Kathleen Maxted
Oct 9, 20202 min
Another interesting week for cyber security, including a new phishing technique and a ransomware 'vaccine'. Keep reading to find out about all the biggest stories in cyber security from around the world.
1. A card-skimming attack has compromised Boom! Mobile's website.
Mobile network operator Boom! Mobile's website became the victim of a Magecart campaign. On Monday, it was discovered that the firm's US website had been compromised and is actively being used to harvest shopper information. Magecart is a term to describe credit-card skimmer attacks and the cyber threat groups who use this method. Boom! Mobile has not yet responded to the attack, and shoppers are currently still at risk.
2. A new phishing method using HTML attachments is bypassing email security.
A new phishing scam was discovered earlier this week which is avoiding detection. Criminals are bypassing email security by using a fake website attached to the email itself as an HTML attachment. Typically, in a phishing campaign, the fake website would be reached by clicking a link. Researchers are urging people to avoid opening HTML attachments and be extra cautious of phishing emails during this time.
3. Asian food delivery service Chowbus has suffered a significant data breach.
Just two months ago, the start-up company received $33 million in funding from investors to create an app to connect diners with Asian restaurants. The data breach will have significantly damaged the reputation to Chowbus due to the severity of the leak. Customers were sent a link to a file which contained 800,000 rows of data, with over 400,000 unique emails. It has been reported that due to the way the data was leaked, it was probably the result of a "disgruntled employee or ex-employee". Chowbus customers are being advised to change their account passwords and implement two-factor authentication immediately.
4. A new ransomware vaccine program named "Raccine" has been released.
Released at the beginning of the week was a ransomware "vaccine" program. Typically ransomware infections delete shadow volume copies to prevent files from being recovered, shadow volume copy snapshots are where windows stores backups of your system and data files. The vaccine program works by terminating processes which try to delete shadow copies using Microsoft's vssadmin.exe program. Although this method can help prevent encryption from a large number of ransomware, some modern ransomware is still able to delete shadow volumes using other commands.
5. Hackers have targeted Swiss universities to steal employee salaries.
Three Swiss universities were targeted by threat actors who managed to drain employee salary transfers. The hackers started by carrying out spear-phishing attacks against the universities so that employees were tricked into providing their access data. The amount stolen is rumoured to be a six-figure amount and immediately moved the funds abroad. The umbrella organisation "Swissuniversities" sent a warning email to encourage universities to keep guard.