Archive for the ‘computer security software’ category

Almost One Third U.S. Businesses breached in 2017

December 26th, 2017

Twenty-nine percent of U.S. businesses were affected by a data breach in the 2017. The analysis was done by HSB of 403 senior executives in the U.S., and conducted by Zogby Analytics.

Company reputation gets a hit after the breach says two third of respondents. The amount spent was $5,000 and $50,000 to respond to a breach as per the twenty seven respondents. Thirty  percent said they spent between $50,000 and $100,000.

Fifty one percent mentioned that lack of knowledge is the reason behind the success of the attack.

“The results highlight how closely our economy and society are interconnected digitally,” HSB vice president Timothy Zellman said in a statement. “Almost all of our personal and business data can be accessible on the Internet through online business connections, websites and social media. And that exposes our private information to attacks from hackers and cyber thieves.”

Another survey conducted by Balabit of 222 IT executives and IT security professionals shows that 35 percent of respondents see themselves as the largest internal security risk to networks within their companies. IT staff has higher rights than other users.

The report also has below findings –

Forty seven percent of respondents mentioned that the time and location of login, followed by private activities using corporate devices (41 percent), and biometrics identification characteristics such as keystroke analytics (31 percent) is the most important user data for spotting malicious activity

“As attacks become more sophisticated, targeted attacks and APTs more commonly involve privileged users inside organizations — often via hacks involving stolen credentials,” Balabit security evangelist Csaba Krasznay said in a statement. “Today, IT security professionals’ tough job has become even tougher. It is not enough to keep the bad guys out; security teams must continuously monitor what their own users are doing with their access rights.”


AlertSec ACCESS is a patent pending technology. It is designed to enforce that devices are encrypted before access to a network is granted. 

Cyber Attacks

December 25th, 2017

Austin Manual Therapy mentioned that they suffered data breach due to unauthorized access to its system. As per the reports, limited parts of the system were accessed. There is no data which shows that the attack was also carried on the organization’s core EHR system.

“Despite conducting a comprehensive forensic analysis, we have very little evidence as to what documents or information the attacker was able to access or steal,” Austin Manual Therapy stated. “We know that the attacker was able to access one of our computers and a shared file system.”

Affected information included addresses, phone numbers, occupations, dates of birth, insurance policy information, insurance coverage and eligibility information, charge amounts, dates of service, driver’s license information, diagnosis, health screening information, referring physician information, and full or partial Social Security numbers.

As per the OCR tool, total 1,750 individuals may have been affected.

“While our investigation is substantially complete, it remains ongoing and will likely continue through the end of the year,” Austin Manual explained. “We also have implemented and are continuing to implement additional security measures designed to prevent a recurrence of this type of attack, to quickly identify unusual activity, and to further protect the privacy of your information.”

CA Facility Data Breach

California-based Stanislaus County Behavioral Health and Recovery Services (BHRS) mentioned that it suffered data breach due to a ransomware attack.

“The network has been shut down and isolated from the County-wide network while online services and communication are being provided by other means temporarily, and client care has continued,” read a Stanislaus County statement from December 15, 2017.

Stanislaus County said that it has previously mitigated ransomware attacks, but this time “the particular techniques used in this attack were able to get past the security mechanisms that are in place.”

“All BHRS computers are being held in quarantine to prevent any further infection,” the statement read. “No breech of personal information has been detected at this time.”

Stanislaus County did not mention the affected number of individuals.

BHRS has more than 400 employees and provides services “for about 14,000 adults and children, including mental health services and help with overcoming addictions.”


AlertSec ACCESS is a patent pending technology designed to check that devices are encrypted before access to a network is granted.

Devices and Data Breach

December 24th, 2017

Pennsylvania-based Washington Health System (WHS) Greene mentioned that it suffered data breach due to missing external hard drive.

The device was used for Bone Densitometry machine. Facility mentioned that data of patients who underwent bone density studies at WHS Greene from 2007 until October 11, 2017 may have been present in the hard drive.

Affected information included certain patient information which includes patient names, height, weight, race, and gender information, medical record numbers and health issues may have been included for some patients. Social Security and financial information were not present.

WHS Greene mentioned that there are no signs of information misuse.

“Washington Health System Greene is committed to maintaining the privacy and security of patient information, including regular review and evaluation of the security of all processes in place,” WHS Green stated. “This unprecedented situation has our full attention and please be assured that we have taken and will continue to take steps to ensure that a breach of this nature will not happen in the future.”

As per the OCR data breach reporting tool, total 4,145 individuals may have been affected.

Data sold online in another breach

New Jersey-based Chilton Medical Center recently mentioned that an employee removed a computer hard drive. The person sold it on the internet. Hard drive was sold in the last month.

Patients treated May 1, 2008 to October 15, 2017 may have had their information present on the device.

Affected information included patients’ names, dates of birth, addresses, medical record numbers, allergies, and medications the patient may have received at Chilton Medical Center.

“During our investigation, we determined that the former employee removed other devices and assets from Chilton Medical Center to sell on the internet in violation of policy,” the statement explained. “While we currently have no indication that any of these devices or assets contain patient information, we continue to investigate this incident and, if we determine additional patients are affected, we will notify them as appropriate.”


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.

Security Budgets After WannaCry, NotPetya Attacks

December 22nd, 2017

AlienVault conducted survey of 233 IT professionals worldwide. The report shows that only 14 percent increased budgets for cyber security after the WannaCry and NotPetya cyber attacks. Only twenty percent were able to apply changes or implement security projects that had previously been put on hold.

Only 16 percent mentioned that their company leadership and boards took interest in security after the attacks.

“WannaCry and NotPetya are generally believe to have marked a turning point in cyber awareness, but the reality on the ground paints a different picture,” AlienVault security advocate Javvad Malik said in a statement. “Destructive malware poses existential threats to companies across all industries and can no longer be ignored.”

“To improve our cyber resilience, corporate strategy needs to be developed that covers how to plan for, detect, mitigate and recover from such destructive attacks,” Malik added.

“The IT security profession remains a very tough place to work, where resilience is the key to success — particularly if you are blamed in the event of your company suffering a security incident,” Malik said.

Twenty percent said that IT advice is now taken seriously after the attacks.

Another survey conducted by Spiceworks shows that thirty two percent hope to look for another job.

Eight one percent mentioned that its critical to have cyber security expertise.

“Although the majority of IT professionals are satisfied with their jobs, many also believe they should be making more money, and will take the initiative to find an employer who is willing to pay them what they’re worth in 2018,” Spiceworks senior technology analyst Peter Tsai said in a statement.

“Many IT professionals are also motivated to change jobs to advance their skills, particularly in cyber security,” Tsai added. “As data breaches and ransomware outbreaks continue to haunt businesses, IT professionals recognize there is high demand for skilled security professionals now, and in the years to come.”


AlertSec ACCESS checks all computers and smartphones and detects all encryption types.

Keeper Security Patches Password Protection Flaw

December 19th, 2017

Google Project Zero security researcher Tavis Ormandy sent a email to Keeper Security about a new vulnerability. Company replied to Ormandy and delivered a patch within 24 hours to the users. The security issue is identified as “privileged UI injection into pages”.

“I’ve heard of Keeper, I remember filing a bug a while ago about how they were injecting privileged UI into pages,” Ormandy wrote in a bug report. “I checked and, they’re doing the same thing again with this version.”

The first time Ormandy informed Keeper Security of the privileged UI injection into pages” issue was in August 2016. At that time, Ormandy explained how the flaw could simply enable an attacker to steal passwords from Keeper users.

“This is a complete compromise of Keeper security, allowing any website to steal any password,” Ormandy wrote in his new advisory.

Keeper browser extension has this particular flaw.

“This potential vulnerability requires a Keeper user to be lured to a malicious website while logged into the browser extension, and then fakes user input by using a clickjacking and/or malicious code injection technique to execute privileged code within the browser extension,” Keeper wrote in its advisory.

Google Project Zero has a 90-day disclosure policy to publicly reveal the issue. But Keeper solved the issue in 24 hours.

Keeper browser extension has already been automatically updated.

“Assume that everything is hackable,” Jeff Bohren, Chief Software Engineer at Optimal IdM suggests.

Boren mentioned that users look for a password manager which is cloud based along with two-factor authentication.

“2FA does a good job of allowing only individual account owners access to their login credentials,” Bohren said. “If hackers do succeed in guessing a password, they must still breach additional authentication steps before they can reach important data.”


AlertSec ACCESS is a patent pending technology. It is designed to enforce that devices are encrypted before access to a network is granted. Encrypted devices secure your data in case a device is lost or stolen.

ICS Malware

December 16th, 2017

FireEye researchers mentioned that the company’s Mandiant subsidiary is attacked by new industrial control systems(ICS) malware. The hackers shut down plant operations by targeting emergency shutdown systems.

Schneider Electric’s Triconex Safety Instrumented System (SIS) controllers were targeted specifically. The researchers are calling the malware Triton. The operations were shut down during reconnaissance performance by attackers.

“FireEye has not connected this activity to any actor we currently track; however, we assess with moderate confidence that the actor is sponsored by a nation state,” the researchers wrote. “The targeting of critical infrastructure as well as the attacker’s persistence, lack of any clear monetary goal and the technical resources necessary to create the attack framework suggest a well-resourced nation state actor.”

Russian, Iranian, North Korean, U.S. and Israeli state actors may be behind the attacks. “Intrusions of this nature do not necessarily indicate an immediate intent to disrupt targeted systems, and may be preparation for a contingency,” the researchers mentioned.

Phil Neray, vice president of industrial cyber security at CyberX, mentioned that his company believes the targeted plant was in Saudi Arabia, which would likely mean that Iran was responsible for the attack.

“It’s widely believed that Iran was responsible for destructive attacks on Saudi Arabian IT networks in 2012 and more recently in 2017 with Shamoon, which destroyed ordinary PCs,”

Neray said. “This would definitely be an escalation of that threat because now we’re talking about critical infrastructure — but it’s also a logical next step for the adversary.”

Chris Morales, head of security analytics at Vectra, mentioned that an attack like this was all but inevitable. “The connectivity and integration of traditional information technology with operational technology — IT/OT convergence — is increasing exponentially,” he said.

“The IoT and IT/OT convergence is accelerated by the speed of business and the implementation of AI to drive decisions in ICS environments,” Morales added. “In addition, more ICS devices are running commercial operating systems, exposing ICS systems to a wider swath of known vulnerabilities.”


AlertSec ACCESS is a patent pending technology designed to check that devices are encrypted before access to a network is granted.

Ransomware Attacks in 2017

December 7th, 2017

As compared to 2016, the ransomware attacks hitting business users increased from 22.6 percent in 2016 to 26.2 percent in 2017. Kaspersky Lab conducted survey.

“Welcome to ransomware in 2017 — the year global enterprises and industrial systems were added to the ever-growing list of victims, and targeted attackers started taking a serious interest in the threat,” the report states. “It was also a year of consistently high attack numbers, but limited innovation.”

Significant businesses lost amount or data due to ransomware.Three massive ransomware outbreaks in 2017 are WannaCry, NotPetya and Bad Rabbit.

”The headline attacks of 2017 are an extreme example of the growing criminal interest in corporate targets,” Kaspersky Lab senior malware analyst Fedor Sinitsyn said in a statement. “We spotted this trend in 2016, it has accelerated throughout 2017 and shows no signs of slowing down.”

“Business victims are remarkably vulnerable, can be charged a higher ransom that individuals and are often willing to pay up in order to keep the business operating,” Sinitsyn added. “New business-focused infection vectors, such as through remote desktop systems, are not surprisingly also on the rise.”

Another report by Malwarebytes shows that the number of ransomware attacks in the first three quarters of 2017 is more than 2016 by 62 percent.

The report also shows that ransomware has largely replaced botnets.

“Knowledge of cybercrime and security best practices has to go across the organization, driven from the top down,” the report states. “With an endless array of potential vulnerability points, from reception to external vendors, an exchange of knowledge, awareness and insight is key to recognizing threats.”

“This idea of a CEO as a cyber security champion evokes an even bigger shift which can ultimately help businesses better protect themselves: treating cyber security as an investment in trust, rather than a way to prevent losses or costs.”


AlertSec ACCESS is a patent pending technology designed to check that devices are encrypted before access to a network is granted.

IoT Security Skills in Energy Companies

December 5th, 2017

Inmarsat survey of senior IT decision makers from 100 large energy companies worldwide shows that fifty four percent need additional security skills to deliver successful IoT projects. Fifty three percent need to make significant investments to fulfill requirements.

Other findings include-

Only two percent mentioned that IoT do not create new challenges

Thirty percent said they have given special consideration for IoT in security apparatus

Fifty nine percent mentioned that their board has insufficient knowledge of IoT

“The core operations of energy companies have traditionally been insulated from the destructive cyber attacks that have destablized other industries, as they were not connected to the Internet,” Inmarsat senior director for energy Chuck Moseley said in a statement. “But with the advent of IoT, more and more parts of their infrastructure are being connected, creating new vulnerabilities and risks.”

“Worryingly, our research shows that many energy businesses lack the security processes and skills to address these new vulnerabilities,” Moseley added. “This needs to be quickly addressed, and it must be driven by senior leadership within energy businesses, to ensure that they do not miss out on the huge potential value that IoT can bring to the energy sector.”

Another survey conducted by CyberX study of 375 industrial networks worldwide shows that thirty one percent are connected to the public Internet. Seventy six percent are running outdated and unpatchable operating systems like Windows XP and Windows 2000.

“Most of these ICS/SCADA sites were built years ago, long before the proliferation of Internet connectivity and the need for real-time intelligence,” the report states. “The key priorities were performance and reliability rather than security.”

“We don’t want to be cyber Cassandras — and this isn’t about creating FUD — but we think business leaders should have a realistic, data-driven view of the current risk and what can be done about it,” CyberX CEO and co-founder Omer Schneider said in a statement.


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.

New Google Patch for Android

December 2nd, 2017

Google released possibly its final Android security update for 2017. The latest patch addresses at least 42 different vulnerabilities which includes 11 flaws in the media framework (five are critical remote code execution issues).

“The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process,” Google warned in its advisory.

Libmedia and libstagefright components of the Android media framework is patched in every single security update provided by Google since August 2015. Google provided update every single month after the Stagefright vulnerability which was first publicly disclosed at Black Hat USA 2015.

“The state of the union for Android security is strong and I have spent time making sure it stays strong,” Adrian Ludwig said, the man who runs Android security for Google. “It’s not just about building a safe; it’s about building something that can react and respond to security quickly.”

In this new update, the critical remote code execution flaw in the system component is also addressed.

“We’re updating all Nexus devices — the Nexus 4, 5, 6, 7, 9 and 10 and even the Nexus players — and we’re patching for libstagefright,” Ludwig said. “This is the single largest mobile software update the world has ever seen.”

Security support will extend for three years from a time Nexus device appears in the market.

“The industry has looked at recent events and realized that it needs to move fast, and we need to tell people what we’re doing,” Ludwig said.

“The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process,” Google warned in its advisory.

Ludwig also mentioned that, “We’re taking an aggressive stance to see if an application is doing something wrong, and we’re working with the developers and the development process to make it right.”


AlertSec ACCESS is a patent pending technology designed to check that devices are encrypted before access to a network is granted.

IoT Security

November 30th, 2017

Healthcare organizations are now implementing connected medical devices for better services to patients. But healthcare technology leaders are worried about IoT security with connected devices.

Business technology professionals survey in healthcare shows that seventy one percent are skeptical towards IoT devices.

“Emerging technologies have to be embraced,” ISACA CEO Matt Loeb said in a statement. “As the research shows, the reluctance to deploy them is linked to the need to understand and mitigate the risks of doing so. Organizations that implement a strong information and technology governance program will better understand their capabilities, which leads to more effective risk management and increased confidence in deployment of these technologies.”

The survey also mentioned that forty seven percent do not consider their organizations’ head is digitally literate.

“The resounding message from our research is clear: senior leadership needs to invest in increasing its digital fluency,” Loeb said. “Organizations with digitally fluent leadership are more clearly recognizing the benefits and risks of emerging technologies.”

The trend shows that IoT devices are there to stay even there is resistance from senior leadership.

“[IoT] can also be remotely controlled and is highly automated across existing network infrastructure, resulting in improved efficiency, accuracy and economic benefit in addition to reduced human intervention,” researchers stated.

The research team also mentioned that there is variety of sectors and savings due to increasing automation. As per the Deloitte poll, the biggest cyber security challenge is to identify and mitigate potential risks in legacy and connected devices.

“Legacy devices can have outdated operating systems and may be on hospital networks without proper security controls,” said Russell Jones, Deloitte Risk and Financial Advisory partner, Deloitte & Touche LLP. “Connected device cybersecurity can start in the early stages of new device development, and should extend throughout the product’s entire lifecycle; but even this can lead to a more challenging procurement process. There is no magic bullet solution.”


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.