Stay ahead of the headlines

Aug 2, 2024·cyberscoop

The Senate Homeland Security and Governmental Affairs Committee has advanced three key bipartisan cybersecurity bills, moving them towards full Senate consideration. The "Streamlining Federal Cybersecurity Regulations Act" seeks to harmonize conflicting federal cybersecurity rules to ease the regulatory burden on the private sector. The "Healthcare Cybersecurity Act" aims to enhance collaboration between the Cybersecurity and Infrastructure Security Agency and the Department of Health and Human Services to strengthen cyber defenses in the healthcare sector. Lastly, the "Federal Cyber Workforce Training Act" focuses on developing a centralized resource and training center to improve the federal cybersecurity workforce, leveraging private sector and academic expertise. All bills were passed with a 10-1 vote, with opposition from Sen. Rand Paul over concerns about increased spending. The full Senate vote schedule has not yet been determined.

Aug 2, 2024·cyberscoop

Microsoft has taken control of the domain rockcaptcha.com, which was used by a trio of Vietnamese individuals to sell CAPTCHA bypass services and create fraudulent accounts, following a court order on July 23. This action is part of an ongoing investigation into the group, dubbed Storm-1152, responsible for generating around 750 million fake Microsoft accounts and facilitating various cybercrimes including ransomware and data theft. The group had resumed operations on a smaller scale after a previous disruption in December 2023, which had significantly impacted their activities. The use of AI to defeat CAPTCHA puzzles and generate fraudulent accounts is noted as an emerging trend in cybercrime. The seizure aims to further undermine the group's credibility and operational capabilities.

Aug 2, 2024·Chief Healthcare Executive

The recent worldwide computer outages, caused by a faulty software update from cybersecurity firm CrowdStrike, starkly highlighted the vulnerabilities in hospital systems. The impact disrupted access to electronic health records and led to postponed medical procedures. Experts underscored the need for robust response plans for such cyber incidents, emphasizing that these plans must be comprehensive, regularly tested, and updated to account for various scenarios, including long-term outages and key personnel unavailability. The Joint Commission advised hospitals to be prepared for critical systems being offline for extended periods and to involve multidisciplinary teams in the planning process. Hospitals must also be vigilant about their vendors' vulnerabilities and ensure they have contingency plans in place for vendor-related disruptions.

Aug 1, 2024·Automation.com

The use of surgical robots has significantly advanced modern healthcare by providing precision, reducing recovery times, and improving patient outcomes. However, these benefits come with increased cybersecurity risks. Ransomware and DDoS attacks can disrupt hospital operations, while unauthorized access can lead to harmful manipulations during surgeries. Data breaches pose substantial threats by exposing sensitive patient information. To mitigate these risks, healthcare organizations should implement multi-factor authentication, regular software updates, encryption, and strong access controls. Proactive and layered defense strategies are essential to ensure the safety and reliability of robotic surgical systems.

Aug 1, 2024·HealthExec

A recent IBM report reveals that healthcare remains the hardest-hit industry by cybercrime, seeing data breach costs of $9.77 million between March 2023 and February 2024. This represents a 10.6% drop from the previous year, yet healthcare still far surpasses the financial sector at $6.08 million. The report underscores that legacy technologies and high disruption vulnerability make healthcare a prime target. Additionally, the study observed a 10% increase in the global cost of data breaches, reaching $4.88 million, largely driven by business disruptions and customer support post-breach. Security AI and automation have proven effective in reducing breach costs by an average of $2.2 million. However, a significant gap in skilled cybersecurity staff persists, exacerbated by growing threats and the rapid adoption of generative AI technologies.

Aug 1, 2024·insurancebusinessmag.com

The article discusses the growing cybersecurity threats to medical devices and healthcare systems due to the increased connectivity brought about by the Internet of Things (IoT). These threats can jeopardize patient safety and compromise sensitive health data, as evidenced by instances like the FDA's recall of pacemakers and the significant data breach experienced by Change Healthcare. The risks are exacerbated by aging hospital infrastructure, particularly outdated MRI machines. Kirstin Simonson and Jennifer Ampulski from Travelers emphasize the importance of cyber insurance and robust cybersecurity practices throughout the supply chain, advising hospitals and healthcare providers to evaluate their partners' security protocols and leverage available resources to strengthen their defenses. Additionally, adhering to FDA guidelines and addressing misconceptions about cyber insurance coverage are crucial steps in mitigating these vulnerabilities.

Aug 1, 2024·bbc.com

Microsoft experienced a global outage affecting key products, including Outlook and Minecraft, caused by a DDoS attack compounded by inadequate defense implementation. The incident lasted nearly 10 hours, disrupting multiple services and causing widespread user complaints. The firm issued an apology and implemented a fix, committing to monitoring for full recovery. This event follows a recent major outage linked to CrowdStrike's flawed update. Services relying on Microsoft's platforms, such as Cambridge Water, HM Courts and Tribunals Service, and NatWest, were also impacted. The outages coincided with Microsoft's financial update, reporting weaker-than-expected growth in its Azure cloud services and a subsequent 2.7% share drop.

Aug 1, 2024·CNBC

Delta Air Lines has enlisted attorney David Boies to seek damages from CrowdStrike and Microsoft following a significant software outage that led to mass flight cancellations. The incident, stemming from a CrowdStrike software update, resulted in extensive disruptions across multiple industries, with Delta being particularly affected. CrowdStrike's shares plummeted by up to 5% in extended trading as a result, and the Department of Transportation is investigating Delta's failures. The outages caused Delta to incur estimated losses between $350 million to $500 million and generated over 176,000 refund requests. Insurance startup Parametrix estimated the total loss for Fortune 500 companies, excluding Microsoft, at $5.4 billion.

Aug 1, 2024·KrebsOnSecurity

New research reveals that over a million domain names, including those registered by major Fortune 100 firms, are susceptible to being hijacked due to weak authentication methods employed by various web hosting providers and domain registrars. The issue stems from "lame" DNS records, which happen when a domain's authoritative name server lacks sufficient information to resolve queries. This vulnerability allows cybercriminals to assume control of these domains without accessing the legitimate owner’s account, a method previously exploited in high-profile cases to send bomb threats and phishing emails. The research, conducted by Infoblox and Eclypsium, notes that this has been an ongoing issue, with numerous DNS providers still failing to implement adequate domain ownership verification. The hijacked domains, termed "Sitting Ducks," are often used for malicious activities, including phishing and malware distribution. Despite some improvements and ongoing efforts by a few providers, more cooperation among all stakeholders and better regulatory measures are necessary to mitigate these risks.

Aug 1, 2024·wired

OpenAI has released its latest AI model, GPT-4o, to power the ChatGPT chatbot, highlighting its advanced capabilities while raising significant privacy concerns. The model's enhanced functions, like interpreting emotions and performing intricate tasks, amplify the amount of data it can collect, including personal information. Despite OpenAI's assurances through their privacy policy that collected data is anonymized and primarily used for improving services, experts worry about potential data misuse and privacy invasions. The company offers some user controls to limit data usage, but the collection scope remains vast, encompassing everything from user prompts to geolocation data. Users can manage their privacy settings to some extent, though doing so may reduce the chatbot's functionality.

Aug 1, 2024·Nextgov

The Cybersecurity and Infrastructure Security Agency (CISA) is preparing to manage an expected surge in cyber incident reports necessitated by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). A Government Accountability Office (GAO) audit confirmed that while CISA has met 13 of the 59 required reporting mandates, it still faces challenges handling the influx of reports due to limited technology and staff. CISA plans to develop new technical solutions, including an incident reporting portal and ticketing system, but budget constraints impede these efforts. The agency is also working to streamline reporting requirements and ensure efficient information sharing among federal partners to mitigate cybersecurity risks effectively.

Jul 31, 2024·arstechnica

Microsoft has urged VMware ESXi hypervisor users to address the CVE-2024-37085 vulnerability, which is exploited by ransomware groups to gain full administrative control over servers. Threat groups including Storm-0506 and Octo Tempest have used this flaw in post-compromise attacks to encrypt file systems and disable servers. The vulnerability allows any domain group named "ESX Admins" to automatically receive admin privileges, a flaw recently patched by VMware. Attackers have leveraged this in escalating privileges and deploying ransomware like Black Basta. Administrators are advised to prioritize patching this vulnerability and monitoring for suspicious domain group modifications.

Jul 31, 2024·paulconnelly substack

A cybersecurity leader's effectiveness is closely tied to their relationships with key business leaders such as the CIO, General Counsel, Head of Internal Audit, CFO, and CEO, as well as with the board of directors. The evolution of the role now often requires regular reporting to the board, especially in high-risk industries. Support from the board can influence senior leadership decisions on investment and priorities and establish organizational tone from the top. Key strategies for building a strong board relationship include understanding the board's oversight role, knowing each member's background, speaking their language, providing clear information on risks and actions, and using real examples to build credibility. Regularly updating and seeking feedback from the board, and engaging in activities like tabletop exercises, can deepen this critical relationship and enhance cybersecurity efforts.

Jul 30, 2024·Los Angeles Times

A recent Gartner survey highlights that chief information security officers (CISOs) who prioritize response and recovery alongside prevention deliver more value than those focused solely on prevention. The report suggests CISOs should develop cyber fault tolerance, minimize their toolsets to essential technologies, and build a resilient cyber workforce. Key recommendations include focusing on adaptive strategies for generative AI and third-party risks, eliminating redundant tools, and fostering a workforce culture that supports resilience and learning from failures. By embracing these strategies, organizations can better navigate the increasing prevalence and impact of cyberattacks.

Jul 30, 2024·nbcnews.com

CrowdStrike, a leading U.S. cybersecurity company, reported a breach where a hacker leaked internal data on hacker groups it monitors and threatened to reveal more sensitive information. The leaked data, which includes details on 244 hacker groups, largely mirrors CrowdStrike’s publicly available information but also allegedly contains “Indicators of Compromise” used by cybersecurity experts. The hacker, identified as USDoD, posted the data on BreachForums, a major hacker forum. This leak follows shortly after CrowdStrike admitted responsibility for a massive computer crash caused by a software update error, indicating no direct link between the two incidents. CrowdStrike stated that the stolen data was likely taken in June.

Jul 30, 2024·bleepingcomputer

A recent report by TRM Labs highlights that Russian-speaking cybercriminals dominated the ransomware landscape in 2023, accounting for 69% of the total illicit crypto proceeds, amounting to over $500 million. Major players like LockBit and BlackCat collectively collected $320 million in ransom payments. Additionally, Russian dark web markets represented 95% of global sales for illicit items and services, generating $1.4 billion in transactions compared to $100 million from Western counterparts. The report also noted Russia's significant role in cryptocurrency money laundering, with platforms like Garantex handling substantial amounts to fund military supplies from China for the conflict in Ukraine. TRM attributes this predominance to historical, regulatory, and geopolitical factors.

Jul 30, 2024·warontherocks

The article discusses the U.S. military's ongoing challenge to train and retain skilled cyber personnel and advocates for the creation of a dedicated Cyber Force as a long-term solution. Due to the slow process of establishing this new force, the article recommends interim measures to address current shortcomings. These include prioritizing specialization in cyber roles, providing job-specific training, redesigning career paths, and revamping incentive pay programs to better retain talent. The suggested changes aim to improve the Army's efficacy in cyber operations and prepare it for the future establishment of a Cyber Force.

Jul 30, 2024·pcmag.com

Microsoft has provided additional information regarding the recent crashes involving Windows and CrowdStrike software. The issue stemmed from a compatibility conflict that caused systems to crash, affecting users who rely on both Windows and CrowdStrike. Microsoft is currently working with CrowdStrike to resolve the problem and prevent future occurrences, while advising affected users to follow specific troubleshooting steps provided by the companies.

Jul 30, 2024·Becker's Hospital Review

A recent report by Parametrix Solutions estimates that the healthcare industry could face losses of $1.9 billion due to a CrowdStrike IT outage caused by a faulty software update on July 19. The update resulted in widespread Windows system crashes, significantly impacting the healthcare and banking sectors in the U.S. According to the report, 75% of firms in these sectors experienced direct financial impacts. The insights were derived from analyzing over 54 billion data points related to cloud service performance. Meanwhile, CrowdStrike CEO George Kurtz announced that over 97% of Windows sensors affected by the outage have been restored.

Jul 29, 2024·Wall Street Journal

Crowdstrike CEO George Kurtz attributed a global tech outage to a failure within Microsoft Windows systems. The disruption highlighted potential vulnerabilities in widely used software platforms, sparking discussions on the importance of robust cybersecurity measures and the need for increased resilience in technology infrastructure.