British Airways breach

Not what you want to see when you’ve just paid for a holiday!

As reported across major news networks over the world, British Airways has suffered a data breach that not only includes customer data but also includes payment details. Details from 380,000 customers have been accessed by an unauthorised third party. More details can be found on news sites such as:

https://www.theregister.co.uk/2018/09/06/british_airways_hacked/

https://www.bbc.com/news/uk-england-london-45440850

It’s likely that attackers have compromised a web service which is linked to payment services, however no specific details have been released yet so until then we can only speculate.

In this post we look at the information reported by British Airways, guidance for customers from BA, ourselves and NCSC but also we discuss the steps business’s should be taking to ensure they have a strong security posture, especially where customer data is concerned. Read more “British Airways breach” →

Threat Week 04-08-2018

Welcome to another threat update, this week we look at some interesting twitter dumpster fires and a highly targeted ransomware campaign

Unbackable wallets – would you trust your funds with this device?

You got root sir but that’s not a hack! The world turns upside-down and inside out when @cybergibbons and a band of hackers go on rage mode at the claims from John McAfee and BitFi that their wallet is un-hackable and the ‘restrictions’ placed on the bug bounty.

https://twitter.com/officialmcafee/status/1024385313966379010

Use a password manager, no really!

@ingnl caused some fun when they recommend not using password managers which went down well with the twitter infosec community. Just so everyone is aware, we recommend using a password manager.

Read more “Threat Week 04-08-2018” →

July Threat Update

Welcome to another Threat Week update, today we are going to look at some of the active threats in the wild and in the news.

Top Threats

Attack Vectors

Common attack vectors are still the usual suspects. Phishing, drive by infections, insecure internet exposed services (e.g. FTP, RDP, SSH, web services etc.) We’ve seen phishing attacks using legitimate services such as Zoho CRM to hijack their mail domain to bypass mail filters, so again good education plus technical controls are the best defence against these attacks.

Firewall Analysis

Xservus run a vulnerable lab which hosts honeypots, web services and is used to detect threats. The following graph showcases external threats detected. Read more “July Threat Update” →

Welcome to Threat Week!

Welcome to the first instalment of threat week, the concept of threat week is to provide regular updates on threats, vulnerabilities, security news to provide you with a service that cuts through the noise and enables you to improve the security of your organisation.

To give people an idea of the content we will be producing we’ve published the following below. The concept is to tailor the content to your specific organisation as we’ve been doing with our customers. To start this process, after your subscribe one of the team will be in touch to discuss your specific requirements.

Vulnerabilities

Vmware releases patches for ESXi, Fusion and Workstation to remove data leakage vulnerabilities!

https://www.vmware.com/uk/security/advisories/VMSA-2018-0016.html

Hackers are targeting CISCO CVE-2018-0296

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd

Threat Trends

Threat Trend – Ransomware declines whilst Crypto mining malware becomes king of the hill for attackers

http://www.newsweek.com/crypto-mining-malware-outbreak-infected-500000-computers-single-day-836145

Security News

Ticketmaster breach – Most of you will be aware that Ticketmaster was involved in a cyber incident. The NCSC has published guidance for customers who suspect their account have been compromised.

https://www.ncsc.gov.uk/guidance/ncsc-advice-ticketmaster-customers

Read more “Welcome to Threat Week!” →