Apple to Switch A17 Bionic Chip Technology to Cut Costs in 2024

andreasc
-
0
Apple to Switch A17 Bionic Chip Technology to Cut Costs in 2024
[ad_1]

The iPhone 15 series is set to debut in September with the A17 Bionic chipset. But we’re hearing that there could be some changes for the A18 Bionic next year.

Currently, Apple has been using the 5nm process to manufacture the A14, A15 and A16 chipsets in recent years. With the A17, Apple is going to be moving to 3nm. To be exact, they will be moving to the TSMC N3B process. However, Apple is planning to move over to the N3E sometime next year. This would likely affect the A18 Bionic and possibly the A19 Bionic.

The main differences here would be making the chips easier to manufacture. Which will also come with reduced efficiency.

N3B is TSMC’s original 3nm node that was created in partnership with Apple. However, N3E is a simpler, more accessible node that most of TSMC’s other clients use. N3E does also use fewer EUV layers and lower transistor density, compared to N3B. Another major difference is that N3B has been ready for mass production for a much longer time compared to N3E, however it does have a lower yield. Which helps raise prices on a per-chip basis.

It’s unlikely that this will affect the iPhone 15

Switching nodes like this for a processor is going to be a big deal, so it’s pretty unlikely that Apple would do this in the middle of the iPhone 15 life cycle. Meaning that the iPhone 15 will likely be more efficient than the iPhone 16, which would have chips made on the N3E process.

This is a cost-cutting measure by Apple, but it’s unclear if this is being done so that iPhone prices can stay the same, or if the price bump is going to be smaller because of this. There are rumors of the iPhone going up in price later this year, including in the US. Which hasn’t happened since the iPhone X was released back in 2017. So a price increase wouldn’t be too crazy, after all $999 in 2017 is now about $1,240.17 in 2023.


[ad_2]
Source link

NSA Releases Guide to Combat BlackLotus Malware

andreasc
-
0
NSA Releases Guide to Combat BlackLotus Malware
[ad_1]
Combat BlackLotus Malware

Malicious cyber actors might exploit a known flaw in Microsoft Windows’ secure startup process to bypass Secure Boot protection and run the BlackLotus malware.

BlackLotus uses a known flaw dubbed “Baton Drop,” tracked as CVE-2022-21894, to bypass beyond security precautions made by the device’s Secure Boot start-up procedure. 

CSN

Since October 2022, BlackLotus has been making appearances on hacker forums. It is advertised as malware that can avoid detection, go through removal attempts, and disable various Windows security mechanisms, including Defender, HVCI, and BitLocker.

By taking advantage of weak boot loaders that have not been added to the Secure Boot Deny List Database (DBX), the malware attacks Secure Boot.

The attack vector used to install BlackLotus is still present since the CVE-2023-24932 patch is by default, disabled.

Administrators must perform a manual procedure taking many steps to update bootable media and apply revocations before allowing this update to safeguard Windows devices.

“BlackLotus is very stoppable on fully updated Windows endpoints, Secure Boot-customized devices, or Linux endpoints. Microsoft has released patches and continues to harden mitigations against BlackLotus and Baton Drop,” the NSA said.

“The Linux community may remove the Microsoft Windows Production CA 2011 certificate on devices that exclusively boot Linux.

Mitigation options available today will be reinforced by changes to vendor Secure Boot certificates in the future (some certificates are expiring starting in 2026).”

Guidelines to Combat BlackLotus Malware

System administrators and network security professionals were recommended to take hardening measures on systems that have been patched against this vulnerability now.

The installation of the BlackLotus payload or the reboot event that initiates its execution and implantation can be detected and stopped by defensive software solutions.

According to the NSA, certain infrastructures may get a false feeling of security from currently available updates.

“NSA recommends system administrators within DoD and other networks take action. NSA reports that BlackLotus is not a firmware threat, but instead targets the earliest software stage of the boot”.

  • Update recovery media, install the most recent security updates, and turn on optional mitigation.
  • Improve defensive policies by setting endpoint security to thwart efforts to install BlackLotus malware.
  • Use endpoint security products and firmware monitoring tools to keep track of device integrity measures and boot settings.
  • Customize UEFI Secure Boot to block older (pre-January 2022), signed Windows boot loaders.

Attacks Against Windows 10 and 11

BlackLotus has been used in attacks against Windows 10 and 11 to take advantage of a vulnerability (known as Baton Drop and tracked as CVE-2022-21894) found in older boot loaders (also known as boot managers) that enables users to get around Secure Boot security and start a chain of malicious operations aimed at compromising system security.

The boot loaders impacted by this vulnerability have not yet been added to the Secure Boot DBX revocation list, enabling the attackers to remove the Secure Boot policy and prevent its enforcement.

“However, patches were not issued to revoke trust in unpatched boot loaders via the Secure Boot Deny List Database (DBX). Administrators should not consider the threat fully remediated as boot loaders vulnerable to Baton Drop are still trusted by Secure Boot,” the NSA said.

An older Extensible Firmware Interface (EFI) binary of the Windows boot loader is deployed onto the boot partition to install and run the malware on compromised devices.

Next, BitLocker and Memory Integrity protections are turned off just before the device is restarted to start and implant the malware. 

As a result, attackers can replace fully patched bootloaders with vulnerable versions. It is not easy to defend systems against BlackLotus.

Patching is an excellent initial step; however, Zachary Blum, NSA’s Platform Security Analyst, advises hardening activities depending on your system’s setup and security software employed.

Manage and Secure Your Endpoints Efficiently – Free Download


[ad_2]
Source link

Patched OpenSSH Exploited for IoT, Linux Cryptomining

andreasc
-
0
Patched OpenSSH Exploited for IoT, Linux Cryptomining
[ad_1]

Apart from cryptomining, the campaign also involves hijacking SSH credentials, hiding malicious SSH connections, and more.

Microsoft researchers have discovered a new cryptojacking campaign that leverages custom and open-source tools to target IoT (Internet of Things) devices and Linux-based systems for cryptomining (aka cryptocurrency mining).

Attackers use a backdoor that can deploy a wide range of “tools and components,” such as rootkits and IRC bots, to steal device resources. This backdoor installs a patched version of OpenSSH to hijack impacted device systems and install a cryptominer.

Once this is done, the attackers can perform a range of activities, such as moving laterally in the network, hijacking SSH credentials, and hiding malicious SSH connections, apart from cryptomining.

The attackers need to hijack SSH credentials, for which they look for misconfigured Linux hosts. These hosts are brute-forced to gain initial access. When the target device is compromised, the first step is to disable the shell history.

The next step is to extract a trojanized OpenSSH package, “openssh-8.0p1.tgz,” from a remote server. It contains “benign OpenSSH source code and other malicious files,” such as backdoor binaries for arm4I, arm5I, x86, i568, i686, a shell script inst.sh, and an archive containing the shell script vars.sh, which has all the files needed for the backdoor to operate. After payload installation, the inst.sh script runs a backdoor binary matching the device’s architecture.

The backdoor is a shell script compiled using the Shell Script Compiler. It allows threat actors to distribute payloads and conduct post-exploitation attacks, such as stealing and sending device information, as well as clearing Apache, nginx, httpd, and system logs to hide their malicious activities and remain undetected.

To retain SSH access, the backdoor modifies two public keys in the system’s authorized key configuration files for all users. Additionally, this backdoor can install the logtamper open-source utility for clearing the wtmp and utmp logs that record user sign-in sessions and system event data.

In this campaign, as Microsoft’s Threat Intel team stated in its blog post, attackers use cryptojacking to install a cryptominer. In cryptojacking, computer resources are illegally drained to generate revenue. Almost all devices, tools, services, and IT infrastructure, including IoTs, are vulnerable to cryptojacking. Before launching the miner, all competing cryptomining processes are eliminated.

Additionally, the backdoor runs a modified version of a Kaiten malware-based DDoS client called ZiggyStarTux that executes bash commands received from the attacker’s C2 server. The C2 communications are established via an unidentified Southeast Asian financial institute’s subdomain to hide the malicious traffic.

Patched OpenSSH Exploited for IoT, Linux Cryptomining

The backdoor determines if the device is a honeypot by testing access to the virtual filesystem /proc. If it cannot access it, the backdoor exits. If it can access /proc, it extracts device data, such as OS version and network configuration, etc., and emails it to a hardcoded address (dotsysadminprotonmailcom) or the attacker’s address. The open-source rootkits it can compile/download/install include Reptile and Diamorphine, both available on GitHub.

Microsoft urges users to improve the security of internet-exposed devices by ensuring secure configurations, using strong passwords, and regularly updating firmware. A VPN should be preferred for remote access, and users should always use the latest version of OpenSSH.

  1. Why IoT Security in Healthcare is Crucial
  2. Illegal cryptomining farm using thousands of PS4s seized
  3. CoinStomp cryptomining malware targeting cloud services
  4. BotenaGo botnet malware targeting millions of IoT devices
  5. Malware hits Hive OS cryptomining users; steals wallet funds

[ad_2]
Source link

Samsung treats Galaxy A71, A02 & more with the June update

andreasc
-
0
Samsung treats Galaxy A71, A02 & more with the June update
[ad_1]

Samsung is rolling out the June 2023 Android security patch to a bunch of budget and mid-range smartphones. The latest security update is now available for the Galaxy A71, Galaxy A Quantum, and Galaxy A02 in some markets. The Galaxy A53 5G is also getting the June SMR (Security Maintenance Release) in more regions. This month’s security patch fixes more than 60 vulnerabilities, including at least three critical issues.

As of this writing, the June SMR for the Galaxy A71 is available in Thailand, Polan, and Vietnam. The new firmware build number for the 2020 mid-range phone is A715FXXUADWE1. According to Samsung’s official changelog, the device is getting some system stability and reliability improvements along with the latest security fixes. The company should roll out the new security patch to the phone in more markets in the coming days.

While Samsung didn’t launch the Galaxy A71 in the US, its 5G sibling arrived stateside. The latter started picking up the June SMR a few days back but the rollout hasn’t expanded beyond Asia. Meanwhile, the South Korean version of the Galaxy A71 5G, which is known as the Galaxy A Quantum and is exclusive to SK Telecom’s network, is getting the June update. The new build number for this phone is A716SKSU6FWF2, and it is getting a lot more.

Samsung’s changelog states that the Galaxy A Quantum is picking up improvements to the Emergency SOS feature. The company has removed the ability to turn off this feature, which lets you make emergency calls by repeatedly pressing the power button five times in quick succession. It also now lets users turn off the countdown before the call is initiated. This change also rolled out to the Galaxy S23 series and several other models with the June update.

The Galaxy A02 is also getting Samsung’s June update

Samsung is also rolling out its June update to the Galaxy A02. The budget model is widely getting the new SMR in Latin America. For users in Brazil, the new build number is A022MUBS3BWF2. It’s A022MUBS3BWF1 for the rest of the continent. This phone isn’t picking up anything else with the latest update. It’s unclear if Samsung will push the June SMR to the Galaxy A02 in other markets. The device didn’t arrive in the US.

Meanwhile, the Galaxy A53 5G is now receiving the June update in several markets outside the US. Samsung began the rollout stateside a couple of weeks back. Users in Europe, Africa, and Asia can also now download the new SMR. Depending on your region and model number, the new build number is either A536BXXU6CWE9 or A536EXXU6CWE9 (via). The Galaxy A53 5G is getting some system optimizations but nothing more.


[ad_2]
Source link

These AI tools will help you find your dream job

andreasc
-
0
These AI tools will help you find your dream job
[ad_1]

There’s no way to deny it; AI is a big part of our modern world, and it’s here to stay. While we’re all preparing for the negative effects of this revolution, we can take a second to enjoy the positives. For example, there are a bunch of cool and useful AI tools that you can use to land your dream job.

These AI tools will help you find your dream job

Being on the job search can be a daunting task. Because of all of the layoffs going on, more people are, unfortunately, having to do this task. Well, here are some tools to help you get that interview.

Jobscan

Getting your dream job often starts with your resume. Getting your resume is one of the most important things to do and also one of the most discouraging. Jobscan can help you out immensely.

What this tool will do is scan your resume and help you optimize it. We all know how crucial (and annoying) this step can be. The thing is that a lot of companies use a database to search through resumes based on certain keywords. Jobscan will search through your resume and optimize it so that it will contain the right amount of keywords.

This will make it easier for your resume to be picked from the pool. The company says that this tool can increase your chances of landing an interview by up to 50%.

The Job For Me

Having the best resume in the world doesn’t mean anything if you’re not applying for the right job. This is where The Job For Me comes in. This is a site that will take the information you provide and feed you jobs that fit your skills.

There are already sites that do this, but there’s a difference. Other services usually require you to input a ton of information like your job history, education, and more. It’s an annoying process if you have to do it several times.

Well, with this service, you don’t have to enter any information. You’re able to simply upload your resume or post your LinkedIn link in the field. Then, it will use AI to scan through the information and deliver your job opportunities. Just know that this service does cost money.

The lowest tier costs $19/month, and it gives you five curated jobs every month. You can check out the prices and services here.

CareerHub AI

This is more like a tool belt than a tool. Imagine if ChatGPT was your personal career counselor. CareerHub AI uses generative AI to help you out in your search for a new job. It can actually help you from the first steps.

There’s a tool that will help you discover your career path. You’ll enter information like your interests and job preferences, and you’ll get some recommendations for careers you should look into.

The next tool will give you career advice based on your skills and career goals. It will give you some information to help you push your career to the next level.

When it comes to your new job, you’ll want to know your worth as an employee. For this tool, you’ll enter information like your current job role, experience, education, and country. It will use AI to estimate what you should be earning based on that information. This way, you’ll know what to put down on the job application when asked about the expected salary.

Do you need a cover letter written? There’s a tool that can write a personalized cover letter for you to present to the employer. It can save you a ton of time when getting your resume together. This requires you to create an account, however.

The last tool will give you personalized interview questions. It will ask you typical questions that you’d see during an interview. This will help you practice answering interview questions before the actual meeting. This also requires that you create an account.

Wonsulting

This is also a suite of tools geared toward finding your next job. It’s an all-in-one solution for people looking to maximize their chances of getting a new role. Wonsulting takes different aspects of the job search into account.

This service has a service that will generate a resume for you using AI. there’s also an AI cover letter writer that will do the same thing. You’ll just need to enter some details.

Wonsulting will also help you with your networking. There’s an AI tool that will help you connect with industry professionals across your field. Knowing the right people is an important part of landing certain jobs. This step is also handled with AI.

A word of caution

So, above, we mentioned some great tools to help you land your next interview. For all we know, this could be the thing to rocket you into your next corner office. However, there’s something that you need to be aware of.

AI has come a long way over the years; it exploded in the past seven months with the introduction of ChatGPT. We’ve seen some mind-boggling feats performed by AI chatbots, but the technology is still not perfect. AI is in a state where it’s still making mistakes.

Chatbots give you inaccurate information from time to time, and that might not be a big issue on the surface. However, if you’re generating entire resumes and cover letters, you’ll want to be careful.

Take a minute to carefully read over the content that these tools create. Make sure that there aren’t any inaccurate details. This is something that represents you and your worth to a company. You don’t want to give any wrong information. Read, reread, and proofread what it produces for you.

While there are powerful tools available at your fingertips, it’s still useful to learn what makes a proper resume and a proper cover letter. This way, you can better make changes if the AI-generated documents aren’t perfect. It could mean the difference between landing the review and landing in the unemployment line.

Looking for more AI content

If you want to find some more AI content, we have you covered. Check out the list below.


[ad_2]
Source link

First Directory of Virtual CISO Providers Launched by Cynomi

andreasc
-
0
First Directory of Virtual CISO Providers Launched by Cynomi
[ad_1]

 The industry’s first-ever directory of virtual Chief Information Security Officer service providers has gone live today at www.thevcisodirectory.com. This extensive list of virtual CISO (vCISO) providers, collated by Cynomi, means that small- and medium-sized businesses (SMBs) can easily tap the expertise of qualified cybersecurity professionals to protect their digital assets and ensure compliance.

Cyberattacks are on the rise, with a 42% global increase in harmful occurrences during the first half of 2022, according to Check Point Software’s Mid-Year Security Report. Strong cybersecurity measures are essential in this environment.

CSN

However, most small and medium-sized businesses do not have their own CISO, mostly because they do not have the funding to fill such a post.

This problem is compounded by the talent gap, making finding individuals with the necessary skill and specialized experience challenging. According to research by Datto, only 50% of SMBs have a dedicated, internal IT person who manages their cybersecurity needs.

Managed security service providers (MSSPs), consultancies, and managed service providers (MSPs) have created vCISO services to fill this gap and aid enterprises in strengthening their cyber defenses.

Businesses can utilize them to strengthen their cybersecurity posture while paying for the agreed-upon scope of work, typically a small fraction of the cost of an in-house security specialist.

By releasing the first vCISO directory in the industry, Cynomi is facilitating easy access for businesses to this growing resource base.

More than 200 U.S.-based providers are listed in the vCISO directory at launch, with information about their specific services and the technological platforms they employ to develop and carry out their security policies.

The directory will be continuously updated and globalized to include providers from other countries.

According to David Primor, co-founder and CEO of Cynomi, “thousands of small and mid-sized businesses across the globe could benefit from the expertise and support of a traditional CISO, but on a more consultative or part-time basis.”

The vCISO services are helpful in this situation. Businesses can use our new directory to identify all vCISO service providers in one location and compare the advantages of the numerous readily available suppliers.

According to Chris Bevil, CISO of InfoSystems, an MSP based in Tennessee, United States, “a couple of years back we weren’t prioritizing our cybersecurity services, but then we started getting consistent security-as-a-service requests.”

“We concluded that creating a vital vCISO service was in our best commercial interest. This has significantly boosted our business in the current environment and established us as a top MSP in our area.

MSPs and MSSPs offering vCISO services that are not yet included in the directory can submit their details for consideration here. 

About Cynomi

By enabling MSSPs, MSPs, and consultancies to deliver vCISO services to SMEs at scale and give them proactive cyber resilience, Cynomi’s AI-driven platform empowers MSSPs, MSPs, and consultancies.

The vCISO’s work is streamlined by Cynomi’s platform, automating time-consuming manual tasks like risk assessment, compliance readiness, cyber posture reporting, customized security policies and remediation plans, and task management optimization. This is done by combining proprietary AI algorithms with CISO-level knowledge and expertise.

By assisting partners in bridging the cybersecurity skills gap and scaling their businesses, Cynomi enables them to introduce new services, upsell existing ones, and boost profits while lowering operating expenses.

With a channel-only focus and the mission that every business deserves a CISO, Cynomi was founded in 2020 and already supported more than 50 partners globally.

To learn more about Cynomi’s solution for MSPs, MSSPs, and cyber consultancies, visit www.cynomi.com.

Rotem Shemesh, VP Marketing, Cynomi
[email protected]


[ad_2]
Source link

Gmail icon finally gets the dynamic theming treatment

andreasc
-
0
Gmail icon finally gets the dynamic theming treatment
[ad_1]

Material You and dynamic theming arrived with Android 12, and Gmail was one of the first apps to receive support for it. Still, Google did miss one detail. That detail is the Gmail icon in the notification shade, but Google corrected its mistake, and finally pushed dynamic theming to that particular part of the app.

Gmail icon is finally getting the dynamic theming treatment from Google

The Gmail icon was always red in combination with either white or black, depending on your theme (light or dark). Now, the black and white outline for the Gmail logo remains untouched, but the background will get changed based on your wallpaper or settings.

The red part of the icon (the background), will change color, as shown by Android Police in the images below. That change will be visible in the notification shade, not the status bar, by the way, of course.

This change is a part of the latest Gmail app update

This change has been rolled out as part of Gmail app version 2023.05.28.54044.3362. That update should have landed on your device already, if it did not, it will soon enough, as it’s rolling out widely.

This is just a small change, but it will be noticeable from the notification shade. Reactions to this change go both ways, actually. I’ve seen people complaining about it on Twitter, and also praising Google for finally pushing this change out.

Some people got so used to the red+black/white combo for Gmail that they don’t want that to change. That is somewhat understandable, as it makes it easier to spot a specific notification if it’s always the same color.

Still, Material You and dynamic theming are Google’s thing now, and it was only a matter of time before this happens. We have no idea why it took Google so long to make the change.


[ad_2]
Source link

Europeans are seeing their Google Nest cameras go offline randomly

andreasc
-
0
Europeans are seeing their Google Nest cameras go offline randomly
[ad_1]

Google Nest cameras have become an integral part of most smart home systems in Europe and around the world. But recently, some European users have seen this piece of tech trip out. Now this is not a self-induced problem as users aren’t forgetting to turn on their cameras but more of a technical fault.

By saying that this is a technical fault, we don’t mean that its users can fix it by themselves. Folks at The Verge have also experienced this fault and have been able to point out that it’s something only Google can properly handle. This issue shouldn’t be taken lightly, as it poses a serious security threat to users.

In a bid to create awareness of this issue, users of the Google Nest cameras have come on the internet to explain what they are facing. Tons of users have come on various platforms to narrate how their Nest camera keeps going offline randomly. With the number of users in Europe facing this issue and coming out to speak of it, there is no way Google hasn’t got these complaints. But what exactly are they doing about the incessant complaints?

Nest cameras are going offline in Europe and Google responded

This issue isn’t just affecting a handful of users in Europe, as it’s plaguing many people. Platforms like Twitter, Reddit, websites (9to5Google), and Google Nest Community have seen users complain about this issue. Without any reason, Nest cameras will go offline whilst recording, but not show the live feeds from the recording.

Google Nest cameras are security products that help users keep an eye on activities around their property. They do this by actively recording the surroundings and syncing this live video with the users’ devices via the Google Home app. With the app showing some European users the offline status and not sharing live feeds, a user can tell what’s happening around their property.

Tom Warren, a senior editor with The Verge, was among those in Europe that had their Nest cameras go offline. To fix his cameras, he had to perform a hard reset, returning the cameras to their factory setting. According to his report, some other users have seen their cameras come back online after hours of showing offline on the Google Home app.

To perform a factory reset to your Google Nest camera, simply go to the Home app and tap on the camera button. This will pull up an interface to view what your camera is recording. Now tap on the settings icon at the top of the interface. On the settings page, select the forget device option at the end of the page.

Then grab your Nest camera and find the reset button at the back of the camera. Press and hold the reset button for a while until the lights go off. After the reset, you can connect the camera back to your Google Home app and it should function properly.

Google is aware of this issue, as a spokesperson claims it has been resolved. However, some users in Europe might still be facing this issue, posing a threat to their home security system. If you are facing this issue, simply hard reset your camera or wait till Google’s fix arrives for your Nest camera.


[ad_2]
Source link

Samsung Health offers free fitness classes thanks to new Les Mills partnership

andreasc
-
0
Samsung Health offers free fitness classes thanks to new Les Mills partnership
[ad_1]

Samsung has just announced a new partnership with Les Mills to bring its customers even more free fitness lessons. The collaboration between the two entities will give access to fitness classes exclusive to Samsung Health via the Samsung Smart Hub. More importantly, these classes are exclusively free to new and existing Samsung customers and are available on 2020-2023 TV models.No less than 14 Les Mills classes, 35 minutes each, are now available for free to Samsung customers. Not to mention that these more than a dozen free classes cover a wide range of styles, including BODYPUMP 118, BODYCOMBAT 93, BODYATTACK 112, and much more.

Additionally, Samsung fans can take part in Less Mills’ Summer Sizzle Fitness Challenge. However, if you want to participate, you have to hurry since you can only apply until the end of the month. Simply access the Challenge row on Samsung Health and complete 10 of the free Les Mills workouts to win.

The partnership between Samsung and Les Mills also allows users to see their performance and statistics in real time on their Galaxy Watch. Also, it’s possible to connect your Galaxy smartphone to access Match Fitness, as well as view yourself on the big screen as you work out.

According to Samsung, the content on Samsung Health will be refreshed throughout the year, so customers should expect new partnership to be announced in the coming months.


[ad_2]
Source link

A full timeline of the MOVEit cyber attack

andreasc
-
0
A full timeline of the MOVEit cyber attack
[ad_1]

Ransomware gang Clop, which has taken responsibility for the cyber attack launched against document transfer service MOVEit, has announced that it has not stolen data from companies thought to be impacted by data breaches linked to the attack. These companies include the UK’s British Broadcasting Company (BBC), British Airways and high street health and beauty retailer Boots.

Since June 14, Clop has been posting company profiles of companies allegedly impacted by data breaches caused by the cyber attack against MOVEit. These posts are an attempt to pressure victims into paying a ransom to the gang. So far, the names, company addresses and websites of almost 50 victims have been added to the site, but no confidential data has yet been leaked.

Of the companies named on the site, prominent British companies thought to have had data stolen during the breach of payroll provider Zellis – including the BBC, BA and Boots – were not included.

In emails exchanged with the BBC, Clop claimed to have never had access to this data, saying they even told Zellis that they had not breached these companies.

“We don’t have that data and we told Zellis about it. We just don’t have it. We are an old group and have never deceived anyone, if we say that we do not have information, then we do not have it,” the gang told the BBC.

When asked by the BBC for more information on the breach, Zellis said it could “confirm that a small number of [its] customers have been impacted by this global issue and [the company is] actively working to support them”.

How did the MOVEit cyber attack happen?

The cyber attack against MOVEit saw ransomware gang Clop exploit a critical zero-day vulnerability in MOVEit’s infrastructure. This allowed the malicious actors to break into multiple company networks and steal data. 

The vulnerability was flagged by security researchers and the US government on June 1. The US Cybersecurity and Infrastructure Security Agency (CISA) urged all MOVEit clients to check for indications that malicious actors had gained unauthorized access to their networks over the past 30 days and to download and install the software patch released by MOVEit to address the issue.   

On June 5, payroll provider Zellis announced that it had been affected by the MOVEit cyber attack, and that a “small number” of its customers had suffered data breaches as a result of this. These victims were originally thought to include the BBC, Boots and BA, however on June 21 Clop claimed that they never had access to this data.

A number of victims, including accounting firm PwC, British watchdog Ofcom and Health Service Ireland made statements in the days and weeks following the cyber attack that they had suffered a data breach linked to it.

Ransomware gang Clop later took ownership of the cyber attack by attempting to exploit its victims. In a post on the gang’s Telegram channel, the malicious actors demanded victims pay them by June 14, or their data would be released.

Starting from this day, they released information including company names, address and websites on their darknet site in an attempt to convince the victims to contact them and pay them money to not release their data.

A timeline of the MOVEit cyber attack

June 1: MOVEit’s vulnerability is flagged by cyber security researchers and the US government. MOVEit issues a patch for the software vulnerability.

June 5: Payroll provider Zellis announces that it was impacted by the MOVEit cyber attack. Companies including the BBC, Boots and British Airways suffer data breaches as a result.

June 7: Ransomware gang Clop issues a threat to victims to contact them by June 16, or their data will be posted online.

June 7: CISA and the FBI announces a US$10 million reward for “information linking the Clop gang or any other malicious cyber actors targeting US critical infrastructure to a foreign government”.

June 8: Professional services network and accounting firm, Ernst & Young (EY) announces that it was impacted by the MOVEit cyber attack. As a result, Health Service Ireland (HSE) suffered a data breach.

June 12: British communications watchdog Ofcom announces that it was a victim of the MOVEit cyber attack, causing a data breach that affected 412 employees.

June 14: Clop begins to post the profiles of companies allegedly breached during the cyber attack launched against MOVEit on its data leak website. Clop does not leak any of the stolen data.

June 19: Accounting firm PriceWaterhouseCoopers (PwC) announces it was impacted by the MOVEit cyber attack

June 21: Clop claims to not have access to data from the BBC, Boots and BA that was thought to be stolen in the MOVEit cyber attack 


[ad_2]
Source link
1...1,1511,1521,153...1,480Page 1,152 of 1,480