Tuesday January 28, 2020
Home Lead Story Now Hackers A...

Now Hackers Aim to Hit Cybersecurity Firms

Companies may face a penalty of up to Rs 15 crore or 4 per cent of global turnover for major violations under the proposed Personal Data Protection law, according to official sources

0
//
Data,Privacy
A French soldier watches code lines on his computer during the International Cybersecurity forum in Lille, northern France, Jan. 23, 2018. VOA

The new breed of hackers is flexing their muscles and now, cybersecurity firms which aim to safeguard your data are being hit right in their backyard — signaling a worrisome trend for enterprises and governments as encryption is proving to be fundamentally flawed.

In a bizarre incident late last month, global cybersecurity firm Palo Alto Networks “admitted” that the personal details of its seven current and former employees had been “inadvertently” published online by a “third-party vendor”.

The personal details of some past and present employees — their names, dates of birth and social security numbers — were exposed online.

Palo Alto Networks, however, did not divulge further details on who the third party vendor was and how the personal details of the employees were leaked.

San Francisco-based HackerOne which itself is a vulnerability coordination and bug bounty platform and boasts of clients like Starbucks, Instagram, Goldman Sachs, Twitter and Zomato, last week paid $20,000 to a community user who exposed a vulnerability in its own bug bounty platform.

The vulnerability was exposed by a user with the handle called “haxta4ok00”.

“I can read all reports @security and more programmes,” posted the hacker on the community page.

US Intelligence, Privacy
A specialist works at the National Cybersecurity and Communications Integration Center in Arlington, Va., Sept. 9, 2014. (VOA)

“I did it to show the impact. I didn’t mean any harm by it. I reported it to you at once. I was not sure that after the token substitution I would own all the rights. I apologise if I did anything wrong. But it was just a white hack”.

The big question arises: How safe is our data with the cyber security enterprises that have mushroomed in the recent past.

In a statement shared with IANS, HackerOne said it believes in transparency and the vital role it plays in building trust.

“This was a vulnerability reported through HackerOne’s own bug bounty programme by an active HackerOne hacker community member and was safely resolved. The team followed standard protocol to conduct a comprehensive investigation of the issue and implement immediate and long-term fixes. All customers impacted were notified the same day,” HackerOne noted.

“It may seem counterintuitive to publish when things go wrong, but many companies face similar security challenges, and the value of public disclosure for the public and our community far outweighs the risk,” the company added.

Palo Alto Networks said they took immediate action to remove the data from public access and terminate the vendor relationship.

“We also promptly reported the incident to the appropriate authorities and to the impacted individuals. We take the protection of our employees’ information very seriously and have taken steps to prevent similar incidents from occurring in the future,” the company said in a statement.

Cyberattacks
An employee works near screens in the virus lab at the headquarters of Russian cybersecurity company Kaspersky Labs in Moscow, July 29, 2013. VOA

The big question arises: If cybersecurity firms are unable to thwart hacking on their platforms, where would an individual or a firm in India go to secure data?

“Both these incidents show that deliberate actions or even mistakes by companies can cripple huge security systems,” Virag Gupta, a lawyer who is arguing the case in Supreme Court for data localisation in India, told IANS.

The Data Protection Bill, which has been cleared by the Cabinet, envisages “sensitive” personal data to be stored in India, but it can be processed outside the country with the explicit consent of the individual concerned.

“Critical” personal data, which is another classified data, can only be stored and processed in India and will not leave the country. What constitutes “critical’ data” will be defined by the government at the time of framing regulations.

Also Read: Malaysia Launches Vaccination Campaign After 1st Polio Infection in 27 Years

“The new Data Protection Law in India must ensure an easy and fast redressal system that provides for both punishment and compensation,” said Gupta.

Companies may face a penalty of up to Rs 15 crore or 4 per cent of global turnover for major violations under the proposed Personal Data Protection law, according to official sources. (IANS)

Next Story

Hackers Can Cause Serious Attacks On E-Bikes For Eavesdropping, Says Study

Someone with malicious intent could eavesdrop on these wireless channels and listen to data exchanges between the scooter and riders' smartphone app

0
Hackers
Vendors of Micromobility vehicles can also suffer denial-of-service (DoS) attacks and data leaks by hackers, said researchers from University of Texas at San Antonio. Pixabay

As governments including in India plan more e-bikes on roads to help tackle traffic congestion, like any Internet-connected device, hackers can cause a series of attacks in e-scooters, including eavesdropping on users and even spoof GPS systems to direct riders to unintended locations, warn researchers including some of Indian-origin.

Vendors of Micromobility vehicles can also suffer denial-of-service (DoS) attacks and data leaks, said researchers from University of Texas at San Antonio.

“We have identified and outlined a variety of weak points or attack surfaces in the current ride-sharing, or micromobility, ecosystem that could potentially be exploited by malicious adversaries right from inferring the riders’ private data to causing economic losses to service providers and remotely controlling the vehicles’ behaviour and operation,” said Jadliwala.

The micromobility e-scooter analysis was conducted by Jadliwala alongside graduate students Nisha Vinayaga-Sureshkanth, Raveen Wijewickrama and post-doctoral fellow Anindya Maiti.

The global e-Bike market is projected to grow at a CAGR of 9.01 per cent to reach $38.6 billion by 2025 from an estimated $21.1 billion in 2018, according to marketsandmarkets research firm. Computer science experts at the university have published the first review of the security and privacy risks posed by e-scooters and their related software services and applications.

According to the review, to appear in the proceedings of the 2nd ACM Workshop on Automotive and Aerial Vehicle Security (AutoSec 2020), hackers can cause a series of attacks. Some e-scooter models communicate with the rider’s smartphone over a Bluetooth Low Energy channel.

Someone with malicious intent could eavesdrop on these wireless channels and listen to data exchanges between the scooter and riders’ smartphone app by means of easily and cheaply accessible hardware and software tools such as Ubertooth and WireShark.

Those who sign up to use e-scooters also offer up a great deal of personal and sensitive data beyond just billing information.According to the study, providers automatically collect other analytics, such as location and individual vehicle information.

Hackers
As governments including in India plan more e-bikes on roads to help tackle traffic congestion, like any Internet-connected device, hackers can cause a series of attacks in e-scooters, including eavesdropping on users and even spoof GPS systems to direct riders to unintended locations. Pixabay

This data can be pieced together to generate an individual profile that can even include a rider’s preferred route, personal interests, and home and work locations.”Cities are experiencing explosive population growth. Micromobility promises to transport people in a more sustainable, faster and economical fashion,” said Jadliwala.

ALSO READ: TikTok and DSCI Comes Together To Unveil Interactive Quiz on Online Privacy

To ensure that this industry stays viable, companies should think not only about rider and pedestrian safety but also how to protect consumers and themselves from significant cybersecurity and privacy threats enabled by this new technology,” the authors noted. (IANS)