Category: Uncategorized

1
Tourists aren’t the only thing visiting London’s hotspots
2
Thailand joins the party of legislated Data Protection
3
IoT (internet of things) legislation makes an appearance in the U.S Senate
4
Ransomware attack hits the state of Georgia
5
Major political parties join the Federal Parliament in the February data breach
6
Q4 NOTIFIABLE DATA BREACHES CONTINUE TO RISE
7
Android users beware the 21st century Trojan horse
8
What do you need to know about the encryption killing legislation?
9
Encryption bill to give unprecedented power
10
Australia identified as the link in a major Chinese hack!

Tourists aren’t the only thing visiting London’s hotspots

By Cameron Abbott and Ella Richards

Over 100 million cyber-attacks have hit London’s top tourist attractions over the past few years, signalling hackers turning their attention to the treasure trove of customer’s personal data and related opportunities for ransomware attacks.

Kew Gardens experienced an incredible 86 million attacks during 2018 and has seen a 438% increase in attacks year-on-year. Personal and financial details of over 100,000 of its members and over 800 staff are highly sought after, with 82 million spyware attempts and 1.6 million information-stealing attempts last financial year alone. Although Kew Gardens have performed admirably in mitigating the attacks, a major server breach in 2017-2018 and an incident involving a compromised email address managed to slip through.

Imperial War Museum was the next highest target; with over 10 million cyber security incidents spread over three years and 8 successful ransomware attacks within that time. The Natural History Museum tallied 875,414 cyber-attacks over three years, of which 26,610 were considered ‘unmitigated’ threats.

Lastly, Tate Gallery (which oversees the Tate Modern Tate Britain Galleries) was subject to 494,709 attacks last year alone, however only four attacks featuring malware and phishing software were successful.

These attacks demonstrate hacker’s increasing focus on personal and financial data, which tourist hotspots and museums collect in enormous volumes on a daily basis. Sheila Flavell (COO of FDM Group) points out that in the wake of these incidents, the UK needs to increase their level of cyber expertise by attracting more people into the tech industry. We agree there are not going to be many unemployed cybersecurity consultants with this sort of scale of activities!

Thailand joins the party of legislated Data Protection

By Cameron Abbott and Ella Richards

Following tireless attempts spanning over two decades, Thailand has finally approved the Thailand Personal Data Protection Act (“PDPA”), subject to royal endorsement and publication in the Government Gazette. Previously, the only right pertaining to personal privacy was located in the Thai Constitution, and while certain business sectors (such as telecommunications, healthcare and banking) had some protection, there was an absence of a singular consolidated data protection regime.

You may notice the broad similarity between the PDPA and the European Union’s GDPR; but don’t get too excited. Although various concepts have been drawn from the GDPR, the PDPA has been written with consideration of Thai perspectives, and therefor careful examination of compliance requirements of both regimes will be necessary.

Once the PDPA is published in the Government Gazette, Thailand will allow a transition period for businesses to adapt their practices (as the PDPA will apply to most entities onshore and offshore).

So, what can we do to prepare for the PDPA now?

Any company collecting data from residents of Thailand should ensure they’re in compliance before the PDPA comes into effect. Penalties for non-compliance will be severe, so an evaluation of business procedures will be necessary to determine if additional measures need to be adopted.

IoT (internet of things) legislation makes an appearance in the U.S Senate

By Cameron Abbott and Ella Richards

For those who are not familiar with the acronym, IoT or ‘Internet of things’ refers to the interconnection of network devices and everyday objects for increased control and ease of use.

The US Government has been steadily increasing the amount of IoT devices used in day-to-day business. In response to mounting concerns surrounding this, a bipartisan group in the Senate revealed a piece of legislation that will govern the use of IoT devices in the government context.

As we have blogged previously, the implementation of IoT brings with it an array of potential security issues and vulnerabilities. If hackers are able to access one device, there’s the possibility for them to manipulate others connected on the same network. This could result in national security risks, citizen information breaches or high-scale ransom attacks.

Under the bill, the National Institute of Standards and Technology (NIST) will give recommendations to the federal government, including minimum security requirements and how the government should approach potential cybersecurity issues. These policies and recommendations would be revisited every five years to keep them fresh and responsive to ever-changing cyber threats.

The potential that such standards would provide more industry wide guidance is to be encouraged, as several years into the growth of IoT there remains huge variability in security. The internet of things is generally less of a focus than most people’s computers, but the impact and ability to propagate is arguably greater.

Ransomware attack hits the state of Georgia

By Cameron Abbott and Ella Richards

Jackson County in Georgia has been held ransom after cyber-attackers deployed ransomware that crippled the government’s IT network for 2 weeks. Government officials resorted to coughing up $400,000 in bitcoin to pay the ransom, desperately trying to get out of the offline ‘pen and paper’ situation the attack had left them in. The suspected ransomware, ‘Ryuk’, caught the eye of the authorities at the end of 2018 after it started affecting the printing presses of Tribune Publishing. Due to the highly problematic decryption tool that is provided once the ransom is paid, Ryuk has the frightening capacity to destroy businesses which cannot survive in downtime or do not have restorable backups.

Read further about the incident here: https://www.bankinfosecurity.com/georgia-county-pays-400000-to-ransomware-attackers-a-12159

Major political parties join the Federal Parliament in the February data breach

By Cameron Abbott and Ella Richards

Following an unprecedented surge in cyber attacks against Australian businesses, an attack on Australia’s political infrastructure was imminent. New information reveals that the cyber attack against the Federal Parliament earlier this year was accompanied by yet another directed towards the Liberal, Labour and National parties.

While the malicious culprit starting poking around last November, the full throttle attack didn’t come along until 3 months later. Australia’s political institutions are high value targets for foreign entities, as they’re relatively small organisations with a huge storage of voter and community data.

It’s the distinctive sophistication of this ‘state actor’ attack that has furthered overt suspicions of foreign state agent involvement. Technical experts reported that the infiltration was the first of its kind, ringing alarm bells across the Government to strengthen security against foreign espionage and increase cyber capabilities.

Authorities are trying to calm the masses by reporting that no electoral information was taken, but they also have no idea what data was taken, or what the motives were behind it.

Various media publications have wasted no time trying to connect the dots between these incidents. A whopping 78% increase in attacks on Australian businesses, upcoming elections in May and precarious ties with suspected countries fuel their prophecies. This may be the wake up call needed to ensure the integrity of our electoral system and avoid our very own version of the alleged foreign interference in the 2016 US presidential election.

Q4 NOTIFIABLE DATA BREACHES CONTINUE TO RISE

By Cameron Abbott, Rob Pulham and Ella Richards.

The Office of the Australian Information Commissioner (OAIC) has released its fourth quarter report of notifiable data breaches between October – December 2018.

The report exposed that the OAIC received 262 notifications of data breaches, which has increased from the 245 notifications that were reported the previous quarter. Below are the key findings from their report:

  • The OAIC report identified the top five sectors who reported data breaches. Private health service providers reported 54 breaches, the finance sector reported 40 breaches, professional services reported 23 breaches, private education providers reported 21 breaches and the mining and manufacturing industry has made its first appearance with a reported 12 breaches.
  • 85% of data breaches involved individual’s contact details, 47% involved financial details, 36% involved identity details, 27% involved health details, 18% involved tax file numbers, and 9% involved other types of personal information.
  • The sources of breach varied, with 64% of data breaches due to malicious or criminal attack, 33% due to human error, and 3% due to system faults.
  • The report also breaks down the breach types per industry. Interestingly, the finance sector experienced the most malicious cyber attacks, and human error dominated the healthcare sector.

Even though 60% of the total breaches involved personal information of 100 individuals or fewer, there were a couple of notifications affecting a significantly higher number of individuals (including one that affected more than 1 million individuals). Human error breaches resulting in the unauthorised disclosure of personal information (via unintended release or publication) impacted an average of more than 17,000 individuals per breach (though this average seems likely to have been skewed by some particularly large breaches), and the failure to securely dispose of personal information affected an average of 300 individuals per breach.

Most data breaches resulted from malicious attacks which gain access through compromised credentials (such as phishing emails or stolen username and passwords). So, if you believe that the email from your CEO requesting your bank details for your exorbitant raise is legitimate, think again!

Android users beware the 21st century Trojan horse


Authors: Cameron Abbott and Sara Zokaei Fard

Here’s one to keep and eye out for – research from ESET has discovered an Android Trojan that attempts to steal funds from PayPal accounts. The malware is distributed by third-party apps rather than the Google Playstore. Once the app is launched, no functionality is provided. Instead, the app terminates and the icon is hidden. When the victim launches their PayPal App, the malware attempts to steal funds.

The interesting thing about this malware is that unlike most, it does not focus on phishing. This malware attacks the victim and attempts to instantly transfer money to the attacker’s account, when the user launches their PayPal App. The malware is able to hijack the legitimate PayPal App through the malware downloaded through the third-party app. This raises concerns of what applications on Android mobile devices will be attacked next.

What do you need to know about the encryption killing legislation?

By Cameron Abbott and Wendy Mansell

There are now three ways a government agency can gain access to encrypted information:

1. ask you to voluntarily help them
2. demand your help
3. force you build new functions in your systems to help them

As a company if you don’t comply you could be hit with a fine of up to almost $10 million dollars.

You do have a defence though – if the requests will undermine your encryption systems, making them inherently less secure you do not have comply.

If you would like to know more about how the new legislation will affect you feel free to contact us for any assistance or information.

Encryption bill to give unprecedented power

By Cameron Abbott and Wendy Mansell

The Coalition government is attempting to pass large-scale decryption reforms which will give sweeping powers to law enforcement agencies for overt and covert computer access.

The reforms have caused significant controversy as they may force tech companies and communications providers to modify their services, creating “systemic weaknesses” for intelligence agencies to exploit. However many point out these same vulnerabilities may be utilised by criminals.

Further the potential repercussions of these reforms may undermine consumers’ privacy, safety and trust through unprecedented access to private communications. This could have anti-competitive effects, as the reputations of Australian software developers and hardware manufacturers will suffer within international markets.

At the same time, the harsh reality that terrorists and organised crime increasingly utilise these technologies to evade surveillance highlights a very clear problem for law enforcement authorities.

We won’t seek to suggest where the balance between these interests should lie, but the debate rages on. Stay tuned.

Australia identified as the link in a major Chinese hack!

By Cameron Abbott and Jessica McIntosh

According to the US, China is trying to advance its aviation manufacturing capability using stolen information – and the latest is…. the information is being stolen out of Australia!

An Australian IT company dubbed “Company L” has been placed smack bang in the middle of a major hacking case in the US where US authorities have very publically and powerfully accused China of using compromised domain names to steal important aviation technology, alarmingly this has been happening for the large part of the last five years.

Read More

Copyright © 2019, K&L Gates LLP. All Rights Reserved.