Category: Managing Threats & Attacks

1
You’ve got mail…and lots of it according to the latest OAIC report!
2
A New Low: Red Cross subject to Fraudulent Claims for Bushfire Grants by Cyber Thieves
3
Toll’d You So: Cyber Security Incident Cripples Toll’s Supply Lines, Causes Customer Backlash
4
You’ve Got (Junk) Mail: Optus Slammed with $504k Fine For Spam Law Breach
5
Don’t let coronavirus get your system infected
6
Taking its Toll: Toll Shuts Down IT Systems Citing Cyber-Security Incident
7
“Totally Clueless”: Dating app Grindr reported for breach of privacy rules
8
Pushing for Gold: Organisers of the Tokyo 2020 Olympics adopting Facial Recognition Technology and Robotics to Ensure Peak (Security) Performance
9
You Can’t Throw the (Face)Book at Them: Affected Users Unable to Pursue Damages Claim against Facebook
10
A JEDI Uses the Force for Knowledge and Defense: The Pentagon awards US$10billion JEDI cloud deal to Microsoft

You’ve got mail…and lots of it according to the latest OAIC report!

By Cameron Abbott and Michelle Aggromito

With email being one of the most common forms of communication, it’s not surprising that inboxes these days accumulate thousands of emails that, perhaps, aren’t always electronically filed or deleted (not ours of course).

As the Office of the Australian Information Commissioner (OAIC) has indicated in its most recent report on notifications received under the Notifiable Data Breach (NBD) scheme, email accounts are frequently being used for storage, and this raises inherent risk. Yes it’s convenient, but using email to send personal information, such as copies of passports, bank account details and credit card information, can very quickly lose its appeal. If the email account is accessed by a malicious actor through a phishing attack or a rogue employee, the end result can be exploitation of that information for criminal gain.

Read More

A New Low: Red Cross subject to Fraudulent Claims for Bushfire Grants by Cyber Thieves

By Cameron Abbott and Max Evans

If you thought cyber attackers couldn’t go any lower, think again. Cyber thieves are tying up valuable resources at the Australian Red Cross through computer generated applications for bushfire relief assistance, according to an article from the AAP.

According to the article, cyber thieves are using applications to automate hundreds of fraudulent attempts to access financial assistance from the Red Cross, which is distributing grants of up to $20,000 per application with a total grant of around $1,000,000 per day. In one community, there were applications made in respect of 15 homes that purportedly had been destroyed by bushfires, but when physically checked remained unaffected. Go figure!

Read More

Toll’d You So: Cyber Security Incident Cripples Toll’s Supply Lines, Causes Customer Backlash

By Cameron Abbott, Warwick Andersen and Max Evans

Further information surrounding the specific details and extent of the security breach suffered by transport and logistics network Toll, which we previously blogged in respect of, have been revealed by the Australian Financial Review.

The crippling ransomware attack, known now as “Mailto” or “Kazakavkovkiz” caused Toll to suspend many of its delivery and tracking systems with a Toll spokesperson indicating that the company needed to suspend up to 500 applications that supported its operations across 25 countries worldwide. In Australia, entities such as Nike, Optus, and Telstra were forced to address a multitude of customer complaints arising out of packages affected by the relevant cyber attack.

Read More

You’ve Got (Junk) Mail: Optus Slammed with $504k Fine For Spam Law Breach

By Cameron Abbott, Max Evans and Florence Fermanis

Optus has been fined $504,000 by the Australian Communications and Media Authority (ACMA) for breaching spam laws, according to articles by the ABC and the SMH. The fine is the second largest in ACMA’s history to be awarded, being just $6,000 shy of the $510,000 fine which was slapped on Telstra in 2014 for missing service standards for urban landline connections.

Despite customers notifying Optus of their wish to opt-out or unsubscribe from such messages, an ACMA investigation found that customers still received the relevant messages, resulting in more than 2 million breaches to the Spam Act 2003 (Cth). Rather than a ‘one-off’ issue, it was found that Optus had systemic deficiencies with their compliance procedures and governance.

Read More

Don’t let coronavirus get your system infected

By Cameron Abbott and Allison Wallace

You’ve all likely seen various news reports and online posts about the coronavirus epidemic – you may have even received email alerts on how you can protect yourself from being infected.

It turns out cyber criminals are using our curiosity to bait us with fake documents purporting to inform us about coronavirus while actually infecting our systems with malware.

Read More

Taking its Toll: Toll Shuts Down IT Systems Citing Cyber-Security Incident

By Cameron Abbott, Max Evans and Florence Fermanis

We have our first large scale data breach of the decade. Toll, a transport and logistics network which delivers up to 95 million items globally every year, has temporarily shut down a number of its IT systems as a precautionary measure after suffering a cyber-security breach on Friday, according to an article by the SMH.

A spokesperson has indicated that Toll has cybersecurity experts working closely with their IT team on the breach, and is taking careful internal measures so that systems can be brought back up online in a “controlled and secured manner”. Additionally, Toll has initiated business continuity plans to minimise the disturbance brought on by the breach. While any official numbers of affected customers and the exact nature and extent of the breach have not yet been released by Toll, The Register has reported that the breach has reportedly affected customers in Australia, India and the Philippines.

Read More

“Totally Clueless”: Dating app Grindr reported for breach of privacy rules

By Cameron Abbott, Max Evans and Florence Fermanis

Dating apps, for many young people, are a fact of life. Meeting someone these days in real-life rather than through a simple swipe right appears to have become the exception, belonging more to any number of 90s teen “romcoms” than it does to real life.

According to an article by Reuters however, in recent times dating app Grindr has been the subject of a complaint by the Norwegian Consumer Council (NCC) in relation to a breach of privacy rules as set out in the European Union’s General Data Protection Regulation, implemented in 2018.

Read More

Pushing for Gold: Organisers of the Tokyo 2020 Olympics adopting Facial Recognition Technology and Robotics to Ensure Peak (Security) Performance

By Cameron Abbott, Max Evans and James Gray

It seems that Facial Recognition Technology (FRT) is the flavour of the month. Recently, we blogged about the adoption of FRT in the SkyCity Adelaide Casino to identify barred gamblers, which comes following the commencement of Perth’s 12 month trial of FRT conducted in co-operation with law enforcement agencies. However, on an international stage, organisers of the 2020 Tokyo Olympics have begun testing of FRT access systems to boost security, according to a Report by the Australian Financial Review.

Read More

You Can’t Throw the (Face)Book at Them: Affected Users Unable to Pursue Damages Claim against Facebook

By Cameron Abbott, Max Evans and James Gray

A US federal judge has ruled that the 29 million Facebook users affected by the September 2018 data breach may not seek damages as a remedy, but can only pursue the enforcement of better security practices at Facebook, according to a report by Reuters. Judge Alsup of the US District Court stated that Facebook’s repetitive losses of users’ privacy indicated a long-term need for supervision, which comes in addition to prior judgment which indicated that Facebook’s views about user’s privacy expectations were “so wrong”.

Read More

A JEDI Uses the Force for Knowledge and Defense: The Pentagon awards US$10billion JEDI cloud deal to Microsoft

By Cameron Abbott and Tan Xin Ya

In October, the US Department of Defence (DoD) awarded the Joint Enterprise Defence Infrastructure (JEDI) contract to Microsoft to overhaul its IT infrastructure – a huge show of confidence in infrastructure as a service (IaaS).

The DoD’s award of the 10-year, $10 billion JEDI contract to Microsoft is an endorsement of the secure nature of Azure, Microsoft’s cloud computing service. Under this deal, Microsoft’s task is to create a globally responsive network and monitor ongoing issues such as bugs and breaches. Part of the deal involves moving sensitive data, including classified mission operations, to Microsoft Azure. The system must be fortified with robust cyber security and encryption as Microsoft bears the important responsibility for the defence of the US.

The DoD’s decision to move to the cloud is a clear signal that IaaS has come of age, considering when such a security sensitive operation is able to use the service.

Copyright © 2019, K&L Gates LLP. All Rights Reserved.