Information Technology Security

By Ionut Ilascu,  Bleeping Computer A faulty component in the latest CrowdStrike Falcon update is crashing Windows systems, impacting various organizations and services across the world, including airports, TV stations, and hospitals. The glitch is affecting Windows workstations and servers, with users reporting massive outages that took offline entire companies and fleets of hundreds of thousands of computers. According to some reports, emergency services in the U.S. and Canada have also been impacted. Worldwide outage By the time of the correction, though, many large organizations across multiple verticals had already been affected. Some reports say that CrowdStrike’s update impacted some 911 emergency service agencies in the state of New York (EMS, police, fire department), Alaska, and Arizona, as well as 911 services in parts of Canada. A 911 telecommunicator in Illinois said that they were “working off of paper until things come back.” There also reports that the health hotlin...

By Vilius Petkauskas,  Cyber News A German citizen is suing the European Commission for transferring citizens’ data from one of the Commission’s websites to the United States. In a twist of irony, the executive branch of the European Union (EU), the European Commission (EC), is being sued for violating the personal data protection laws it created. According to Europäische Gesellschaft für Datenschutz (EuGD), a Germany-based organization supporting consumers in the enforcement of legal claims over breaches of the General Data Protection Regulation (GDPR), a German consumer believes his right to the protection of personal data was violated. While the GDPR does not apply to European institutions directly, they have to follow a similar law that closely resembles the restrictive nature of the GDPR. Both sets of legislation were created with the help of the Commission. “When calling up the website […] and registering for an event offered there, the US cloud service in its function as web...

By Bill Toulas,  Bleeping Computer After hitting Germany, Taiwan, South Korea, Japan, the US, and the U.K. the Roaming Mantis operation moved to targeting Android and iOS users in France, likely compromising tens of thousands of devices. Roaming Mantis is believed to be a financially-motivated threat actor that started targeting European users in February. In a recently observed campaign, the threat actor uses SMS communication to lure users into downloading malware on their Android devices. If the potential victim uses iOS, they are redirected to a phishing page for Apple credentials.

By  Krebs On Security Authorities in the United States, Germany, the Netherlands and the U.K. last week said they dismantled the “RSOCKS” botnet, a collection of millions of hacked devices that were sold as “proxies” to cybercriminals looking for ways to route their malicious traffic through someone else’s computer. While the coordinated action did not name the Russian hackers allegedly behind RSOCKS, KrebsOnSecurity has identified its owner as a 35-year-old Russian man living abroad who also runs the world’s top Russian spamming forum. According to a statement by the U.S. Department of Justice, RSOCKS offered clients access to IP addresses assigned to devices that had been hacked: “A cybercriminal who wanted to utilize the RSOCKS platform could use a web browser to navigate to a web-based ‘storefront’ (i.e., a public web site that allows users to purchase access to the botnet), which allowed the customer to pay to rent access to a pool of proxies for a specified daily, weekly, or ...

By Vilius Petkauskas, Cybernews Darmstadt-based Entega and Meinz-based Mainzer Stadtwerke were attacked over the weekend. Both companies' websites were still down at the time of publishing this article. According to a tweet by Entega, the company was hit by an attack that mainly affected the firm's website and staff email accounts. Entega claims that critical infrastructure was not affected, and no customer data was leaked. Local media reported that Mainzer Stadtwerke also said that critical infrastructure suffered no damage, and no supply failures are expected. Both of the energy providers use the same IT solutions provider, Count+Care. The company's website was also inaccessible at the time of publishing. Several German wind farms were hit by cyberattacks in recent months. An attack forced Deutsche Windtechnik, a German wind turbine maintenance and repair company, to turn off its IT systems. Another German wind turbine operator, Nordex, was hit by a cyberattack on the las...

By Bill Toulas,  Bleeping Computer The Spanish police have announced the arrest of 13 people and the launch of investigations on another seven for their participation in a phishing ring that stole online bank credentials. The threat actors used phishing lures to trick their victims into believing they received an alert from their bank and proceeded to steal their account credentials. Having access to banking accounts, the adversaries used their victims' money to make online purchases, direct transfers to "money mule" accounts, or request personal loans. The police say the threat actors stole at least 443,600 Euros ($466,000). from approximately 146 victims as part of these phishing attacks. "The operation, carried out in several phases between January 2019 and April of this year, has ended with the arrest of 13 people -and another 7 investigated but not detained- in A Coruña, Córdoba (5), Huelva, Madrid (2), Málaga, Murcia, Palma de Mallorca and Terrassa (Barcelona)....

By Bill Toulas, Bleeping Computer The Romanian national cyber security and incident response team, DNSC , has issued a statement about a series of distributed denial-of-service (DDoS) attacks targeting several public websites managed by the state entities. The attack has been claimed by a pro-Russian group calling themselves Killnet . They targeted servers that host public sites with a high number of requests or high volumes of data, essentially depleting their processing resources and causing them to become unavailable. All websites are currently working. According to the DNSC announcement, attackers targeted the following websites: gov.ro (official website of Romania's Government) mapn.ro (official website of Romania's Ministry of Defense) politiadefrontiera.ro (official of Romanian Border Police) cfrcalatori.ro (official website of Romania's National Railway Transport Company) otpbank.ro (site of a commercial bank operating in Romanian)  DNSC is now collaborating with ot...