In this weekly blog, we’ll compile the top cyber news you need to know from the week before and provide an easy breakdown so you can get the news you need and skip the fluff you don’t.
Don’t Buy a Car This Week: CDK Global Dealership Software Shut Down
Bloomberg News is reporting hackers based in Eastern Europe are claiming the cyberattack on CDK Global, a software management company used by thousands of auto dealerships. CDK proactively took their systems offline to protect their clients. The software helps dealerships manage vehicle acquisitions, sales, financing, insurance, repairs, and maintenance – so basically running the whole show.
What You Need to Know:
Over 15,000 auto dealerships across North America resort to handwritten forms to continue operations. The attack is ransom-based, and CDK is expected to pay to get their systems back online. National dealers like AutoNation, Penske, and Lithia Motors have experienced disruptions. Cliff Steinhauer, an official at the National Cybersecurity Alliance, said the attack has “significantly slowed down” the auto retail industry. The hacking group BlackSuit is behind the attack.
Implications:
“Premier Truck Group has implemented its business continuity response plans, and continues to operate at all locations through manual or alternate processes,” said a spokesperson for Penske. Penske was the only one to make this comment out of all the dealers listed in various articles. Business continuity planning is vital for your business or organization’s cybersecurity and resilience. If you want to stay open when everyone else isn’t, we can help.
Kraken Got Kraken-ed: Threat Actors Seize $3M in Digital Assets from Crypto Exchange
Crypto exchange Kraken received a notification on June 9 through their Bug Bounty program from a “security researcher” who claimed to have found an “extremely critical” bug that allowed them to artificially inflate their balance. Unlike many false flags, however, this one was indeed an isolated bug, allowing a malicious attacker to initiate a deposit onto the platform, then receive funds in their account without fully completing a deposit. The bug was verified and closed within 47 minutes. However, the “researcher” and two associates had leveraged the flaw to seize $3 million in assets from Kraken’s treasuries – that they’re now refusing to return.
What You Need to Know:
Bug bounty programs are not a new concept. They are an incentive-based concept, where IT or IT-based businesses incentivize legimitate researchers to seek out any bugs or flaws, exploit them enough to provide proof of concept, and then return any “ill-gotten gains.”
Implications:
This situation reveals the down-side which is the ability for “researchers,” aka hackers, in this instance, who are masquerading as “the good guys.” Bug bounty programs give white hat hackers “license to hack.” They’re trying to find vulnerabilities before the legitimate bad guys do. But not following the rules for the program you’re participating in does essentially make legal hackers criminals – and that’s how Kraken is treating this.
Threat Actor IntelBroker Posts Apple Internal Source Code
Threat actor IntelBroker posted source code to three different tools Apple uses on the dark web. This breach has been sourced to internal tools used by Apple in internal environments. No private user data is believed to have been compromised.
What You Need to Know:
The breach has landed Apple in an investigation by the European Union for allegedly breaking tech rules violating GDPR. In addition to the breach, Apple is also under investigation for their recent business models and contractual language, which appears to discourage app developers not sponsored by the company.
Implications:
Apple isn’t the first of the “big tech” companies to land themselves in hot water for allegedly creating preferential environments for their own development. For instance, the FDC slammed Facebook/Meta with a $5 billion fine for privacy violations in 2019, 20x larger than any data security fine imposed to date. There are several key legal battles that are expected to be decided in 2024, which will decide the future of competition, content moderation, artificial intelligence, and more. This includes the several years-long anti-trust trial(x2) against Alphabet Company/Google.
Los Angeles Department of Health Discloses Data Breach
LA Department of Health disclosed the data of more than 200,000 individuals, as the result of a phishing campaign which compromised 53 emails of public health employees. Endpoint users are always going to be the weakest point in your security policy, which is why security awareness training is so important.
What You Need to Know:
The department serves roughly 10 million people in the LA area. This breach disclosed private data, including:
- First and last name
- Date of birth
- Diagnosis and prescription information
- Medical record number/patient ID number
- Medicare or Med/Cal number
- Health insurance information
- Social Security number and other financial information
Implications:
Alone, the PII disclosed in this breach will have massive implications for those 200,000 citizens. The Personal Health Identity Information (PHII), however, creates the ability for longterm compromise using the medical records.
Why is PHII such a high target for hackers? It allows actors to obtain false prescriptions, which can then be resold for street value. (One Oxycontin has a street value of $15, which would make one 30-day supply worth $450.) They can even use these records to receive fraudulent reimbursement payments. This means the real patient not only pays for the service, but when they seek the reimbursement they are rightly owed, they’re denied, because the system will show the reimbursement has already been paid.
Cyber attacks aren’t just focused on capturing information. While the score is a thrill for hackers, it’s also about the further profit that can be gained from that information.