information over several sites so, breach notification should have gone out immediately.

“This incomprehensible action of mass password reset may damage Dell’s reputation of a vendor who cares about information security and privacy. Preventive password reset can certainly be helpful; however, it should be properly accompanied with assuring explanations and transparent next steps,”

https://www.scmagazine.com/home/security-news/dells-belated-data-breach-notification-angers-cybersecurity-industry-exec/

2018 - Year of Data Leak + Data Breach - The sad part is "Data Leak" can be easily avoided if we can overcome SIS (Security Ignorance Syndrome)

ElasticSearch server database containing the information of nearly 57 million U.S. residents was found to have been left exposed without a password.

The data base was first indexed by Shodan on November 14, 2018 and contained the information including first and last names, employers, job titles, email, addresses, state, zip codes, phone numbers, and IP addresses. Diachenko also reportedly discovered a second cached database named “Yellow Pages,” which reportedly held an additional 25,917,820 records, which appeared to be business entries.

Overprivileged identities are one of the biggest threats facing enterprises with complex, multi-cloud environments, and we will continue to see database leaks like this one until companies get better at assessing and managing unused, high-risk privileges

https://www.scmagazine.com/home/security-news/elasticsearch-server-exposed-data-of-nearly-57m-u-s-residents/

Apparently, IT Security folks may be estimating the value of the data wrongly - Some datasets like R&D data, pricing models, source code, M&A documents and signed employment agreements are worth substantially more to organizations that other assets such as product manufacturing and engineering workflows, signed customer contracts, budget and accounting data and network design documents.

The survey also showed that data value — for certain types of data — decreases over time because of a decline in relevancy. For instance, R&D documents in the manufacturing function that are less than one year old are valued at more than $873,380. The value of the same data declines to about $492,700 if it is older than a year

Similarly, fresh legal documents that are less than a year old are valued at some $508,640 and those that are older than one year at $120,911.

Similarly, the cost associated with a data leak involving R&D documents, at $661,400, is substantially higher than the costs of a breach that involves product-manufacturing workflows ($106,520)

The data shows that organizations need to manage data as an asset and not just as a liability, Abbott says. 

IT security groups need to be thinking about assigning values to data types based on factors like business use, age, how much it would cost to reproduce, how much it would cost if lost or in the wrong hands, Abbott says.

https://www.darkreading.com/vulnerabilities---threats/incorrect-assessments-of-data-value-putting-organizations-at-risk/d/d-id/1333362

Inconvenient Truth about awareness training , Enterprise and Employees - Despite an increased focus on cybersecurity awareness in the workplace, employees’ poor cybersecurity habits are getting worse.

• 75% of respondents admitted to reusing passwords across accounts, including work and personal.
• 49% of respondents would actually blame the IT department for a cyberattack if one occurred as a result of an employee being hacked.
• Survey findings points to a workforce who are less committed to security best practices. 
• (48%) of respondents are currently using or planning to use chatbots and artificial intelligence personal assistants, with more than one tenth (13%) already using these in their organization to increase their work efficiency.
• Over half (55%) of survey respondents stated their IT department can be a source of inconvenience in their organization
• 31% who admitted that they have deployed software without IT’s help (i.e. ‘shadow IT’).
  13% of employees admitted they would not immediately notify their IT department if they thought they had been hacked.
• Enterprises are increasingly adopting software bots powered by robotic process automation (RPA), and granting them access to mission-critical applications and data, like their human counterparts.

https://www.helpnetsecurity.com/2018/11/14/poor-security-habits-are-getting-worse

Do you own a Sennheiser's HeadSet - Here is an interesting story (like the Adware Scandal that made Lenova pay $7.3m for installing adware in 750,000 laptops) - Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks.

When users have been installing Sennheiser's HeadSetup software, little did they know that the software was also installing a root certificate into the Trusted Root CA Certificate store.  To make matters worse, the software was also installing an encrypted version of the certificate's private key that was not as secure as the developers may have thought.

While these certificate files are deleted when a user uninstalls the HeadSetup software, the trusted root certificate was not removed. This would allow an attacker who had the right private key to continue to perform attacks even when the software was no longer installed on the computer

Microsoft has also released the security advisory ADV180029, titled "Inadvertently Disclosed Digital Certificates Could Allow Spoofing", that explains that Microsoft has released an updated Certificate Trust List that removes trust for these certificates.

https://www.bleepingcomputer.com/news/security/sennheiser-headset-software-could-allow-man-in-the-middle-ssl-attacks/

Resurrection of the Worm - Fileless version of the malicious remote access tool njRAT that propagates as a worm via removable drives. It looks like Malwares (old and new) are going to behave like worm. Is it time to disable removable media and monitor Powershell?. It also time to revisit old school best practices like Segmentation and endpoint isolation.

This particular variant, identified as Worm.Win32.BLADABINDI.AA, leverages AutoIt, a free automation script language for Windows, to compile the final payload and the main script into one executable. The technique makes the ultimate payload difficult to detect

“The worm’s payload, propagation, and technique of filelessly delivering the backdoor in the affected system make it a significant threat,” the blog post concludes. “Users and especially businesses that still use removable media in the workplace should practice security hygiene. Restrict and secure the use of removable media or USB functionality, or tools like PowerShell


https://www.scmagazine.com/home/security-news/cybercrime/malicious-developer-creates-wormable-fileless-variant-of-njrat/