Table of Contents
Futile warnings?
Regarding the rate of cyber security violation and daily virtual assaults, the need to secure data online is more relevant than ever before. However, despite the emergence of ransomware, companies still have not learned their lesson. For example, Equifax breach resulted in the leak of more than 143 million Americans’ personal data: ranging from social security numbers to birth date details. Unfortunately, it is not the only case. London-based accountancy firm Deloitte faced the same destiny: data leaked, who’s to blame?
“Accidental” vulnerabilities in cyber security
You might be wondering why the companies could not protect the systems properly especially after WannaCry and Petya dashed away.
Indeed, such question may remain rhetorical. Elaborating on the Equifax case, the impact of a data breach is tremendous. Besides leaked security numbers and users’ names, hackers also took hold of 209 000[1] US consumers’ credit card information.
Unfortunately, British and Canadian limited personal data was also leaked. The company states that the vulnerability in the application, Apache Struts, is to blame for the breach. The Federal Trade Commission especially took an interest in this case.[2]
Basic protection measures
The Deloitte data breach case is no less intriguing as well. The company is London-based, though it has its branch office in New York. It was said to have earned $32 billion revenue within last year[3]. Therefore, it is no wonder why it became the next target. Despite the size of its company, its cyber protection measures are highly questionable if not ridiculous.
The felons were able to hack into administrator’s account, which only required a simple password and no two-step verification. The very attack took place in March 2017, though the fraudsters are believed to have gained the access since last year’s October. Besides users’ email addresses, passwords, and IP addresses, business architectural diagrams, and health-related information were leaked. Thus, it is not surprising if another WannaCry or Locky wave may roll out.
In some cases, such oversight may spark more than frustration. Can such frequent data breaches be related with “improper” supervision of cyber security by the very companies? In other words, do hackers break into the system without “inside” assistance? The case of M.E. Doc company, when it deliberately ignored warnings to patch security flaws, which eventually led to WannaCry outbreak, reinforces speculations.
Aiming at a big fish
There is a growing number of cyber criminals, who are no longer satisfied with breaking into small businesses or ordinary users’ computers. The analysis of the CCleaner v5.33 malware[4] suggested that the developers intended to spy on bigger companies.
The Floxif malware, which is technically a backdoor, collected information about victims’ computers and sent them to a remote command and control server. Further investigation revealed that it aimed at major companies, some of them are:
- Akamai;
- D-Link;
- Google;
- Intel;
- Microsoft;
- Samsung;
- Sony;
- VMware;
Though the National Cyber Security Centre, FBI, and SEC continue issuing warnings to the companies and the virtual community, it seems that some certain big companies, managing a big amount of users’ private data, still fail to take such alerts seriously. The question whether they do so on purpose remains unanswered.
COMMENTS