Ago 08, 2024 Marina Londei Approfondimenti, Attacchi, Attacchi, In evidenza, News, RSS 0

---

Il ransomware continua a spaventare le aziende di tutto il mondo, le quali devono vedersela non solo con la perdita di dati, ma anche col pericolo che vengano pubblicati sul web. I cybercriminali sanno che le imprese temono l’esposizione delle informazioni sensibili e sfruttano questo vantaggio per aumentare la pressione sugli obiettivi che si rifiutano di pagare.

A dirlo è la ricerca “Turning the Screws: The Pressure Tactics of Ransomware Gangs” di Sophos X-Ops, la quale evidenzia che i cyberattaccanti stanno usando nuove tecniche per costringere le vittime a pagare il riscatto, facendo pressione su di esse in ogni modo.

“Le gang di cybercriminali autrici di attacchi ransomware stanno diventando sempre più invasive e audaci su come e cosa colpire. Per aggravare la pressione sulle aziende, non si limitano a rubare i dati e a minacciare di diffonderli, ma li analizzano attivamente per massimizzare i danni e creare nuove opportunità di estorsione. Ciò significa che le organizzazioni non devono preoccuparsi soltanto dello spionaggio aziendale e della perdita di segreti commerciali o di attività illegali da parte dei dipendenti, ma anche dei danni collaterali di questi cyberattacchi“, ha dichiarato Christopher Budd, direttore della ricerca sulle minacce di Sophos.

I gruppi ransomware minacciano le vittime

In molti casi i gruppi ransomware condividono i dettagli di contatto degli amministratori delegati ed eseguono attacchi di doxing contro i membri della loro famiglia; inoltre, minacciano di riferire alle autorità qualsiasi informazione su attività commerciali illegali trovata nei dati, a danno della reputazione aziendale.

I cybercriminali spesso criticano apertamente le vittime e le deridono, additandole come entità poco etiche e negligenti; anche in questo caso si tratta di un danno di reputazione significativo e, agli occhi dei cittadini, i gruppi ransomware possono addirittura apparire come dei vigilantes dalla parte del giusto.

Il team di Sophos ha inoltre scoperto che i gruppi ransomware stanno sottraendo e pubblicando sempre più spesso dati estremamente sensibili, come informazioni sanitarie, immagini di nudo e, nel caso del gruppo Qiulong, anche i documenti della figlia del CEO dell’azienda colpita.

Dopo aver informato l’azienda di essere in possesso di questi e altri dati, alcuni gruppi incoraggiano i dipendenti a chiedere un risarcimento all’organizzazione per il danno subito e minacciano di contattare anche clienti, partner e concorrenti per informarli della violazione; tutto questo per aumentare la pressione sulle aziende e spingerle a pagare.

In un caso specifico, la gang Monti ha addirittura dichiarato di essere in possesso di prove riguardo un dipendente che avrebbe cerato materiale pedopornografico. Il gruppo ha pubblicato uno screenshot con la cronologia del browser del dipendente e una finestra PowerShell in cui si vedeva lo username del presunto colpevole. In un messaggio rivolto all’azienda, Monti ha affermato che se non avesse pagato avrebbero fornito queste informazioni alle autorità e le avrebbero rivelate al pubblico.

“Dal punto di vista degli attaccanti, fare riferimento a persone specifiche serve a tre scopi. In primo luogo, fornisce un “parafulmine” per qualsiasi accusa, pressione e/o controversia successiva. In secondo luogo, contribuisce alla minaccia di danni alla reputazione. In terzo luogo, gli attacchi personali possono minacciare e intimidire la leadership dell’organizzazione presa di mira” si legge nel report.

Il team di Sophos X-Ops prevede un aumento dell’uso di queste tattiche per fare pressione sugli obiettivi, oltre all’impiego di nuove strategie per aumentare il danno reputazionale in caso di mancato pagamento.

Oltre a stipulare un contratto di assicurazione che comprenda anche le minacce ransomware, le imprese devono lavorare per migliorare la propria postura di cybersecurity; ciò include l’uso di soluzioni Zero Trust Network Access, la segmentazione della rete, la riduzione della superficie di attacco, l’uso di metodi di autenticazione robusti e l’installazione tempestiva di patch.

---

---

---

https://www.securityinfo.it/2024/08/08/i-gruppi-ransomware-usano-i-dati-rubati-per-aumentare-la-pressione-sulle-vittime/?utm_source=rss&utm_medium=rss&utm_campaign=i-gruppi-ransomware-usano-i-dati-rubati-per-aumentare-la-pressione-sulle-vittime

Geopolitical threats have been a top security concern for years. Issues such as climate change increase the likelihood of severe weather, while the impact of international conflicts can be felt all over the world.

Closer to home, U.S. organizations also have to manage the risk of domestic terrorism. While far from a new issue, domestic terrorism has been a growing concern in the United States for the past few years. The current definition of domestic terrorism includes criminal acts dangerous to human life occurring in the U.S. that appear intended to coerce a civilian population or influence or affect the conduct of government.

The first National Strategy for Countering Domestic Terrorism was implemented in 2021. The initial 2021 analysis identifies two of the primary threats: racial and ethnic-based attacks, and anti-government-based attacks. The U.S. Government Accountability Office (GAO) found that from fiscal years 2013 through 2021, the Federal Bureau of Investigations’ (FBI) number of open domestic terrorism-related cases grew by 357% from 1,981 to 9,049.

In recent years, domestic terrorists have been lone actors or small groups of informally aligned individuals who mobilize to violence with little or no clear organizational structure or direction. The plan focuses on information sharing and prevention, with a goal of shutting down the various pathways that lead up to an attack. The strategy’s first priority is analysis and information sharing. This included research into past attacks and building proper communication networks between government organizations. In recent years, GAO has put out a report on the current domestic terrorism trends, including recommendations for the FBI and the Department of Homeland Security (DHS). According to GAO, the FBI tracks “investigations” and “disruptions”, while the DHS tracks “attacks” and “plots”.

Due to the rise in attacks, GAO provided a list of recommendations for both organizations. These recommendations included improving communication channels, both between the organizations and with the country as a whole.

Security leaders should pay close attention to these updates. This information is not only critical to government organizations, but any business that operates in a public space. Leaders should familiarize themselves with risk factors and work to develop a solid security plan. This can include strengthening access control and training employees in emergency response.

It’s important to consider cyber threats alongside any physical ones. Large-scale cyberattacks such as the one against MGM Resorts, have proven their ability to be disruptive. These kinds of attacks pose a different kind of risk, as they can be launched from anywhere in the country. Some threat actors take credit for their work, but some attacks can go unclaimed. Cyberattacks pose the risk of shutting down critical systems, such as hospitals, or revealing sensitive information to the public. It’s important for organizations to build out a cybersecurity strategy to protect themselves, especially if they handle any information a cybercriminal may want.

Important data to protect could include:

• Medical information
• Banking information
• Social Security Numbers
• Home addresses

Recently, unexpected targets have fell victim to cyberattacks. Ticketmaster recently suffered a ransomware attack that threatened to leak consumer payment information, as users often saved their card information to their account for a quick ticket-buying process. If any personal information is saved within a company’s system, there needs to be a plan to protect it.

Domestic terrorism is unfortunately a rising theat. As government agencies work to prevent future attacks, businesses need to work to keep themselves and their data safe.

https://www.securitymagazine.com/articles/100912-the-multi-faceted-threat-of-domestic-terrorism

The corporate security recruitment landscape of today looks quite different from that of 10 years ago. Technological advancements that benefit hiring companies and candidates alike have grown and their effect on recruitment has been noticed. It is interesting to evaluate how some recruitment practices have evolved to meet these challenges. Some of these shifts have been beneficial while others have created an impersonal, transactional environment.

Recruitment companies of all sizes around the globe adapt in diverse ways to the changing face of talent acquisition. Some of those firms that pre-dated the explosion of data/cybersecurity have either been sold, diversified into other recruitment sectors, or branched into unrelated businesses such as meetings or themed conferences to augment revenue.

Despite security’s heightened profile, corporate security executive roles remain in the minority within organizations. Internal human resources and talent acquisition departments often struggle to fill those positions as they recruit for them so infrequently. Social media and networking sites offer internal recruiters a source of potential candidates in areas they may not normally work, and in some instances can be a viable solution. Unfortunately, participants in the largest professional sites have started to shift their utilization. As a result, its members are more frequently sharing a wide range of personal endeavors, social activities and unsolicited, sometimes inappropriate, opinions.

Organizations that tend to hire a specialist security recruiter know that the same pool of candidates available to their internal recruitment team is available to the recruiter. It is our experience that many clients who hire us are doing so for just that reason. Rather than searching for only those candidates who have put themselves out there, they are seeking engagement with those passive candidates not normally found as a part of a keyword search. Further the response rate to an inquiry is significantly less.

The additional complication is that — by its very nature — security breeds caution. Many security practitioners are simply not comfortable with any of their personal data in the public domain. They may utilize social media for intelligence but would prefer to be absent from it themselves. We like to say that security professionals practice social monitoring vs. social media. As a result, large segments of security professionals are not accessible.

Another pushback to pure socialization of recruitment is hiring departments that factor in budget for outside recruitment support with the direct goal of bypassing their internal talent acquisition team. They recognize that limitations exist within their organization and are planning to accommodate the gap.

The silo effect that often exists in larger organizations is also a source of consternation to both clients and candidates. The functions that must come together to hire recruitment support often include the hiring department, procurement, human resources and any other stakeholders, some or all of whom can be in different countries. A specialist recruitment partner understands how each function comes into play and can better manage expectations for clients.

Security recruitment will continue to be valuable partners for hiring organizations for the foreseeable future. In addition to a keen understanding of the roles to be filled, we skillfully navigate our clients’ internal operations to put unique top talent in place for them. Recruitment partnerships yield impressive results for both security job seekers and the companies that hire them.

https://www.securitymagazine.com/articles/100913-understand-security-recruitment-to-advance-your-career

VIPRE Security Group has released its Q2 2024 Email Threat Trends Report. The report highlights the prevalent threat of business email compromise (BEC) attacks, stating that 49% of detected spam emails are categorized as BEC emails, and 40% of BEC emails are generated by AI. The report suggests that some AI-generated BEC emails may have been entirely created via AI. 

Security leaders weigh in 

Stephen Kowski, Field CTO at SlashNext Email Security+:

“The rise of AI-generated Business Email Compromise (BEC) attacks, as reported by VIPRE Security Group, aligns with our observations of a significant increase in sophisticated phishing lures over the past year. To combat this evolving threat landscape, organizations must adopt advanced threat detection solutions that leverage AI and machine learning to identify and block these increasingly convincing AI-generated scams in real-time. Additionally, implementing continuous security awareness training for employees and utilizing multi-factor authentication can significantly enhance an organization’s resilience against BEC attacks in the AI age.”

Nicole Carignan, Vice President of Strategic Cyber AI, at Darktrace:

“Despite increased focus on email security, organizations and their employees continue to be plagued by successful phishing attempts. With the increasing use of generative AI by threat actors, our dependency on traditional threat intelligence or rules and signature-based defense systems will diminish as threat actors can now rapidly adopt and change signatures, hashes and indicators of compromise to evade defenses.

“As the sophistication of phishing attacks continue to grow, organizations cannot rely on employees to be the last line of defense against these attacks. Instead, organizations must use machine learning-powered tools that can understand how their employees interact with their inboxes and build a profile of what activity is normal for users, including their relationships, tone and sentiment, content, when and how they follow or share links, etc. Only then can they accurately recognize suspicious activity that may indicate an attack or business email compromise.

“The malicious use of AI poses an increasing threat as it lowers the barrier to entry for threat actors to be able to deploy highly sophisticated attacks with ease and at scale. We can expect offensive AI to continue to be used throughout the attack life cycle, including the use of natural language processing or large language models by threat actors to craft contextualized spear-phishing emails at scale. In addition to phishing, we have also seen evidence of threat actors using generative AI to write malware scripts. Threat actors are also exploiting vulnerabilities within LLMs themselves (adversarial machine learning), allowing threat actors to misuse these for malicious purposes, such as script generation and targeted content generation.”

Pyry Åvist, Co-Founder and CTO at Hoxhunt:

“We’ve seen a significant uptick in attacks that are likely from a new generation of blackhat AI phishing kits available on the dark web. The prices of these kits are dropping and they produce phishing emails with comparatively better localized text, graphics and landing pages than the older generation phishing kits. 

“Meanwhile, evasive dynamic phishing kits are becoming more popular. I’d say that the rise of Adversary in the Middle (AitM) attacks is the most concerning trend we’re seeing involving blackhat AI. AitM is the future of cybercrime. It’s extremely effective and much harder to trace and prevent than traditional social engineering attacks. Their evasive techniques are fundamentally different from traditional static phishing attacks because they will intercept legitimate user traffic and deploy malware and malicious content that adjusts on-the-fly to the user’s context, making it very hard to identify. The trusty old URL-hover technique won’t reveal the malicious intent.

“The technical barrier that’s kept AitM from being widespread on the dark web seems to diminish by the month. Once the barrier is low enough, and the ROI is high enough, we’ll see a wave of breaches from AitM-integrated credential harvesters, BECs, and ransomware.

“Security awareness and phishing training must keep pace with all of the latest threats so people to find their telltales, and report them to the SOC. We must basically take a ‘trust but verify’ approach to literally every online interaction we have.”

https://www.securitymagazine.com/articles/100927-ai-is-responsible-for-40-of-business-email-compromise-bec-emails

Ago 07, 2024 Marina Londei Attacchi, News, Phishing, RSS 0

---

I ricercatori di Kaspersky hanno individuato un nuovo trend negli attacchi di phishing che usa lo spear phishing in campagne di phishing massive.

Questo tipo di phishing prende di mira individui specifici o piccoli gruppi con e-mail dal contenuto altamente personalizzato, con dettagli studiati e credibili. I messaggi imitano lo stile e il contenuto di comunicazioni legittime, provenienti da soggetti fidati, e sono confezionato con attenzione per superare i filtri di sicurezza.

Al contrario, le campagne massive di phishing mirano a colpire più utenti possibili e per questo le e-mail sono generiche, spesso con errori di battitura.

Alla fine del 2023, Kaspersky ha individuato un’anomalia statistica che combinava tattiche di spear phishing e pishing di massa: il volume di e-mail era troppo aggressivo per essere mirato, ma il contenuto era molto più sofisticato dei normali messaggi del mass phishing. In un caso, un’email da parte delle risorse umane si riferiva al destinatario usando il suo nome e nominando la sua azienda, ma il modulo allegato era un falso accesso generico a Outlook, caratteristica tipica del phishing di massa.

Kaspersky ha rilevato un aumento significativo di questi attacchi ibridi di phishing da marzo a maggio 2024. L’incremento, spiega il team di ricerca, indica che gli aggressori stanno usando tecnologie avanzate per ridurre i costi e gli sforzi di personalizzazione degli attacchi di massa; in particolare, grazie all’intelligenza artificiale è possibile generare un gran numero di e-mail con contenuti convincenti e senza errori di battitura.

“Gli aggressori stanno adottando sempre più spesso metodi e tecnologie di spear phishing nelle loro campagne di massa, il che porta a e-mail più personalizzate e a una gamma sempre più ampia di tecnologie e tattiche di spoofing. Nonostante si tratti di campagne e-mail di massa, questi attacchi rappresentano una minaccia significativa. Per combatterla è fondamentale implementare misure di protezione che tengano il passo con i progressi tecnologici e utilizzino una combinazione di metodi e servizi” ha commentato Roman Dedenok di Kaspersky.

Per proteggere le organizzazioni da attacchi di phishing, gli esperti di Kaspersky consigliano di formare i dipendenti affinché riescano a distinguere le e-mail legittime da quelle di spear phishing, usare soluzioni di protezione mirate per i server di posta e scegliere soluzioni complete e facili da gestire per proteggere l’infrastruttura, adatte anche alle PMI.

---

---

---

https://www.securityinfo.it/2024/08/07/un-nuovo-trend-di-phishing-usa-lo-spear-phishing-per-campagne-massive/?utm_source=rss&utm_medium=rss&utm_campaign=un-nuovo-trend-di-phishing-usa-lo-spear-phishing-per-campagne-massive

Ago 07, 2024 Marina Londei Attacchi, In evidenza, Malware, News, RSS 0

---

I ricercatori di Volexity hanno individuato una campagna malware a opera di StormBamboo, un gruppo di hacker cinesi, che ha compromesso un internet service provider (ISP) per distribuire payload malevoli su macchine Windows e macOS.

Conosciuto anche come Evasive Panda e StormCloud, il gruppo ha sfruttato diverse famiglie di malware per infettare una stessa rete. I cybercriminali hanno usato un attacco di DNS poisoning per compromettere l’ISP: il gruppo ha alterato le risposte alle query DNS per domini specifici, legati agli aggiornamenti software automatici.

I record DNS sono stati compromessi a livello di ISP per essere risolti in un server di Hong Kong controllato dagli attaccanti. Volexity ha immediatamente contattato l’ISP che ha riavviato la propria infrastruttura e messo offline alcune componenti, interrompendo il flusso d’attacco e la diffusione dei malware.

Modificando le risposte DNS, il gruppo è riuscito a redirezionare le richieste di update al proprio server e far installare alle applicazioni il malware. “Sembra che StormBamboo abbia colpito i software che usavano meccanismi di update non sicuri, come HTTP, e non validavano correttamente la firma digitali degli installer” spiegano i ricercatori. Quando queste applicazioni scaricavano gli aggiornamenti, in realtà installavano il payload malevolo.

Tra i malware più usati dal gruppo ci sono MACMA, per macOS, e POCOSTICK, per Windows, conosciuto anche come MGBot.

“La varietà di malware impiegati nelle varie campagne di questo gruppo indica che esso ha fatto uno sforzo significativo, con payload attivamente supportati non solo per macOS e Windows, ma anche per le appliance di rete” scrivono i ricercatori.

Prima di Volexity, anche i ricercatori di ESET avevano individuato l’attività degli attaccanti: ad aprile 2023 il team aveva scoperto che il gruppo stava distribuendo POCOSTICK su diverse macchine di reti aziendali, ma non era riuscito a capire quale fosse l’esatto meccanismo di distribuzione.

Il team di Volexity ha avvertito gli utenti della natura molto aggressiva di StormBamboo e ha invitato gli amministratori di rete a implementare meccanismi robusti per individuare e bloccare attività sospette.

---

---

---

https://www.securityinfo.it/2024/08/07/hacker-cinesi-hanno-compromesso-un-isp-per-distribuire-malware/?utm_source=rss&utm_medium=rss&utm_campaign=hacker-cinesi-hanno-compromesso-un-isp-per-distribuire-malware

API security was analyzed in a recent report by Traceable AI. According to the report, 82% of financial institutions expressed moderate to extreme concern about complying with federal financial regulations, including FFIEC, OCC and CFPB, and 76% are concerned about PCI-DSS compliance as it relates to their API security posture.

Sixty-four percent of respondents do not have the ability to understand the context between API activity, user activity, data flow and code execution, hindering their ability to detect and respond to API-based threats effectively.

According to the report, APIs in financial organizations commonly handle personally identifiable information (60%), account authentication data (60%), payment card details (56%) and device and location data (55%), making them prime targets for attackers.

Detecting and preventing unauthorized access to accounts (35%), sensitive data exfiltration (33%) and identifying API vulnerabilities (30%) are the most pressing API security concerns for financial institutions, according to the report.

Forty-two percent of respondents who experienced an API-related data breach cite fraud, abuse, and misuse as the root cause, and only 15% are extremely confident in their ability to detect and prevent API-based fraud and abuse.

According to the report, data loss and brand reputation damage (both 41%) topping the list of repercussions, followed by financial loss (36%) and customer attrition (35%).

Read the report.

https://www.securitymagazine.com/articles/100910-api-and-data-security-remain-top-threats

The top concerns for IT and security leaders were analyzed in a recent report by Bitfinder.

According to the report, 96% of all respondents agreed that generative artificial intelligence (AI) a threat with more than a third (36%) stating its use for manipulating or the creation of deceptive content (deepfakes) is a significant threat. The report found that confidence in the ability to spot a deepfake type of attack (audio/video) was high with 74% believing colleagues in their department could do so.

More than half of all respondents (57%) surveyed experienced a data breach or data leak in the last 12 months, up 6% from the previous year when asked the same question. At 73.5%, U.K. respondents experienced the most data breaches or leaks followed by Germany at 61%. Singapore experienced the least at 33% (24% below the average).

The report found that 64.3% of all respondents stated they will be looking for a new job in the next 12 months, up a considerable 25% when compared to last year’s result. This finding correlates with 70.2% of respondents agreeing they must work weekends due to security concerns their company faces. Respondents in the U.K. were most likely to work weekends at 81% and German respondents are most likely to look for new jobs at 76.6% (12.2% higher than the average).

When asked what the top security concerns are when it comes to managing cloud environments, 38.7% stated IAM followed closely by maintaining cloud compliance at 38%. Singapore respondents were well above the average (50.5%) saying IAM was their biggest challenge. At 36%, shadow IT came in as a strong third overall followed by risk of misconfigurations at 34%. Additionally, when asked how risk is monitored across cloud infrastructure, only 44.6% of overall respondents say they conduct regular audits and assessments.

More than 74% agree phishing/social engineering have increased in sophistication — The top cybersecurity threats according to overall respondents are phishing/social engineering and software vulnerabilities and/or zero-days both at 32% followed closely by GenAI’s influence on cyber threats and ransomware (both at 29%) and insider threats at 28%. More than 74% of respondents say they have seen an increase in the sophistication of phishing attacks.

When asked what the biggest challenge is about an organization’s current security solutions, adhering to data compliance and regulations was the number one challenge for 28% of all respondents. Extending capabilities across multiple environments was a close second at 27.5% followed by incompatibility with other security solutions at 25%.

Read the report.

https://www.securitymagazine.com/articles/100911-generative-ai-poses-security-threat-for-it-leaders

A report by Darktrace analyzed 17.8 million phishing emails and found 62% were able to pass verification checks for domain-based message authentication, reporting and conformance (DMARC). Over a third of these emails also avoided detection by major email providers. 56% bypassed all existing security measures. 

The report emphasizes how malicious actors are leveraging sophisticated tactics, techniques and procedures (TTPs) in order to bypass traditional security methods. malicious actors were observed exploiting legitimate third-party sites and services in order to blend in with normal traffic. According to the report, there has also been an increase in the deployment of covert command and control mechanisms. This includes remote monitoring and management (RMM) devices, tunneling and proxy services. 

From January 2024 to June 2024, the report recorded the most common threats observed: 

• Malware for information theft (29% of initial triaged investigations) 
• Trojans (15%) 
• Remote access trojans (12%) 
• Botnets (6%)
• Loaders (6%)

https://www.securitymagazine.com/articles/100926-62-of-phishing-emails-can-bypass-dmarc-verification-checks

Students in Singapore are scrambling after a security breach wiped notes and all other data from school-issued iPads and Chromebooks running the mobile device management app Mobile Guardian.

According to news reports, the mass wiping came as a shock to multiple students in Singapore, where the Mobile Guardian app has been the country’s official mobile device management provider for public schools since 2020. Singapore’s Ministry of Education said Monday that roughly 13,000 students from 26 secondary schools had their devices wiped remotely in the incident. The agency said it will remove the Mobile Guardian from all iPads and Chromebooks it issues.

Second breach in 4 months

Also on Monday, Mobile Guardian revealed its platform had been breached in a “security incident that affected users globally, including on the North America, European, and Singapore instances. This resulted in a small percentage of devices to be unenrolled from Mobile Guardian and their devices wiped remotely. There is no evidence to suggest that the perpetrator had access to users’ data.”

In response to the breach, Mobile Guardian has halted services, a move that prevents users from logging in to the Mobile Guardian Platform. Students will also experience restricted access on their devices as a result.

Mobile Guardian representatives didn’t respond to questions, including if the company has identified the means used to breach its platform, if it has identified the attackers, or received any ransom demands.

The breach is at least the second one to hit Mobile Guardian this year. In April, a compromise of the company’s user management portal affected 127 schools in Singapore. The portal is used for account licensing, providing technical support and other administrative tasks. It has access to users’ names, email addresses, school names, and whether the user is a parent or school employee. In all, data for 67,000 parents and 22,000 school staff was accessed.

According to the Singapore Ministry of Education:

On 12 April, MG received an email that an unauthorized individual had gained access to MG’s management portal. This email was considered a phishing email, until MG received a subsequent email on 16 April. In the second email, the individual showed evidence of access to MG’s management portal and attempted to solicit money in exchange for keeping silent that the individual had been able to access MG’s management portal. MG acted on this second alert, and worked to establish the extent of access and customers affected. This included suspending all administrative accounts that could be used to access MG’s management portal.

MOE was notified by MG on 17 April late night of this incident, as well as the enhanced security measures implemented by MG on its management portal. MOE learned from MG’s preliminary investigations that an unauthorized individual had gained access to a support account on MG’s management portal. MG’s assessment was that the unauthorized individual could have used the compromised account to view the information of customers based in the United States and Asia Pacific region, including Singapore.

The agency said that the breach was “primarily attributed to poor password management practice, and not the result of the unauthorized individual exploiting vulnerabilities in MG’s systems.”

On Tuesday, a Reddit user published an email purportedly sent to Mobile Guardian reporting a “critical” vulnerability involving improper access control. The user said the vulnerability allows the unauthorized reading and modification of “all data in Mobile Guardian systems” and requires only three minutes to exploit.

Mobile device management software allows businesses and schools to remotely monitor and manage entire fleets of devices used by employees or students. Mobile Guardian bills itself as a “complete mobile device solution” that runs on Android, Windows, iOS, ChromeOS, and macOS platforms and provides device management, parental monitoring and control, secure web filtering, classroom management, and communications.

The outage has rippled across social media platforms. An image posted on Reddit shows dozens of devices piled on a table. “This is a picture, taken at one random moment, of the sheer number of iPads sitting on the table of a school’s IT department, that need to be wiped out and re-setup after yesterday’s Mobile Guardian glitch,” the user wrote. Similar threads can be found here and here.

https://arstechnica.com/?p=2041407