Cyber Security Newsletter Week 9
FBI urges temporary phones for Olympic athletes
Athletes and visitors heading to the 2022 Winter Olympics in Beijing should leave their phones at home and use temporary ones instead, the FBI has urged. It comes in a wider warning about how cyber-activities may disrupt the events. Those include ransomware and denial of service attacks. But it also cautioned about malware, data theft and the installation of "tracking tools" on mobile devices. It added that the National Olympic Committees in some Western countries were also advising against the use of personal mobile phones. The warning comes after a similar one from cyber-security group Citizen Lab. Earlier this month, it looked into the official app for the Olympics - which people attending are required to download for Covid health monitoring purposes.
Its report suggested:
- it was insecure when it came to protecting personal data.
- an encryption flaw enabled a third party to access documents, audio and files
- it was subject to censorship based on a list of keywords
- its privacy policy was not clear about who received and processed any data uploaded to it.
The FBI said it was not aware of "any specific threat" against the Olympics but encouraged partners to "remain vigilant".
Solutions:
• Ransomware Protection
• Web Protection
• Email Protection
Shortage of KP Nuts and Hula Hoops looms after cyber-attack
A cyber-attack targeting KP Snacks could lead to a shortage of some of Britain’s most popular snacks including Hula Hoops, McCoy’s and Tyrrells crisps, Butterkist, Skips, Nik Naks and KP Nuts. The company has sent a letter to stores saying the ransomware attack, which has crippled its IT and communications systems, could lead to supply issues until “the end of March at the earliest” as it “cannot safely process orders or dispatch goods”. The warning message, sent out through the groceries wholesaler Nisa, said KP Snacks was going to limit the size of orders to retailers so it could “manage what stock we do have”. The hackers are threatening to release information stolen from the company’s IT systems to try to force it into making a payment to decrypt its files to continue operations. In October, the crisp firm Walkers was hit by IT issues that resulted in gaps on shelves that lasted through to the end of December. In December, the Spar wholesaler and store operator James Hall was also hit by severe IT issues after a cyber-attack affected more than 600 independent and centrally owned Spar stores across the north of England, forcing many to close temporarily. They said locking files and data on a user’s computer and demanding payment for their release had become increasingly popular among criminals because it is proving to be highly profitable. Cybercriminals are still little more than exploitative bullies looking for easy money. However, the UK’s National Cyber Security Centre (NCSC) has warned that even if firms pay up “there is no guarantee that you will get access to your computer or your files”. KP Snacks also warns of supply problems for McCoy’s and Tyrrells crisps after ransomware attack hits IT systems. “This is another example of the real-life consequences that ransomware can have, and they are becoming more common than ever before,” A cyber-attack on Ukraine government websites earlier this month warned the public to “be afraid and expect the worst”
Solutions:
• Ransomware Protection
• Cyber Consultancy
• End-point protection
Cyber-attack strikes German fuel supplies
A major fuel supplier in Germany is operating at a "limited capacity" after a cyber-attack disrupted IT systems at the weekend. Oil tanking Deutschland GmbH & Co. KG stores and transports oil, vehicle fuels and other petroleum products for companies like Shell. It says it discovered it had been hacked on Saturday. It has declared "force majeure" for the majority of its inland supply activities in Germany. The declaration of force majeure excuses a company from contractual agreements when an extraordinary event occurs which is beyond its control. In May last year a ransomware attack on US oil supplier Colonial Pipeline saw supplies tighten across the US and multiple states declaring an emergency. German news outlet Handelsblatt, which first reported the incident, said: "All of Oil tanking’s loading and unloading systems are paralyzed." Oil tanking Deutshland GmbH's parent company did not give details about the type of hack they were dealing with but said: "We are working to solve this issue according to our contingency plans, as well as to understand the full scope of the incident." Cyber-security researchers say that attacks on critical infrastructure like oil and food supplies are on the increase.
Solutions:
• Web protection
• Ransomware Protection
• Awareness Training
Data breach exposes details of British Council students
The personal details and login information of British Council students has been exposed following a major data breach. According to a report by researchers at Clario, an open Microsoft Azure repository indexed by a public search engine with no authentication in place was found and will have failed to protect the files within. The details included full names, student IDs, enrollment details, email addresses and more. The breach, which was discovered back in December, was reported to the British Council by Clario and the victim organisation has since released a statement. “Upon becoming aware of this incident, where the data was held by a third-party supplier, the records in question were immediately secured, and we continue to look into the incident in order to ensure that all necessary measures are and remain in place. The students of the British Council have been warned that the breach could put them at risk to scam attempts such as identity theft and phishing.
Solutions:
• Multi Factor Authentication (MFA)
• Regularly update passwords and emails
• Email Protection (Mimecast)
Athletes and visitors heading to the 2022 Winter Olympics in Beijing should leave their phones at home and use temporary ones instead, the FBI has urged. It comes in a wider warning about how cyber-activities may disrupt the events. Those include ransomware and denial of service attacks. But it also cautioned about malware, data theft and the installation of "tracking tools" on mobile devices. It added that the National Olympic Committees in some Western countries were also advising against the use of personal mobile phones. The warning comes after a similar one from cyber-security group Citizen Lab. Earlier this month, it looked into the official app for the Olympics - which people attending are required to download for Covid health monitoring purposes.
Its report suggested:
- it was insecure when it came to protecting personal data.
- an encryption flaw enabled a third party to access documents, audio and files
- it was subject to censorship based on a list of keywords
- its privacy policy was not clear about who received and processed any data uploaded to it.
The FBI said it was not aware of "any specific threat" against the Olympics but encouraged partners to "remain vigilant".
Solutions:
• Ransomware Protection
• Web Protection
• Email Protection
Shortage of KP Nuts and Hula Hoops looms after cyber-attack
A cyber-attack targeting KP Snacks could lead to a shortage of some of Britain’s most popular snacks including Hula Hoops, McCoy’s and Tyrrells crisps, Butterkist, Skips, Nik Naks and KP Nuts. The company has sent a letter to stores saying the ransomware attack, which has crippled its IT and communications systems, could lead to supply issues until “the end of March at the earliest” as it “cannot safely process orders or dispatch goods”. The warning message, sent out through the groceries wholesaler Nisa, said KP Snacks was going to limit the size of orders to retailers so it could “manage what stock we do have”. The hackers are threatening to release information stolen from the company’s IT systems to try to force it into making a payment to decrypt its files to continue operations. In October, the crisp firm Walkers was hit by IT issues that resulted in gaps on shelves that lasted through to the end of December. In December, the Spar wholesaler and store operator James Hall was also hit by severe IT issues after a cyber-attack affected more than 600 independent and centrally owned Spar stores across the north of England, forcing many to close temporarily. They said locking files and data on a user’s computer and demanding payment for their release had become increasingly popular among criminals because it is proving to be highly profitable. Cybercriminals are still little more than exploitative bullies looking for easy money. However, the UK’s National Cyber Security Centre (NCSC) has warned that even if firms pay up “there is no guarantee that you will get access to your computer or your files”. KP Snacks also warns of supply problems for McCoy’s and Tyrrells crisps after ransomware attack hits IT systems. “This is another example of the real-life consequences that ransomware can have, and they are becoming more common than ever before,” A cyber-attack on Ukraine government websites earlier this month warned the public to “be afraid and expect the worst”
Solutions:
• Ransomware Protection
• Cyber Consultancy
• End-point protection
Cyber-attack strikes German fuel supplies
A major fuel supplier in Germany is operating at a "limited capacity" after a cyber-attack disrupted IT systems at the weekend. Oil tanking Deutschland GmbH & Co. KG stores and transports oil, vehicle fuels and other petroleum products for companies like Shell. It says it discovered it had been hacked on Saturday. It has declared "force majeure" for the majority of its inland supply activities in Germany. The declaration of force majeure excuses a company from contractual agreements when an extraordinary event occurs which is beyond its control. In May last year a ransomware attack on US oil supplier Colonial Pipeline saw supplies tighten across the US and multiple states declaring an emergency. German news outlet Handelsblatt, which first reported the incident, said: "All of Oil tanking’s loading and unloading systems are paralyzed." Oil tanking Deutshland GmbH's parent company did not give details about the type of hack they were dealing with but said: "We are working to solve this issue according to our contingency plans, as well as to understand the full scope of the incident." Cyber-security researchers say that attacks on critical infrastructure like oil and food supplies are on the increase.
Solutions:
• Web protection
• Ransomware Protection
• Awareness Training
Data breach exposes details of British Council students
The personal details and login information of British Council students has been exposed following a major data breach. According to a report by researchers at Clario, an open Microsoft Azure repository indexed by a public search engine with no authentication in place was found and will have failed to protect the files within. The details included full names, student IDs, enrollment details, email addresses and more. The breach, which was discovered back in December, was reported to the British Council by Clario and the victim organisation has since released a statement. “Upon becoming aware of this incident, where the data was held by a third-party supplier, the records in question were immediately secured, and we continue to look into the incident in order to ensure that all necessary measures are and remain in place. The students of the British Council have been warned that the breach could put them at risk to scam attempts such as identity theft and phishing.
Solutions:
• Multi Factor Authentication (MFA)
• Regularly update passwords and emails
• Email Protection (Mimecast)