Author: rescue@crimefire.in

Andriy Onufriyenko/Getty Images

By Edward Graham
The State Department should conduct a “comprehensive evaluation” of federal agencies’ efforts to assist partner nations with combating cybercrimes, according to a report from the Government Accountability Office released on March 1.
GAO’s review—which was requested by lawmakers on the Senate Foreign Relations Committee and the House Foreign Affairs Committee—examined “federal efforts to build the capacity of allies and partner nations to combat cybercrime,” including some of the challenges with capacity-building initiatives and what federal agencies are doing to assist international partners in building out their own cyberdefense and investigative capabilities. 
The report found that the departments of State, Justice and Homeland Security “have been assigned lead roles” in working with partner nations to combat cybercrimes, including through a host of cooperative, legal, strategic and training initiatives. While GAO noted that these agencies “have documented accomplishments for many activities, such as nations joining international treaties aimed at combating cybercrime,” it found that they have “not comprehensively evaluated [their] collective efforts.”
GAO said that State is in the best position to conduct this evaluation, since the agency “is authorized to provide foreign assistance funding to help build key allies’ and partners’ capacity to combat cybercrime.” The evaluation, the report added, should focus on “how these activities have contributed to overall capacity building.” 
“Without such evaluations, State cannot ensure that agencies’ individual activities or case-specific accomplishments are contributing to long-term success in improving foreign nations’ ability to more effectively combat cybercrime,” GAO said.
Beyond the need for a comprehensive evaluation to review agencies’ efforts, the report also identified “mutual challenges in building global capacity to combat cybercrimes.” These included concerns about “the lack of available resources and difficulty in retaining trained individuals,” as well as “the rapidly evolving technological landscape and inconsistent definitions of ‘cybercrime.’”
“Both agency officials and international experts noted that the lack of an agreed upon definition for what constitutes cybercrime, within governments and globally, presents a barrier to tracking data on the current scope and prevalence of cybercrime,” the report said.
Experts and officials also expressed concerns about the U.S. government’s ability to effectively support international partners with their anti-cybercrime efforts, with the report noting that “State officials commented that the federal government’s own capacity, such as availability of experts, to deliver assistance to foreign partners and international law enforcement, is a challenge.”
Some of the challenges international allies noted in working with the U.S. government included “difficulty obtaining information, lack of communication, limitations regarding the use of funds and difficulty disseminating classified intelligence.”
GAO noted, in part, that some DHS officials interviewed for the report “agreed that most international law enforcement entities are unaware of how to request funding information,” and added that “these international law enforcement entities rely on State’s field point of contact to navigate the various layers of formal requests.”
In its one recommendation, GAO said that State should “conduct a comprehensive evaluation of capacity building efforts to counter cybercrime.” State concurred with GAO’s recommendation.
NEXT STORY: Ransomware Payments Decreased in 2022 as Criminals Used Other Extortion Tactics
Do Not Sell My Personal Information
When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.
Manage Consent Preferences
Strictly Necessary Cookies – Always Active
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data, Targeting & Social Media Cookies
Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link
If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.
Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.
If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Cookie List
A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:
Strictly Necessary Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Functional Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Performance Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Social Media Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Targeting Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Help us tailor content specifically for you:

source

BERLIN (AP) — German police said Monday they have disrupted a ransomware cybercrime gang tied to Russia that has been blackmailing large companies and institutions for years, raking in millions of euros.
Working with law enforcement partners including Europol, the FBI and authorities in Ukraine, police in Duesseldorf said they were able to identify 11 individuals linked to a group that has operated in various guises since at least 2010.
The gang allegedly behind the ransomware, known as DoppelPaymer, appears tied to Evil Corp, a Russia-based syndicate engaged in online bank theft well before ransomware became a global scourge.
Among its most prominent victims were Britain’s National Health Service and Duesseldorf University Hospital, whose computers were infected with DoppelPaymer in 2020. A woman who needed urgent treatment died after she had to be taken to another city for treatment.
Ransomware is the world’s most disruptive cybercrime. Gangs mostly based in Russia break into networks and steal sensitive information before activating malware that scrambles data. The criminals demand payment in exchange for decryption keys and a promise not to dump the stolen data online.
In a 2020 alert, the FBI said DoppelPaymer had been used since late 2019 to target critical industries worldwide including healthcare, emergency services and education, with six- and seven-figure ransoms routinely demanded.
An analyst with the cybersecurity firm Emsisoft, Brett Callow, said DoppelPaymer has published data stolen from about 200 companies, including in the U.S. defense sector, which resisted payment. And given DoppelPaymer’s suspected connection through Evil Corp to the FSB — the successor to Russia’s KGB spy agency — “the bust could provide law enforcement with some exceptionally valuable intel,” he said.
Dirk Kunze, who heads the cybercrime department with North Rhine-Westphalia state police, said at least 601 victims have been identified worldwide, including 37 in Germany. Europol said victims in the United States paid out at least 40 million euros ($42.5 million) to the gang between May 2019 and March 2021 to release important data that was electronically locked using the malware.
The group specialized in “big game hunting,” said Kunze, and ran a professional recruitment operation, luring new members with the promise of paid vacation and asking applicants to submit references for past cybercrimes.
He said police conducted simultaneous raids in Germany and Ukraine on Feb. 28, seizing evidence and detaining several suspects.
Three further suspects couldn’t be apprehended as they were beyond the reach of European law enforcement, Kunze said.
German police identified the fugitives as Russian citizens Igor Turashev, 41, and Irina Zemlyanikina, 36, and 31-year-old Igor Garshin, who was born in Russia but whose nationality wasn’t immediately known.
Turashev is wanted by U.S. authorities since late 2019 in connection with cyberattacks carried out using a predecessor to DoppelPaymer, known as BitPaymer, that is linked to Evil Corp. The U.S. government offered a $5 million reward in 2019 for information leading to the capture of its alleged leader, Maxim Yakubets.
___
Frank Bajak in Boston contributed to this report.

source

The deadline is approaching for Washington State University employees to complete cyber security awareness training on Skillsoft Percipio, following the recent revisions to WSU Executive Policy 37 (EP37).
In accordance with the goals of EP37, all employees, including faculty, staff, students, and part time workers, are required to complete designated cyber security trainings within six months of:
Moving forward, all employees will also be required to complete designated cyber security trainings annually. The due date for completing next year’s session will be one year from the most recent completion date.
At this time, students without employee affiliation do not have the option to complete security awareness training.
Policy changes establish high-level requirements for safeguarding the confidentiality, integrity, availability, and privacy of institutional data and the protection of WSU information systems, services, and devices that collect, store, process, share, or transmit institutional data.
Throughout fiscal year 2022, Information Technology Services (ITS) technical teams and security systems detected:
To arm users against the common cyber threats ITS identified, cyber security awareness training teaches how to identify phishing attempts, false URLs, malicious senders, and other potential online dangers.
By enhancing their cyber awareness knowledge and learning how to combat security risks that threaten the safety of individual and institutional information, WSU employees will help reduce the risk of cyberattacks and set a new standard for the university’s cyber security maturity.
For technical assistance, please contact the Crimson Service Desk via email at crimsonservicedesk@wsu.edu or phone at 509-335-4357.
Tomorrow’s Honoring Undergraduate and Graduate Scholars Symposium in Toppenish, Washington represents an ongoing alliance between the two universities while helping graduate students improve their mentoring skills.
Tomorrow’s Honoring Undergraduate and Graduate Scholars Symposium in Toppenish, Washington represents an ongoing alliance between the two universities while helping graduate students improve their mentoring skills.
WSU Regents Professor Diane Cook has been inducted into the American Institute for Medical and Biological Engineering College of Fellows.
WSU Director of Athletics Pat Chun asked U.S. lawmakers to partner with the NCAA to develop federal standards for NIL opportunities now available to student-athletes.
President Kirk Schulz discussed WSU’s mission of providing students access to a quality education with Executive Vice President and Chancellor of WSU Spokane Daryll DeWald during the State of the University address.
The 40th annual WSU Fashion Show imagines the past, present, and future through student-made apparel collections, 7 p.m. Friday, March 31, at Beasley Coliseum.
Snohomish County leaders announced their proposal to set up a research and development site focused on sustainable aviation fuels at Paine Field Airport at a press conference Tuesday morning.
Subscribe to WSU Insider to receive free daily updates by email. University employees are automatically subscribed—no sign up is necessary.
WSU Director of Athletics Pat Chun asked U.S. lawmakers to partner with the NCAA to develop federal standards for NIL opportunities now available to student-athletes.
President Kirk Schulz discussed WSU’s mission of providing students access to a quality education with Executive Vice President and Chancellor of WSU Spokane Daryll DeWald during the State of the University address.
Food safety, WSU stories, science answers for kids, and more—listen to podcasts from Washington State University.
A selection of programs about Washington State, produced by alumni and friends.

source

IBM’s long history as a tech industry leader includes inventing many technologies we use today—from the UPC bar code to the SQL programming language and its research and development in the industry also led to the development of personal computers. This Fortune 500 tech giant in recent years has focused on training the next generation of workers, introducing programs like IBM SkillsBuild. 
In 2021, IBM pledged to skill 30 million people worldwide by 2030, and through its SkillsBuild offering, learners can take free courses online in topics like cybersecurity, artificial intelligence, data analysis, and more. 
“We are focused on reaching people who have traditionally been left out of the tech sector: women, veterans, refugees, neurodivergent people, underrepresented minorities, and economically disadvantaged people,” Lydia Logan, IBM global vice president for education and workforce development, tells Fortune.
Many of the foundational courses can be completed in less than 10 hours, which makes for a good starting point for learners who may be considering a career switch. This could mean a leg up for candidates looking to break into the tech industry—and cybersecurity in particular, where there’s more than 700,000 open positions in the U.S.
“Any time demand is high and supply is low, there are opportunities for individuals. We’re in an exciting time,” Logan says. “Companies like IBM are dropping the four-year degree requirement for a lot of positions. We’re looking at people who have talent and who have shown interest and ability.”
Upon completion of a SkillsBuild course, learners earn a digital credential for their work. Plus, the holidays can be a great time to learn a new skill, Logan says.
“It’s another way to signal to employers that even if you’ve never had that kind of a job before, what you know and are able to do,” she says. “It’s a way to give people a bite-sized experience and make them more attractive as potential employees.”
Logan recommends four foundation courses that provide a high-level overview of the topic, as well as information about the skills needed to succeed. In these courses, learners also have the opportunity to do real-world projects with IBM partners upon completion of a course. And the following courses can be useful for people who are looking to learn a new skill or to potentially make a career switch:
Cybersecurity is one of the most in-demand fields; the U.S. Bureau of Labor Statistics reports that the information security analyst role is one of the fastest-growing in the U.S. Between 2021 and 2031, the number of information security analysts is projected to grow 35%, making it the eighth-fastest-growing occupation in the U.S. Plus, many entry-level cybersecurity roles offer six-figure salaries. 
“If you think about it, we have personal data everywhere,” Logan says. “It’s really important to have people in place who are working on the internal policies, education of employees, and making sure that they’re protected against potential bad actors.”
The Cybersecurity Fundamentals course offered by IBM teaches learners cybersecurity concepts, objectives, and practices and even includes information about the cyber job market. The course focuses on cyber attacks, cryptography, and security strategies and includes case studies. It takes six hours to complete.
The importance of artificial intelligence is growing. In fact, 94% of business leaders agree that AI is critical to success during the next five years, according to a Deloitte report published in October 2022. 
Some of the top jobs in AI are machine learning engineers, data scientists, and business intelligence developers. These workers make more than $100,000, on average, according to several job marketing platforms. 
IBM’s course focuses on AI concepts including natural language processing, computer vision, machine learning, deep learning, chatbots, and neural networks. Participants will also learn about the importance of ethical AI and its applications. The course takes about nine hours to complete.
This course can be a way for people to get a feel for the tech industry—and potentially pursue a job in data analytics, which are “low hanging fruit,” Logan says. “There are plenty of good-paying, entry-level jobs as data analysts.”
This seven-hour course focuses on data analytics, data science, programming languages, and the data ecosystem. Learners even get a chance to see how to clean, refine, and visualize data in IBM Watson Studio, which helps data scientists, developers, and analysts build, run, and manage AI models, according to IBM.
Participants also get an introduction to job outlooks in the field. Job growth for data scientists from 2021 to 2023 is much faster than other occupations at 36% growth, according to the U.S. BLS. These workers earn more than $100,000 median base salaries.
This course focuses on IT basics, including troubleshooting and tools that IT professionals use. Learners also focus on computer basics, networking, hardware, software, and computer security. Participants practice helping a customer use a simulated remote connection tool.
Like the other courses, learners are also introduced to the job outlook for IT professionals. IT support salaries are roughly $60,000, according to the BLS. Many of these professionals also work to upskill and eventually move into data-focused roles, some of which are mentioned above. Learners can complete this course in just over 10 hours, and earn a credential upon completion. 
These digital credentials “help to beef up your resume if you don’t have experience on the job already,” Logan says. “This shows that you’ve taken initiative and it shows that you’re willing and ready to do what it takes to be a successful employee at a tech company.”
Check out all of Fortune’s rankings of degree programs, and learn more about specific career paths.

source

Analytics Insight
Bitcoin Dip Impending with Dogetti as the Top dog in a Meme Nation.
Why Might A Presale Be The Best Time To Invest In Cryptocurrency? A Look At Dogetti, Ethereum, And Fight Out
Crypto vs AI: US Chipmaker Nvidia Says AI More Valuable Than Crypto – Bitcoin & Big Eyes Coin Stay On Course In Upward Movement, Ethereum Dips Ahead Of Upgrade
Dogecoin (DOGE) and Solana (SOL) rallies are short-lived. Experts Predict DigiToads (TOAD) Rally to exceed 1000%
Megamind: Bridging the Gap Between Digital Vision and Reality with Technological Services
The 10 Most Innovative Blockchain Companies to Watch in 2023
The 10 Most Innovative Tech CEOs Revamping the Future
The 10 Most Impactful Chief AI Officers of the Year 2022
No products in the cart.

As the frequency of cybercrimes and security breaches rises in today’s digital environment, new hazards appear, demanding the hiring of cybersecurity professionals by organizations. The cyber security courses expose you to put appropriate measures in place to avoid or control any security breaches and safeguard your company’s critical data. 
One can learn the fundamentals to help protect yourself and your organization against cyberattacks through these courses. At this point, Harvard introduced some cyber security courses and Harvard-Approved Cybersecurity Courses are in high demand. These Cyber Security courses will teach you how to avoid and protect against Cyber Security threats and improve your skills and help you learn more in the fields of cyber security and related topics like preventing cyber-attacks, browsing securely, artificial ignorance, Social Engineering Toolkit (SET), risk management, etc. These Cyber Security courses will help delegates to begin their career as Cyber Security professionals in multinational companies.
Conclusion: The importance of cyber security is rising in the modern world, where numerous organizations experience cyberattacks every year so it is important to know these, the top 10 cyber security courses that are approved and offered by Harvard university that you can enroll in 2023. 
Disclaimer: The information provided in this article is solely the author/advertisers’ opinion and not an investment advice – it is provided for educational purposes only. By using this, you agree that the information does not constitute any investment or financial instructions by Analytics Insight and the team. Anyone wishing to invest should seek his or her own independent financial or professional advice. Do conduct your own research along with financial advisors before making any investment decisions. Analytics Insight and the team is not accountable for the investment views provided in the article.



Subscribe to our weekly newsletter. Get the latest news about architecture, design, city, and inspiration.
I have read and agree to the terms & conditions
Analytics Insight® is an influential platform dedicated to insights, trends, and opinion from the world of data-driven technologies. It monitors developments, recognition, and achievements made by Artificial Intelligence, Big Data and Analytics companies across the globe.

source

Photo: Omar Marques/SOPA Images/LightRocket via Getty Images
LastPass CEO Karim Toubba said in a blog post Wednesday he takes full responsibility for his company's communications failures about recent cybersecurity incidents.
The big picture: LastPass, a password manager with roughly 30 million users, has been called out by customers for sharing limited information about two cyber incidents that happened in August.
Catch up quick: In the last six months, LastPass has gone back on how serious its recent cybersecurity incidents have actually been.
Driving the news: This week, the company shared in a difficult-to-find security advisory that attackers initially gained access to LastPass' systems by targeting a key employee's home computer.
What they're saying: "The length of the investigation left us with difficult trade-offs to make in that regard," Toubba wrote in the post.
Details: In Wednesday's post, Toubba said attacks accessed sensitive customer data, source code repositories, internal company secrets and cloud-based backup storage locations.
Yes, but: Wednesday's blog post does not have the same level of details as the earlier advisories from LastPass that circulated earlier this week — although those advisories are linked in Toubba's post.
Between the lines: Toubba said the company has been deploying "several new security technologies across our infrastructure, data centers, and our cloud environments to further bolster our security posture" in recent months.
State of play: LastPass users' "master password" — the password users need to log into their account — are the only sensitive pieces of information attackers haven't accessed, in part because LastPass doesn't store that information to begin with.
Be smart: LastPass is advising users to make sure they're using a strong and unique master passwords and to evaluate the strength of the passwords stored in their other accounts.
Sign up for Axios’ cybersecurity newsletter Codebook here.

source

Getty Images/iStockphoto
The U.S. Marshals Service suffered a ransomware attack earlier this month where threat actors stole sensitive data, including the personally identifiable information of fugitives and some employees.
NBC News first reported the major breach Monday night, which was quickly followed up by additional media coverage. While USMS spokesperson Drew Wade, chief of the Office of Public Affairs, confirmed the ransomware attack and data exfiltration to multiple news outlets, including TechTarget Editorial, the agency did not release an official statement.
The incident continues trends TechTarget Editorial observed in January of ransomware attacks increasing against the public sector, though the USMS is one of the highest-profile government agencies to be victimized in some time.
Most significantly, Wade’s statement confirmed that on Feb. 22, the USMS briefed senior Justice Department officials, who “determined that it constitutes a major incident.”
Wade informed media outlets that the USMS first detected the ransomware and data exfiltration on Feb. 17, but the threat was limited to a “stand-alone USMS system” that was subsequently forced offline. An ongoing investigation revealed that the system contained sensitive law enforcement data including the personally identifiable information of fugitives, third parties and some employees.
In addition, it stored administrative information, though it’s unclear exactly what that entails. Attackers are known to leverage stolen administrative credentials to gain initial system access.
On the other hand, attackers did not obtain all critical information during the attack. NBC News correspondent Tom Winter said on Twitter Monday night that a senior law enforcement official confirmed that the breach did not expose the Witness Security Program. It appears most of the stolen data pertained to agency investigations.
“The [Justice] Department’s remediation efforts and criminal and forensic investigations are ongoing,” Wade said in the statement. “We are working swiftly and effectively to mitigate any potential risks as a result of the incident.”
As the forensic investigation is ongoing, questions remain around attack attribution, motive and the initial access point. Many ransomware groups that exfiltrate data post the information on public leak sites to pressure victims into paying. So far, there have been no reports of leaked USMS sensitive information or any ransomware group claiming responsibility for the attack.
Arielle Waldman is a Boston-based reporter covering enterprise security news.
With help from automation and AI, self-healing networks promise to detect, remediate and even predict network problems. But can …
SD-WAN technology has its fair share of risk factors, some of which include cost reduction and management. Find out how your IT …
This analysis by SD-WAN Experts compares some of the major single-vendor SASE options in the market, looking at strengths, …
In uncertain times, CIOs need to take appropriate measures to improve IT efficiency. These practical strategies can also …
IT investments underpin an organizational performance and help businesses gain a competitive edge. That’s why CIOs and IT leaders…
Some CIOs are redefining digital transformation, while others abandon the term. What comes next will feature smaller projects, …
Each organization’s cost to migrate to Windows 11 will be slightly different depending on existing licenses, so IT teams should …
The end-user experience monitoring market is chock-full of options that can be confusing to keep track of. Take a look at nine …
When organizations look for software and services that can help monitor users, customers and IT system functionality, they need …
Without proper planning, an organization could end up feeling trapped in its relationship with a cloud provider. Follow these …
A cloud-first strategy has its fair share of advantages and disadvantages. Learn how to avoid risks and build a strategy that is …
Google Cloud lets you use startup scripts when booting VMs to improve security and reliability. Follow these steps to create your…
The UK open banking sector is at a crossroads and suppliers need more certainty about its direction, says report
In what could represent a multimillion-pound bandwidth boost to Cardiff’s business offering, Welsh altnet reveals plans to bring …
The UK Competition & Markets Authority has become the first antitrust watchdog to express concerns over the impact Broadcom’s …
All Rights Reserved, Copyright 2000 – 2023, TechTarget

Privacy Policy
Cookie Preferences
Do Not Sell or Share My Personal Information

source

source

By Jess Weatherbed
LastPass says that a threat actor was able to steal corporate and customer data by hacking an employee’s personal computer and installing keylogger malware, which let them gain access to the company’s cloud storage. The update provides more information about how the series of hacks happened last year that resulted in the popular password manager’s source code and customer vault data being stolen by an unauthorized third party.
Last August, LastPass notified its users of a “security incident” in which an unauthorized third party used a compromised developer account to access the password manager’s source code and “some proprietary LastPass technical information.” The company later disclosed a second security breach in November, announcing that hackers had accessed a third-party cloud storage service used by the password manager and were able to “gain access to certain elements” of “customers’ information.”
On December 22nd, LastPass revealed that the hackers had used information from the first breach in August to access its systems during the second incident in November and that the attacker was able to copy a backup of partially encrypted customer vault data containing website URLs, usernames, and passwords. LastPass then advised its users to change all of their stored passwords as “an extra safety measure,” despite maintaining that the passwords were still secured by the account’s master password.
Now, LastPass has revealed the threat actor responsible for both security breaches was “actively engaged in a new series of reconnaissance, enumeration, and exfiltration activities” between August 12th and October 26th. During this time, the attacker stole valid credentials from a senior DevOps engineer to gain access to shared cloud storage containing the encryption keys for customer vault backups stored in Amazon S3 buckets. Using these stolen credentials made it difficult to distinguish between legitimate and suspicious activity.
It’s suspected the hacker accessed the private computer via Plex media software installed on the machine
Just four DevOps engineers had access to the decryption keys needed to access the cloud storage service. One of the engineers was targeted by exploiting an (undisclosed) vulnerable third-party media software package on their home computer and installing keylogger malware. Ars Technica reports that the computer was likely hacked through the Plex media platform, which similarly reported a data breach shortly after LastPass disclosed its first incident in August.
Plex has provided a statement to The Verge addressing these claims. “We have not been contacted by LastPass so we cannot speak to the specifics of their incident. We take security issues very seriously, and frequently work with external parties who report issues big or small using our guidelines and bug bounty program,” said Scott Hancock, VP of Marketing at Plex. “When vulnerabilities are reported following responsible disclosure we address them swiftly and thoroughly, and we’ve never had a critical vulnerability published for which there wasn’t already a patched version released. And when we’ve had incidents of our own, we’ve always chosen to communicate them quickly.”
“We are not aware of any unpatched vulnerabilities, and as always, we invite people to disclose issues to us following the guidelines linked above,” added Hancock. “Given recent articles about the LastPass incident, although we are not aware of any unpatched vulnerabilities, we have reached out to LastPass to be sure.”
After installing the keylogger, LastPass says the threat actor “was able to capture the employee’s master password as it was entered, after the employee authenticated with [multifactor authentication], and gain access to the DevOps engineer’s LastPass corporate vault.” The company has since taken additional steps to secure its platform, including revoking certificates and rotating credentials known to the threat actor and implementing additional logging and alerting across its cloud storage.
Alongside the announcement, LastPass has published a complete list of the data that was compromised across both security breaches on a dedicated support page. BleepingComputer reports that LastPass has made efforts to conceal this information, however, noting that HTML tags had been added to the document to prevent the updates from being indexed by search engines. LastPass has additionally published a PDF containing further details regarding the incidents last year alongside two additional security bulletins — one for LastPass Free, Premium, and Families customers and another for business administrators — with recommended actions to secure your accounts.
Update, March 2nd, 2023, 4.00AM ET: Article updated with a statement from Plex.
/ Sign up for Verge Deals to get deals on products we’ve tested sent to your inbox daily.
The Verge is a vox media network
© 2023 Vox Media, LLC. All Rights Reserved

source

Your guide to a better future
You still need to take action to protect your data even though LastPass said it hasn’t seen any threat-related activity since October.
LastPass, one of the world’s most popular password managers, suffered a major data breach in 2022 that compromised users’ personal data and put their online passwords and other sensitive information at risk. 
On Dec. 22, LastPass CEO Karim Toubba acknowledged in a blog post that a security incident the company first disclosed in August eventually paved the way for an “unauthorized party” to steal customer account information and sensitive vault data. The breach is the latest in a lengthy and troubling string of security incidents involving LastPass, which date back to 2011. 
It’s also the most alarming.
The unauthorized party was able to gain access to unencrypted customer account information like LastPass usernames, company names, billing addresses, email addresses, phone numbers and IP addresses, according to Toubba. That same unauthorized party was also able to steal customer vault data, which includes unencrypted data like website URLs as well as encrypted data like the usernames and passwords for all the sites that LastPass users have stored in their vaults. 
In the meantime, LastPass has wrapped up an “exhaustive investigation” into the breach, according to a blog post published by Toubba on Wednesday, March 1, that updates customers on what actions the company has taken in the wake of the breach. Toubba vowed to make things right for customers and promised more effective communication going forward while adding that the company has “not seen any threat-actor activity since October 26, 2022.”   
Even so, if you’re a LastPass subscriber, the severity of this breach should have you looking for a different password manager, because your passwords and personal data can still be at serious risk of being exposed. At the very least, you need to change all of the passwords you have stored with LastPass right away if you haven’t already.
The company didn’t specify how many users were affected, and LastPass didn’t respond to CNET’s request for additional comment on the breach. But if you’re a LastPass subscriber, you need to operate under the assumption that your user and vault data are in the hands of an unauthorized party with ill intentions. Though the most sensitive data is encrypted, the problem is that the threat actor can run “brute force” attacks on those stolen local files. LastPass estimates it would take “millions of years” to guess your master password — if you’ve followed its best practices.
If you haven’t — or if you just want total peace of mind — you’ll need to spend some serious time and effort changing your individual passwords. And while you’re doing that, you’ll probably want to transition away from LastPass, too.
With that in mind, here’s what you need to do right away if you’re a LastPass subscriber:
1. Find a new password manager. Given LastPass’ history with security incidents and considering the severity of this latest breach, now’s a better time than ever to seek an alternative.
2. Change your most important site-level passwords immediately. This includes passwords for anything like online banking, financial records, internal company logins and medical information. Make sure these new passwords are strong and unique.
3. Change every single one of your other online passwords. It’s a good idea to change your passwords in order of importance here too. Start with changing the passwords to accounts like email and social media profiles, then you can start moving backward to other accounts that may not be as critical.
4. Enable two-factor authentication wherever possible. Once you’ve changed your passwords, make sure to enable 2FA on any online account that offers it. This will give you an added layer of protection by alerting you and requiring you to authorize each login attempt. That means even if someone ends up obtaining your new password, they shouldn’t be able to gain access to a given site without your secondary authenticating device (typically your phone).
5. Change your master password. Though this doesn’t change the threat level to the stolen vaults, it’s still prudent to help mitigate the threats of any potential future attack — that is, if you decide you want to stay with LastPass.
In August 2022, LastPass published a blog post written by Toubba saying that the company “determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information.”
At the time, Toubba said that the threat was contained after LastPass “engaged a leading cybersecurity and forensics firm” and implemented “enhanced security measures.” But that blog post would be updated several times over the following months as the scope of the breach gradually widened.
On Sept. 15, Toubba updated the blog post to notify customers that the company’s investigation into the incident had concluded. 
“Our investigation revealed that the threat actor’s activity was limited to a four-day period in August 2022. During this timeframe, the LastPass security team detected the threat actor’s activity and then contained the incident,” Toubba said. “There is no evidence of any threat actor activity beyond the established timeline. We can also confirm that there is no evidence that this incident involved any access to customer data or encrypted password vaults.”
Toubba assured customers at the time that their passwords and personal data were safe in LastPass’s care.
However, it turned out that the unauthorized party was indeed ultimately able to access customer data. On Nov. 30, Toubba updated the blog post once again to alert customers that the company “determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information.”
Then, on Dec. 22, Toubba issued a lengthy update to the blog post outlining the unnerving details regarding precisely what customer data the hackers were able to access in the breach. It was then that the full severity of the situation finally came to light and the public found out that LastPass customers’ personal data was in the hands of a threat actor and all of their passwords were at serious risk of being exposed. 
Still, Toubba assured customers who follow LastPass’s best practices for passwords and have the latest default settings enabled that no further action on their part is recommended at this time since their “sensitive vault data, such as usernames and passwords, secure notes, attachments, and form-fill fields, remain safely encrypted based on LastPass’ Zero Knowledge architecture.”
However, Toubba warned that those who don’t have LastPass’s default settings enabled and don’t follow the password manager’s best practices are at greater risk of having their master passwords cracked. Toubba suggested that those users should consider changing the passwords of the websites they have stored.
On March 1, Toubba published a new blog post offering customers a lengthy update on where the situation stands, what data was accessed and what steps LastPass has taken to shore up its security. In the blog post, LastPass also offered its own recommendations on what business customers as well as individual customers should do to protect their data.
The company has completed its investigation into the data breach and said that it hasn’t detected any unauthorized activity since October, according to the blog post. Also, in response to the breach, LastPass “prioritized and initiated significant investments in security, privacy and operational best practices” and “performed a comprehensive review of our security policies and incorporated changes to restrict access and privilege, where appropriate,” according to the blog post. 
The initial breach ended up allowing the unauthorized party to access sensitive user account data as well as vault data, which means that LastPass subscribers should be extremely concerned for the integrity of the data they have stored in their vaults and should be questioning LastPass’s capacity to keep their data safe — even considering the latest security improvements outlined by the company in its latest blog post.
If you’re a LastPass subscriber, an unauthorized party may have access to personal information like your LastPass username, email address, phone number, name and billing address. IP addresses used when accessing LastPass were also exposed in the breach, which means that the unauthorized party could also see the locations from which you used your account. And because LastPass doesn’t encrypt users’ stored website URLs, the unauthorized party can see all of the websites for which you have login information saved with the password manager (even if the passwords themselves are encrypted).
Information like this gives a potential attacker plenty of ammunition for launching a phishing attack and socially engineering their way to your account passwords. And if you have any password reset links stored that may still be active, an attacker can easily go ahead and create a new password for themselves. 
LastPass says that encrypted vault data like usernames and passwords, secure notes and form-filled data that was stolen remains secured. However, if an attacker were to crack your master password at the time of the breach, they would be able to access all of that information, including all the usernames and passwords to your online accounts. If your master password wasn’t strong enough at the time of the breach, your passwords are especially at risk of being exposed. 
Changing your master password now will, unfortunately, not help solve the issue because the attackers already have a copy of your vault that was encrypted using the master password you had in place at the time of the breach. This means the attackers essentially have an unlimited amount of time to crack that master password. That’s why the safest course of action is a site-by-site password reset for all of your LastPass-stored accounts. Once changed at the site level, that would mean the attackers would be getting your old, outdated passwords if they managed to crack the stolen encrypted vaults. 
For more on staying secure online, here are data privacy tips digital security experts wish you knew and browser settings to change to better guard your information.

source