The Aftermath of the eBay Cyber-Attack and the Lessons to be Learnt…

In May it was announced on news sites such as the BBC and SkyNews that the popular e-commerce site eBay was breach late February and early March. The breached database contained phone numbers, addresses, date of birth, other personal data and encrypted passwords. The company never disclosed how many of the 148 million active accounts were affected but, has asked all active users to change their passwords. The hackers infiltrated the network by obtaining, a small number of employees’ login credentials. Luckily the hacker did not access eBay subsidiary, Paypal’s financial database because it was stored on a separate network.

The Aftermath

Since the news many customers have complained and criticised the way the situation was handled, Attorney Generals in at least 3 states in the US has begun investigating the cyber-attack incident. Users was also outraged that eBay waited 2 weeks before publishing the breach after they found out, their explanation was:-

“For a very long period of time we did not believe that there was any eBay customer data compromised,” commented the Global Marketplaces Chief Devin Wenig shortly after the news was announced.

After promising they will make password resets mandatory on the website, it was days before this was carried out and for users that wanted to change their passwords after the initial announcement, they were unable to because the site struggled with the abnormal number of reset requests. Both of these factors added to the negative feelings amongst eBay users.

In a bid to assure customers they released a statement saying they have seen no indication of increased fraudulent account activities on the site but, it would seem eBay has missed the point as the main concern is… what the cybercriminals can potentially do with the non-encrypted information they stole like the numbers, addresses, date of birth, etc. – so the question is, why wasn’t this personal data encrypted like the passwords?

Considering eBay is responsible for a vast amount of personal data, you would assume they have a better incident response and management, breach detection, network admin login protection, and communication practices.

The most important lessons to take from this data incident is that good IT security practices for networks is essential for all businesses, regular network security assessments are required, educate staff on security and have good crisis management.

Breaches can happen to any company and poor incident response and management can just be like rubbing more salt to the wound, with the potential to create more long-term brand reputation damage.

For more information on IT network security practices and services please feel free to contact us on 0845 603 5552

Advertisements

Netshield to Discuss How Vulnerable Businesses are to Cyber Threats

Managed ICT Services Provider Netshield on the 24th April 2014, will be discussing the issue of Cyber Threats and different types of IT protection methods at a seminar held at the British Embassy in Brussels.

Working with UK Trade & Investment (UKTI) in Belgium Richard Carty, Commercial Director at Netshield will discuss why ICT Security needs to be a high priority, the common threats and ways in which organisations can protect their network and data.

The seminar will be aimed at organisations operating in sectors such as legal, financial, recruitment and the service industry and will take place on the 24th April 2014, at the prestigious British Embassy in Brussels from 9.30 – 13.00 (Central European Time).

‘ICT security is a growing concern with an increasing trend of professional services being a target for malicious behaviour, due to the high levels of business data they hold. The seminar will provide insight to the current threat landscape, security risks of current technological trends and protection methods’ commented Richard Carty.

The seminar will also include a live security breach demonstration from our guest speaker Rodrigo Marcos from SecForce and discussions on data security from a Legal perspective by Paul Van den Bulck, McGuireWoods.

‘We are delighted that the British Ambassador Jonathan Brenton, Paul Van de Bulck Partner at McGuireWoods and Rodrigo Marcos at SecForce will be able to join us to discuss the topic of ICT security and examine how exposed are businesses to the cyber threat in the changing workplace environment. With majority of businesses reliant on technology and data to be operational it emphasises why a secure ICT network is essential’ added Richard Carty.

For more information or to register click here

Beware of the Microsoft Voice Phishing Scams!

The number of reports of fraudsters calling people and pretending to be Microsoft Support Technicians in voice phishing scams is on the increase. The fake Microsoft support technician would call advising they need to remote onto the user computer to deal with a call that has been logged or to fix an issue the user is unaware about.

Do not let these malicious people onto your system if they remote onto your system, they can:-

  • Install malicious software to steal and capture sensitive data, like your banking information
  • They could direct you to fraudulent websites and ask you to input your credit card details
  • Ask for credit card details for authenticating reasons and then use the information to charge you for the fake services
  • They can adjust the system settings making it vulnerable and available for them to access in future.
NetFlix Phishing Scam

Netflix Phishing Scam leads to Fake Microsoft Tech Support

But, beware these voice phishing campaigns are becoming more elaborate; for example there has been reports the scammers would impersonate other popular companies like Netflix in order to direct the victim to a fake Microsoft support agent.

It is very rare that Microsoft would contact end users directly especially, when you haven’t personally logged a support call with them.

If you do receive a call from a so-called Microsoft Technician you can ask the following questions to help determine whether it is a phishing campaign:-

  • the name of the person that logged the support call with them?
  • the telephone number they are calling from?
  • their name?
  • the Microsoft support case reference number?

Genuine Microsoft Technicians would have the answers to these questions. If it is a genuine call Microsoft technician they would provide a support case reference number and ask for the person who logged the call immediately. Also Microsoft will never ask for credit card details during a support call and would provide their contact name and telephone number willingly.

Voice Phishing

A BBC news article also reported bank and courier voice phishing complaints have increased in the latter part of 2013. It states that the fraudsters tend to target some of the most vulnerable people within society and the average age of victims is 70 years old.

So, act with caution if you receive a call from someone claiming they are from banks, police, utility companies and asking you for personal information like pins, payment, account details, credit card numbers etc. These malicious people are trained to be convincing so, even if they provide you with a number for you to call back on don’t do it! This is because once you put down the phone the criminal can keep the line open at their end so, when you call the number, you are unknowingly connected directly back to the fraudster!

Conclusion

It is sad to think fraudsters have the ability to take advantage of our trust, fear and innocence, to persuade us to part with our personal information. Voice Phishing is not likely to go away anytime soon and judging from the recent NetFlix story they are likely to become more elaborate.

So, be vigilant and do not trust unsolicited calls and treat them like phishing emails, just hang up and go about your day. Whatever you do not provide them with any personal information.