Data Protection & Privacy

[Admin]

Personal data of 2,400 MINDEF, SAF personnel potentially affected; 2 vendors hit by malware
21 Dec 2019

SINGAPORE: The personal data of 2,400 Ministry of Defence (MINDEF) and Singapore Armed Forces (SAF) personnel may be affected by a potential ST Logistics personal data breach.

ST Logistics said in a media release on Saturday (Dec 21) that the potential breach was a result of a recent series of email phishing activities involving malicious malware sent to its employees’ email accounts.

“This data, contained in working files residing in affected workstations, may have been exfiltrated,” it added.

MINDEF said in a statement that preliminary investigations indicate that the personal data could have been leaked.

The affected systems contained full names and NRIC numbers, and a combination of contact numbers, email addresses or residential addresses.

ST Logistics said that it had carried out “extensive forensic investigations” into these activities through its own cyber security team and with the support of external cyber security experts.

The company also added that it informed the Personal Data Protection Commission (PDPC) and the Singapore Computer Emergency Response Team (SingCERT) of the "possible breach" of personal data on Dec 16.

The company operates several logistics services, including an eMart retail and equipping servicefor MINDEF and SAF personnel since 1999.

“In some instances, to ensure that these services are carried out correctly, some personal data is utilised,” it said.

ST Logistics chief executive officer Loganathan Ramasamy said that the company is committed to ensuring that all personal data in the company’s possession is treated with “high standards of integrity”.

“We apologise sincerely for this incident and we owe this to our customers and stakeholders to ensure their personal data is robustly protected,” he added.

DATA OF 98,000 PERSONNEL IN AFFECTED HMI INSTITUTE SERVER

In a separate data incident, the HMI Institute of Health Sciences said that it discovered a file server to be encrypted by ransomware on Dec 4.

The affected server, which primarily contained backup information, was immediately taken offline and isolated from the Internet and internal network, HMI Institute said in a media advisory on Saturday.

The institute added that its learning management system was not impacted and that daily operations were “unaffected and continued as usual”.

Preliminary investigations indicated that the likelihood of a data leak to external parties was low, MINDEF said, adding that the affected system contained personal data of 120,000 individuals.

This included the full names and NRIC numbers of about 98,000 MINDEF and SAF personnel who previously attended a cardiopulmonary resuscitation and automated external defibrillation (AED) course.

The HMI Institute has been contracted by the SAF to conduct CPR and AED training for MINDEF and SAF personnel since 2016.

Data containing full names, NRIC numbers, contact numbers, email addresses, dates of birth and residential addresses of other HMI Institute customers was also affected.

HMI institute data breach notification
A notification received by a full-time national serviceman on Dec 21, 2019.

Upon discovery of the incident, HMI Institute said it immediately engaged a cybersecurity firm to conduct investigations.

The institute said the findings so far show that the likelihood of a data leak was low and that the incident was a “random and opportunistic attack” on the file server.

There was also no evidence that the information had been copied or exported, the institute added.

“We take this incident very seriously and we deeply apologise to the students and applicants affected for the inconvenience caused,” said HMI Institute executive director Mr Tee Soo Kong.

Additional measures to fortify the institute’s systems against increasingly sophisticated cyber intrusions have also been put in place, he added.

HMI Institute said it has reported the incident to the PDPC and SingCert.

It is also currently completing the implementation of additional IT security enhancement initiatives including the establishment of a secured wide-area network and an enhanced cybersecurity protection suite.

Affected students and applicants have been informed via multiple communication channels including emails, letters and face-to-face meetings.

Students and applicants may email or call the institute should they have further enquiries regarding the incident, said the institute.

SECURITY OF SYSTEMS AN "IMPORTANT FACTOR"

MINDEF and the SAF said they take a serious view on the secure handling of personal data by their vendors.

“The security of their IT systems is an important factor that will be taken into account in the award of contracts,” MINDEF said.

MINDEF added that it is also engaging other vendors who hold information of MINDEF and SAF personnel to strengthen the security of their IT systems.

The PDPC is also conducting investigations into both cases, MINDEF said.

In response to the malware incidents, Defence Cyber Chief Brigadier-General Mark Tan said: “The malware incidents affected the IT systems of our vendors. Although MINDEF/SAF’s systems and operations were not affected, the malware incidents in these vendor companies may have compromised the confidentiality of our personnel’s personal data."

He added that MINDEF and the SAF will review the cybersecurity standards of their vendors to ensure that they are able to protect their personnel’s personal data and information.

Affected personnel will be notified from Saturday, said MINDEF.

CNA/zl

Source: https://www.channelnewsasia.com/news/singapore/st-logistics-mindef-saf-2400-personal-data-breach-hmi-institute-12202786

[Admin]

Security camera maker Wyze said it left the personal information of 2.4 million customers exposed on the internet for weeks
Tyler Lizenby/CNET

Security camera startup Wyze has confirmed it suffered a data leak this month that may have left the personal information of millions of its customers exposed on the internet. No passwords or financial information were exposed, but email addresses, Wi-Fi network IDs and body metrics were left unprotected from Dec. 4 through Dec. 26, the company said Friday.

More than 2.4 million Wyze customers were affected by the leak, according to cybersecurity firm Twelve Security, which first reported on the leak

The data was accidentally left exposed when it was transferred to a new database to make the data easier to query, but a company employee failed to maintain security protocols during the process, Wyze co-founder Dongsheng Song wrote in a forum post.

"We are still looking into this event to figure out why and how this happened," he wrote.

In an update Sunday, Song said Wyze discovered a second unprotected database during its investigation of the data leak. It's unclear what information was stored in this database, but Song said passwords and personal financial data weren't included.

Keeping sensitive information private continues to be a challenge for database managers. Among this year's more high-profile data leaks were the names, addresses and demographic data of 80 million US households, as well as the expected salaries of more than a million job seekers and thousands of Facebook passwords.

Among the data exposed in the Wyze leak was the height, weight, gender and other health information of about 140 beta users participating in the testing of new hardware, Wyze said. 

The company said there was no evidence that login tokens had been exposed but signed out all users to generate new tokens. Customers can also expect their cameras to automatically reboot in the coming days as an additional security action.

Wyze said it takes its product security seriously and will reexamine its procedures.

"This is a clear signal that we need to totally revisit all Wyze security guidelines in all aspects, better communicate those protocols to Wyze employees, and bump up priority for user-requested security features beyond 2-factor authentication," Wyze said.

Wyze representatives didn't respond to a request for additional information and comment.

Source: https://www.cnet.com/news/wyze-data-leak-may-have-exposed-personal-data-for-millions-of-users/

[Admin]

Creative Tech, MSIG's service provider, PeopleSearch, 4 other entities penalised for personal data breach
Fri, Jan 10, 2020 | Tay Peck Gek

SEVEN organisations were found in breach of the Personal Data Protection Act (PDPA) and were fined S$90,000 in total penalties. The companies included Creative Technology, MSIG's service provider and a recruitment company that was attacked by ransomware.

Among the seven, Globalsign.in, the email marketing service provider of MSIG Insurance (Singapore) was slapped with the highest penalty, S$34,000 for having its mass emailing system accessed without authorisation in August 2017 and abused to send spam emails to 149,172 MSIG’s customers.

Creative was handed a S$15,000 penalty. The company did not install patches to address a vulnerability in the software used to operate and host an online forum. This resulted in the unauthorised disclosure of personal data of forum users - 484,512 of them whose account information was accessed and extracted in May 2018.

PeopleSearch was a victim of ransomware attack last March. The company offering professional recruitment and staffing services in Asia received a ransom note asking for payment in exchange for the decryption key to the files of 944 individuals' personal information. PeopleSearch admitted that security scans, penetration testing or patching of the server had not been performed for at least 12 months preceding the incident. It was fined S$5,000.

A SAFRA National Service Association employee inadvertently leaked the personal data of 780 shooting club members in September 2018. When he sent out emails to 491 of these members, the emails had attached spreadsheets that included other members' names, National Registration Identity Card (NRIC) numbers, dates of birth, addresses, telephone numbers and email addresses. The association was fined S$10,000.

Society of Tourist Guides (Singapore) had disclosed sensitive information of 111 members in March last year, exposing their NRIC numbers, driving licence and photographs through links on its website. The publicly accessible directories on the website were found to store images of identification documents, which contained data of the affected members including their thumbprints, addresses and dates of issue of the documents. The society was given a S$20,000 penalty.

National Healthcare Group did not restrict access through the Internet to a list of 129 general practitioners (GPs) who had registered to be partner doctors of the organisation. Personal information of five members of public who submitted feedback on the website was also publicly accessible. For this, the organisation has to pay a penalty of S$6,000.

Personal data of seven L’Oreal Singapore customers had been exposed to the risk of unauthorised disclosure, as a result of the company's failure to ensure appropriate testing of its website or make other security arrangements to protect the personal data. The company instructed its vendor to make some changes to the website in November 2018.

However, it failed to scope the user acceptance tests to include the normal functioning of the website, in particular the login and caching functions of the customer login page. This resulted in the personal data of a customer to be cached when he or she logged in, and this data would then be disclosed to customers who subsequently logged in until the next cache refresh. Having considered the representations and taking into account all the relevant circumstances, the Personal Data Protection Commission issued a warning to the company.

Source: https://www.businesstimes.com.sg/companies-markets/creative-tech-msigs-service-provider-peoplesearch-4-other-entities-penalised-for

[Admin]

Big Microsoft data breach – 250 million records exposed
22 Jan 2020 | by Paul Ducklin   

Microsoft has today announced a data breach that affected one of its customer databases.

The blog article, entitled Access Misconfiguration for Customer Support Databases, admits that between 05 December 2019 and 31 December 2019, a database used for “support case analytics” was effectively visible from the cloud to the world.

Microsoft didn’t give details of how big the database was. However, consumer website Comparitech, which says it discovered the unsecured data online, claims it was to the order of 250 million records containing:

    …logs of conversations between Microsoft support agents and customers from all over the world, spanning a 14-year period from 2005 to December 2019.

According to Comparitech, that same data was accessible on five Elasticsearch servers.

The company informed Microsoft, and Microsoft quickly secured the data.

Microsoft’s official statement states that “the vast majority of records were cleared of personal information,” meaning that it used automated tools to look for and remove private data.

However, some private data that was supposed to be redacted was missed and remained visible in the exposed information.

Microsoft didn’t say what type of personal information was involved, or which data fields ended up un-anonymised.

It did, however, give one example of data that would have been left behind: email addresses with spaces added by mistake were not recognised as personal data and therefore escaped anonymisation.

So if your email address were recorded as “name@example.com” your data would have been converted into a harmless form, whereas “name[space]@example.com” (an easy mistake for a support staffer to make when capturing data) would have been left alone.

Microsoft has promised to notify anyone whose data was inadvertently exposed in this way, but didn’t say what percentage of all records were affected.
What to do?

We don’t know how many people were affected or exactly what personal data was opened up for those users.

We also don’t know who else, besides Comparitech, may have noticed in the three weeks it was exposed, although Microsoft says that it “found no malicious use”.

We assume that if you don’t hear from Microsoft, even if you did contact support during the 2005 to 2019 period, then either your data wasn’t in the exposed database, or there wasn’t actually enough in the leaked database to allow anyone, including Microsoft itself, to identify you.

It’s nevertheless possible that crooks will contact you claiming that you *were* in the breach.

They might urge you to take steps to “fix” the problem, such as clicking on a link and logging in “for security reasons”, or to “confirm your account”, or on some other pretext.

Remember: if ever you receive a security alert email, whether you think it is legitimate or not, avoid clicking on any links, calling any numbers or taking any online actions demanded in the email.

Find your own way to the site where you would usually log in, and stay one step ahead of phishing emails!

Source: https://nakedsecurity.sophos.com/2020/01/22/big-microsoft-data-breach-250-million-records-exposed/

Reference: https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/

[Admin]

Singapore, Malaysia credit card details dumped online in massive data breach
March 07, 2020 | Tashny Sukumaran

Hundreds of thousands of credit card details from at least six Southeast Asian countries – including Malaysia and Singapore – have been leaked online, according to India-based cybersecurity start-up Technisanct.

The company said this week it had found a series of data breaches involving credit card details issued by top banks in Singapore, Malaysia, the Philippines, Vietnam, Indonesia and Thailand.

“The results are alarming as it seems no one is aware that such a huge volume of payment card details – including the CVV and PIN – are available,” said CEO Nandakishore Harikumar, referring to the card verification value and personal identification number.

Anyone with access to those details could cause financial losses to the owner of the cards, he added.

Technisanct said its research found that credit card holders in the Philippine were the worst hit, with 172,828 cards breached, while Malaysia and Singapore had 37,145 and 25,290 cards breached respectively.

According to Nandakishore, in the past week his team had identified even more cards available for sale from these six countries. Although many systems required a one-time transaction password, there were portals that did not require this, he said.

Nandakishore said he had emailed the Computer Emergency Response Team (CERT) – which handles cybersecurity incidents – in each country and advised them to take action, although not all had responded.

In Malaysia, both Cybersecurity Malaysia and the central bank, which regulates financial institutions, declined to comment.

CIMB Group Holdings – allegedly one of the affected banks – said it had “no credible evidence that any actionable customer data has been compromised from us”.

“CIMB takes data privacy and protection seriously and has taken the necessary security measures to ensure all customers’ personal information remain secured. We continuously monitor all avenues to ensure that our customer data remains protected where possible,” a spokesperson said.

This Week in Asia understands the CERTs of both Vietnam and Malaysia are investigating the matter.

Meanwhile, the Monetary Authority of Singapore said it was constantly monitoring cyber threats, including cyberattacks that may result in payment card fraud, as part of its surveillance.

“We note that security vendors have reported a rise in incidents of data theft internationally, including loss of card details from compromised e-commerce websites,” a spokesperson said, adding that it had strict requirements for financial institutions in Singapore to implement information technology controls to protect sensitive information from unauthorised disclosure.

“Card issuers have well established processes to handle credit cards whose details have been leaked. Card issuers have also put in place real time fraud monitoring to detect and block suspicious transactions promptly,” the MAS said.

Southeast Asian countries have been hit by growing cybercrime including high-profile data breaches.

Last year, subsidiaries of Indonesian low-cost airline Lion Air suffered a massive data breach, resulting in the information of millions of passengers – including passport details, home addresses and phone numbers – being leaked onto data exchange forums.

In 2018, the details of millions of mobile service subscribers in Malaysia were leaked online, while popular beauty products retailer Sephora revealed online accounts of residents of Hong Kong, Singapore and Malaysia were compromised by a data leak.

Singapore has been the target of several data leaks, including a widely-reported incident where the confidential information of over 14,000 people diagnosed with HIV was leaked online and another where personal data of 1.5 million patients of SingHealth’s specialist clinics – including Prime Minister Lee Hsien Loong – was compromised.

Source: https://www.asiaone.com/singapore/singapore-malaysia-credit-card-details-dumped-online-massive-data-breach

[Admin]

Indonesia's Tokopedia probes alleged data leak of 15 million users
May 3, 2020 | Fanny Potkin

SINGAPORE (Reuters) - Tokopedia, Indonesia’s largest e-commerce platform, said on Saturday it was investigating claims that the details of millions of its users had been leaked online by a hacker.

“We found that there had been an attempt to steal data from Tokopedia users,” a spokesman for the company said in a statement. “However, Tokopedia ensures that crucial information such as passwords remains successfully protected behind encryption.”

“At this moment, we continue to investigate further into this matter and there is no additional information that we can share,” the statement added.

Data breach monitoring service Under the Breach published a Twitter post on Saturday showing screenshots from an unnamed individual who claimed he had acquired the personal details of 15 million Tokopedia users during a March 2020 hack on the e-commerce site.

According to the screenshots, which show names, emails and birthdays, the hacker alleges he or she is in possession of a much bigger user database and asks for assistance to “crack” users’ passwords.

Backed by $2 billion in funding from investors including SoftBank Group Corp’s Vision Fund and Alibaba, Tokopedia, whose founder and CEO William Tanuwijaya is one of the country’s most prominent tech entrepreneurs, claims more than 90 million monthly active users.

The spokesman declined to comment on details of the allegations in the screenshots. Under the Breach was not immediately reachable for comment.

Source: https://in.reuters.com/article/us-tokopedia-cyber/indonesias-tokopedia-probes-alleged-data-leak-of-15-million-users-idINKBN22E0Q2

[Admin]

Common framework to safeguard citizens' personal data set up
May 1, 2020 | Lester Wong

The public will now be able to whistleblow on suspected data breaches by government agencies under a common framework to safeguard citizens' personal data.

It is among the first set of recommendations by the Public Sector Data Security Review Committee being rolled out after a spate of breaches over the last two years.

The common framework will replace current practices being followed by public agencies, many of which have devised the protocols themselves.

Yesterday, the Smart Nation and Digital Government Office (SNDGO) said: "(The new measures) will improve accountability and transparency of the public sector data security regime, and enhance the Government's effectiveness in responding to incidents promptly, and notifying affected individuals in the event of a data incident."

The committee was convened by Prime Minister Lee Hsien Loong in March last year following a spate of cyber-security breaches, including the SingHealth incident in which hackers stole the data of 1.5 million patients and the outpatient prescription information of 160,000 people in June 2018.

In the spirit of transparency, the Government's approach to data security is also published on the Smart Nation website. Annual reports highlighting efforts to continually improve data security standards will be made available to the public on the site.

Meanwhile, members of the public can flag unauthorised disclosures of government data by completing a form on the Smart Nation website.

"The Smart Nation and Digital Government Group will work with the public and the relevant public sector agency or agencies involved to investigate the suspected data incident, and take remedial steps to address any confirmed data incident in a timely manner," the spokesman said.

Other recommendations implemented this month include clarifying the roles and responsibilities of public officers involved in managing data security, and mandating that top public sector leadership be accountable for putting in place a strong organisational data security regime.

The SNDGO said that efforts are on track to implement the committee's recommendations where relevant in 80 per cent of government systems by the end of next year.

The rest will follow by the end of 2023 as some systems will require significant redesign.

Other new measures include encrypting sensitive files, and hiding away in a separate system with tighter controls highly sensitive information about individuals, such as their HIV status. The personal information of ministers and other important people will also be kept in separate systems with more stringent protection.

Source: https://www.straitstimes.com/singapore/common-framework-to-safeguard-citizens-personal-data-set-up

[Admin]

Hack Brief: An Adult Cam Site Exposed 10.88 Billion Records
CAM4 has taken the server offline, but not before it leaked 7TB of user data.

It’s all too common for companies to leave databases chock full of sensitive information exposed to the great wide internet. But when that company operates an adult livestreaming service, and that data comprises 7 terabytes of names, sexual orientations, payment logs, and email and chat transcripts—across 10.88 billion records in all—the stakes are a bit higher.

The site is CAM4, a popular adult platform that advertises “free live sex cams.” As part of a search on the Shodan engine for unsecured databases, security review site Safety Detectives found that CAM4 had misconfigured an ElasticSearch production database so that it was easy to find and view heaps of personally identifiable information, as well as corporate details like fraud and spam detection logs.

“Leaving their production server publicly exposed without any password,” says Safety Detectives researcher Anurag Sen, whose team discovered the leak, “it’s really dangerous to the users and to the company.”

The Hack

First of all, very important distinction here: There’s no evidence that CAM4 was hacked, or that the database was accessed by malicious actors. That doesn’t mean it wasn’t, but this is not an Ashley Madison–style meltdown. It’s the difference between leaving the bank vault door wide open (bad) and robbers actually stealing the money (much worse).

"The team concluded without any doubt that absolutely no personally identifiable information, including names, addresses, emails, IP addresses or financial data, was improperly accessed by anyone outside the SafetyDetectives firm and CAM4’s company investigators," the company said in a statement.

The company also says that the actual number of people who could have been identified was much smaller than the eye-popping number of exposed records. Payment and payout information could have exposed 93 people—a mix of performers and customers—had a breach occurred, says Kevin Krieg, technical director of Smart-X, which manages the CAM4 database. Safety Detectives put the number at "a few hundred."

The mistake CAM4 made is also not unique. ElasticSearch server goofs have been the cause of countless high-profile data leaks. What typically happens: They’re intended for internal use only, but someone makes a configuration error that leaves it online with no password protection. “It’s a really common experience for me to see a lot of exposed ElasticSearch instances,” says security consultant Bob Diachenko, who has a long history of finding exposed databases. “The only surprise that came out of this is the data that is exposed this time.”

And there’s the rub. The list of data that CAM4 leaked is alarmingly comprehensive. The production logs Safety Detectives found date back to March 16 of this year; in addition to the categories of information mentioned above, they also included country of origin, sign-up dates, device information, language preferences, user names, hashed passwords, and email correspondence between users and the company.

Out of the 10.88 billion records the researchers found, 11 million contained email addresses, while another 26,392,701 had password hashes for both CAM4 users and website systems.

"The server in question was a log aggregation server from a bunch of different sources, but server was considered non-confidential," says Krieg. "The 93 records got into the logs due to a mistake by a developer who was looking to debug an issue, but accidentally logged those records when an error happened to that log file."

Who’s Affected?

It’s hard to say exactly, but the Safety Detectives analysis suggests that roughly 6.6 million US users of CAM4 were part of the leak, along with 5.4 million in Brazil, 4.9 million in Italy, and 4.2 million in France. It’s unclear to what extent the leak impacted both performers and customers.

Again, there’s no indication that bad actors tapped into all those terabytes of data. And Sen says that CAM4's parent company, Granity Entertainment, took the problematic server offline within a half hour of being contacted by the researchers. That doesn’t excuse the initial error, but at least the response was swift.

Moreover, despite the sensitive nature of the site and the data involved, it was actually fairly difficult to connect specific pieces of information to real names. “You really have to dig into the logs to find tokens or anything that would connect you to the real person or anything that would reveal his or her identity,” says Diachenko. “It should not have been exposed online, of course, but I would say it’s not the scariest thing that I’ve seen.”

How Bad Is It?

Which is not to say that everything’s totally fine. If anyone were to have done that digging, they could have found out enough about a person—including sexual preferences—to potentially blackmail them. On a more mundane level, CAM4 users who reuse their passwords would be at immediate risk for credential stuffing attacks, potentially exposing any accounts where they don’t use strong, unique credentials.

Or consider the inverse: If you have the email address of a CAM4 user, Sen says, there’s a decent chance you can find an associated password from a previous data breach, and break into their account.

The data in the leak could have potentially put CAM4 at risk, as well; privileged fraud and spam detection information would have given potential attackers a road map for how to get around those defenses.

Krieg says that the CAM4 has already taken steps to prevent a repeat of the data leak. "It’s a server that should not have an outward facing IP in the first place," he says. "We’re going to be moving it to our internal LAN to make it a lot harder for people to get access to this type of server, while making sure that nothing is on it that should not be on it, which includes any personally identifiable information."

Data leaks happen. They’re not as bad as breaches, but with information this sensitive, the onus is on companies to take every precaution to protect it—not the bare minimum.

This story has been updated to include a statement from CAM4 and comments from Kevin Krieg of Smart-X.

Source: https://www.wired.com/story/cam4-adult-cam-data-leak-7tb/

[Admin]

US Marshals says prisoners’ personal information taken in data breach
Zack Whittaker@zackwhittaker / May 9, 2020

Justice Department Inspector General Releases Report On Investigation Into FISA Warrant Process During The 2016 Election

A data breach at the U.S. Marshals Service exposed the personal information of current and former prisoners, TechCrunch has learned.

A letter sent to those affected, and obtained by TechCrunch, said the Justice Department notified the U.S. Marshals on December 30, 2019 of a data breach affecting a public-facing server storing personal information on current and former prisoners in its custody. The letter said the breach may have included their address, date of birth and Social Security number, which can be used for identity fraud.

But the notice didn’t say how many current and former prisoners are affected by the breach.

As the law enforcement arm of the federal courts, U.S. Marshals are tasked with capturing fugitives and serving federal arrest warrants. Last year, U.S. Marshals arrested more than 90,000 fugitives and served over 105,000 warrants.

A spokesperson for the Justice Department did not respond to a request for comment by email or phone.

It’s the latest federal government security lapse in recent weeks.

The Defense Information Systems Agency, a Dept. of Defense division charged with providing technology and communications support to the U.S. government — including the president and other senior officials — said a data breach between May and July 2019 resulted in the theft of employees’ personal information.

Last month, the Small Business Administration admitted that 8,000 applicants, who applied for an emergency loan after facing financial difficulties because of the coronavirus pandemic, had their data exposed.

Source: https://techcrunch.com/2020/05/08/us-marshals-prisoner-data-breach

[Admin]

New TraceTogether token to have no GPS or internet connectivity to track user’s whereabouts: Vivian Balakrishnan
Raj Nadarajan | 08 June, 2020

SINGAPORE — The portable contact-tracing device that the Government is developing will not record its user’s location data and will not have Global Positioning System (GPS) or mobile internet connectivity, the Minister-in-charge of the Smart Nation initiative Vivian Balakrishnan said.

He also said that the Bluetooth proximity data collected by this device will be encrypted in the device, is auto-erased after 25 days. It will be extracted only if the user is infected by Covid-19.

Dr Balakrishnan was speaking during a media briefing on Monday (June 8 ) held by the governmental task force tackling the Covid-19 pandemic.

The first batch of these devices, which will be named the TraceTogether token, will be delivered in the later half of this month and progressively distributed to Singapore households, he added.

In a statement on Monday, Smart Nation and Digital Government Group (SNDGG), which is the Government-led initiative behind the application, said that the token will be a standalone device that functions in “the same way" that the TraceTogether mobile application does — by using Bluetooth signals to record other nearby TraceTogether devices.

The token has no GPS, which means the device does not capture geolocation data and only proximity data. “This means a person cannot be tracked, and no one will know where the person has been,” it added.

If a user is infected with Covid-19, the data from the token would then be extracted by authorised contact tracers from the Ministry of Health. SNDGG added that only a “small number of personnel have access to the data for contact tracing purposes”.

Dr Balakrishnan also gave the assurance that there will not be “one, big, giant central database” that will hold the data collected by these tokens, adding that since the tokens do not have internet connectivity, users’ data cannot be extracted without their knowledge.

“Even the finite silos of data that are uploaded are protected by the public sector data security recommendations. All the officers involved are covered by the Official Secrets Act and we will continue to audit and make sure no data leakage occurs,” Dr Balakrishnan said.

“We will continue to test the devices and test our systems… and also reassure people that we are getting the balance right between defending public health and protecting personal privacy. I believe it is possible to protect both.”

Dr Balakrishnan had said in Parliament last Friday that the Government was developing and would soon roll out a portable wearable device that will achieve the same objective as the TraceTogether mobile app.

He said that unlike the app, this device will not depend on the need for users to possess a smartphone, adding that if this portable device works, the Government might then distribute it to everyone in Singapore.

PROBLEMS WITH APPLE DEVICES

Dr Balakrishnan had noted on Friday that aside from the fact that not everyone has a smartphone, there were other issues with the TraceTogether app, which has so far been downloaded 1.5 million times or by about 25 per cent of the population.

It does not appear to work as well on Apple devices because the iOS operating system suspends Bluetooth scanning when the app is running in the background, he said.

“We’ve had repeated discussions both at the technical and policy level with Apple, but we have not yet been able to find a satisfactory solution.”

Over the weekend, some Singaporeans raised concerns about privacy issues related to the wearable device.

A petition titled “Singapore says 'No' to wearable devices for Covid-19 contact tracing” has since gathered more than 32,000 signatures.

The Singapore People’s Party released a statement on Sunday (June 7) expressing its concerns about the risk as well, that the data collected may be abused. It said that the pandemic does not justify the need for a wearable contact tracing device and that the Government should select more “proportionate measures”.

Source: https://www.todayonline.com/singapore/tracetogether-token-has-no-gps-or-internet-connectivity-track-users-whereabouts-vivian

Reference: OpenTrace source codes (Kotlin, TypeScript, Swift) in Github, https://github.com/opentrace-community

[Admin]

Fake Malicious Mobile Applications Imitating Contact-Tracing Applications
12 Jun 2020

Many countries are implementing contact tracing applications as they progressively move out of their lockdown phase. Threat actors are capitalising on such implementations to conduct malicious activities through fake mobile applications that imitate official COVID-19 contact tracing applications. These fake applications are usually embedded with trojans or malware that, when executed, could be used to monitor user's activities on the device and/or steal their personal data.

Users are recommended to adopt the following measures to avoid downloading fake and malicious applications to your mobile devices:

• Only download applications from the official Play Store (Android) and App Store (iOS).
• Check the developer information on the application listing. Only download applications developed and listed by the official developer.
• Pay attention to the security permissions required by the application and/or its privacy policy before downloading. Be wary of applications that ask for unnecessary permissions on your device.
• Look through the application’s reviews, and be wary of poorly-reviewed applications. Multiple poor reviews or comments may be an indication of issues with the application.

Users who have downloaded applications from unofficial sources are recommended to delete them, and perform an anti-virus scan on their device(s) thereafter. In the event that users are unable to delete the application after it has been installed, they may wish to perform a factory reset on their device(s) to try to remove it. Users are reminded to do a backup of important data from the device(s) before proceeding to perform the factory reset. 

References:

https://www.csa.gov.sg/gosafeonline/go-safe-for-me/homeinternetusers/android-mobile-security-what-you-need-to-know-about-malicious-apps

https://support.tracetogether.gov.sg/hc/en-sg/articles/360050057093-10-June-2020-Android-APKs-impersonating-TraceTogether

https://www.anomali.com/blog/anomali-threat-research-identifies-fake-covid-19-contact-tracing-apps-used-to-monitor-devices-steal-personal-data

***

Source: https://www.csa.gov.sg/singcert/advisories/ad-2020-004
Additional Reference: https://www.facebook.com/GovTechSG/photos/a.411947277510/10156998483617511

[Admin]

IT giant Cognizant confirms data breach after ransomware attack
Lawrence Abrams | June 17, 2020

In a series of data breach notifications, IT services giant Cognizant has stated that unencrypted data was most likely accessed and stolen during an April Maze Ransomware attack.

Cognizant is one of the largest IT managed services company in the world with close to 300,000 employees and over $15 billion in revenue.

As a managed service provider (MSP), Cognizant remotely manages many of its clients to fix issues, install patches, and monitor their security.

On April 17th, Cognizant began emailing their clients to warn them that they were under attack by the Maze Ransomware so that they could disconnect themselves from Cognizant and protect themselves from possibly being affected.

This email also contained indicators of compromise that included IP addresses utilized by Maze and file hashes for the kepstl32.dll, memes.tmp, and maze.dll files. These IP addresses and files are known to be used in previous attacks by the Maze ransomware actors.

While Cognizant stated that it was an attack by Maze, the Maze operators told BleepingComputer at the time that they weren't behind the attack.

Unencrypted data most likely were stolen

In two data breach notification letters [1, 2] filed with the Office of the Attorney General of California, Cognizant states that the Maze Ransomware operators were active on Cognizant's network between April 9th and the 11th.

During the time they had access, they "likely exfiltrated a limited amount of data from Cognizant’s systems."

Before deploying ransomware and encrypting devices, the Maze Ransomware operators will first spread laterally through the network and steal unencrypted files.

These stolen files are then used as an extortion tactic by threatening to publicly release the data on the Maze data leak site if the victim does not pay the ransom.

In the data breach notifications, Cognizant warned sensitive personal information such as SSN, Tax IDs, financial information, and driver's licenses, and passports may have been stolen.

"We have determined that the personal information involved in this incident included your name and one or more of: your Social Security number and/or other tax identification number, financial account information, driver’s license information, and/or passport information," the Cognizant customer data breach notification stated.

For employees who have corporate credit cards, Cognizant warned that they were likely exposed during the attack.

"The majority of the personal information that was impacted was information relating to our corporate credit cards. Out of an abundance of caution, we are giving notice to all associates who have an active corporate credit card. All associates who have an active corporate credit card will be offered credit and identity theft monitoring services from ID Experts"

For those affected, Cognizant is providing a free year of ID theft and dark web monitoring.

BleepingComputer suggests that victims utilize this free offer to detect and prevent threat actors from using the stolen information to open credit card accounts, bank accounts, or perform other identity theft.

Source: https://www.bleepingcomputer.com/news/security/it-giant-cognizant-confirms-data-breach-after-ransomware-attack/

Reference 1: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/

Reference 2: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Reference 3: https://www.tripwire.com/state-of-security/featured/maze-ransomware-what-you-need-to-know/

[Admin]

Hackers Leaked 269 GB of U.S. Police and Fusion Centers Data Online
June 22, 2020 | Swati Khandelwal

A group of hacktivists and transparency advocates has published a massive 269 GB of data allegedly stolen from more than 200 police departments, fusion centers, and other law enforcement agencies across the United States.

Dubbed BlueLeaks, the exposed data leaked by the DDoSecrets group contains hundreds of thousands of sensitive documents from the past ten years with official and personal information.

DDoSecrets, or Distributed Denial of Secrets, is a transparency collective similar to WikiLeaks, which publicly publishes data and classified information submitted by leakers and hackers while claiming the organization itself never gets involved in the exfiltration of data.

According to the hacktivist group, BlueLeaks dump includes "police and FBI reports, bulletins, guides and more," which "provides unique insights into law enforcement and a wide array of government activities, including thousands of documents mentioning COVID19.

As you can see in the screenshot below, a quick analysis of the BlueLeaks dump shows the data contains over millions of files including images, documents, videos, web pages, text files, emails, audio files, and more, though it's yet to be investigated how many files are classified and are not supposed to be public.

Some alerts and guides leaked in BlueLeaks also contained intelligence on the protests, including the recent countrywide Black Lives Matter protests in the U.S. following the death of George Floyd at the time he was in the custody of Minneapolis police.




Some of the U.S. agencies listed in BlueLeaks are:

•     Alabama Fusion Center
•     Austin Regional Intelligence Center
•     Boston Regional Intelligence Center
•     Colorado Information Analysis Center
•     California Narcotic Officers' Association
•     Delaware Information and Analysis Center
•     FBI Houston Citizens Academy Alumni Association
•     FBI National Academy Association Arkansas/Missouri Chapter
•     FBI National Academy Association Michigan Chapter
•     FBI National Academy Association of Texas

It appears that the source of this massive data stems from a security breach at Houston-based web hosting company 'Netsential Inc,' where the webserver for National Fusion Center Association (NFCA) is hosted, security blogger Krebs reported.

Fusion centers are basically information centers that enable intelligence sharing between local, state, tribal, territorial law enforcement and federal agencies, maximizing their ability to detect, prevent, investigate, and respond to criminal and terrorist activities.

In a statement, NFCA confirmed Krebs that the "dates of the files in the leak actually span nearly 24 years — from August 1996 through June 19, 2020 — and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files."

Netsential confirmed that a threat actor had leveraged a compromised Netsential customer user account and the web platform's upload feature and exfiltrated other Netsential customer data, including several U.S. police agencies, including Fusion Centers.

Netsential is the same web hosting company that was previously abused by attackers to infect targeted victims with ransomware by sending spoofed spear-phishing emails disguised as NFCA.

Source: https://thehackernews.com/2020/06/law-enforcement-data-breach.html

[Admin]

Personal details of more than 3,000 people in Singapore leaked online
July 01, 2020 | David Sun


The scam features a celeb in the victim's location, like Bryan Wong in Singapore, saying he or she had made a fortune on a cryptocurrency investment platform.
GROUP-IB

The personal records of 3,499 people in Singapore have been leaked online, and they are being targeted in a bitcoin scam. The records, which include names, phone numbers and e-mail addresses, were discovered by Singapore-based cyber security company Group-IB recently.

In a release yesterday, it said the records were part of a larger haul comprising the records of almost 250,000 people.

Most are from Britain, tallying more than 147,000 records, while the rest are from Australia, South Africa, the US, Singapore, Malaysia, Spain and other countries.

The source of the leak and how the details were stolen are unknown.

The leaked details are being used by scammers, who send victims text messages disguised as being from recognised media outlets with an enticing headline and a link.

Sample messages acquired by Group-IB researchers showed the headline would usually feature a celebrity relevant to the victim's location, such as Bryan Wong in Singapore or Chris Brown in the US.

Those who click the link are taken to a fake news site featuring celebrities saying they made a fortune on a new cryptocurrency investment platform.

Clicking any link in the article takes victims to the scam bitcoin investment platform website.

The Group-IB team found the scam platform used the names Crypto Cash, Bitcoin Rejoin, Bitcoin Supreme and Banking on Blockchain.

Mr Ilya Sachkov, chief executive and founder of Group-IB, warned that the elaborate nature of the scheme showed that cyber criminals were getting more sophisticated.

"Bitcoin investment scams have been around for a while and we regularly detect new instances of crypto fraud," he said.

"This time, however, the scheme was significantly upgraded, and a tremendous amount of personal information was leaked. The bad guys got smarter in a bid to increase the success rate of their fraudulent operations."

Group-IB said one should be wary of long redirect chains and double check the domain name before entering personal data on a site.

In response to the leak, a spokesman for the Cyber Security Agency of Singapore said members of public should stay vigilant and warned that scammers will use topics of high interest to lure victims.

"These could take the form of investments that promise high returns, General Election-related news, or threats to freeze their online accounts," she said.

"(Members of public) should not disclose personal or financial details, make transfers or follow any instructions to install apps or log into their banking accounts."

Source: https://www.asiaone.com/singapore/personal-details-more-3000-people-singapore-leaked-online

[Admin]

"This was reluctantly shared by the owner of a store in Century Square as he initially wanted to avoid any implication from the authorities, thinking this could be an one-off incident.

However, this Social distancing officer got too bossy and nosey by coming every other day to disturb the staffs, terrorizing to take photos and write reports if they breach any measures. He claimed that the staffs must stand 1-metre apart when serving customers.

When staff requested him to scan SafeEntry before entering store, he always simply replied he’s not required becos he’s Social distancing officer..
In this video, the staff is under duress to polish his “Tiffany Platinum” for him.. didn’t even bother to ask properly.

On another occasion, the staffs shared that he even asks the staff if he could get his ears pierced for free and he will close one eye if he sees something amiss.

Hope relevant authorities can look into the conduct of such officer to prevent further abuse of authority.
Mothership.sg
CNA
Stomp
Enterprise Singapore

Source: https://www.facebook.com/SGAROOO/posts/3600535369965964
Reference 1: https://mothership.sg/2020/08/century-square-safe-distancing-officer/
Reference 2: https://www.asiaone.com/singapore/sda-fired-after-unprofessional-behaviour-soliciting-favours-store-esg