{"id":2153,"date":"2021-01-08T03:38:29","date_gmt":"2021-01-08T03:38:29","guid":{"rendered":"https:\/\/thenextweb.com\/?p=1333374"},"modified":"2021-01-08T03:38:29","modified_gmt":"2021-01-08T03:38:29","slug":"pardon-the-intrusion-34-cyberbaddies-had-a-field-day-in-2020","status":"publish","type":"post","link":"https:\/\/www.londonchiropracter.com\/?p=2153","title":{"rendered":"Pardon the Intrusion #34: Cyberbaddies had a field day in 2020"},"content":{"rendered":"\n

Subscribe to this bi-weekly newsletter here<\/a>!<\/em><\/strong><\/p>\n

Welcome to the latest edition of Pardon The Intrusion, TNW\u2019s <\/span>bi-weekly newsletter<\/a> in which we explore the wild world of security.<\/p>\n

2020 is finally over. The year was already surreal and tough enough, thanks to the pandemic.<\/span><\/p>\n

But the en masse shift to remote work and the race to find a vaccine <\/span>created unique threats<\/a> in cyberspace, allowing criminals and threat actors to mount a variety of attacks, ranging from phishing scams to sophisticated espionage campaigns aimed at <\/span>stealing COVID-19 research<\/a>.<\/span><\/p>\n

Ransomware attacks exploded in number, with an endless stream of compromises hitting schools, hospitals, government agencies, and private companies.<\/span><\/p>\n

Attackers not only demanded massive ransoms, but also <\/span>extracted large quantities of sensitive data<\/a> and threatened to publish them unless their demands are met. The average ransom payout <\/span>increased<\/a> from about $84,000 in 2019 to about $233,000 this year.<\/span><\/p>\n

2020 was also a great year for data breaches, which became a regular occurrence. Worse, weak or stolen passwords were tied to <\/span>37% of the breaches<\/a>.<\/span><\/p>\n

Some of the notable companies that were crippled by data breaches and ransomware attacks include Garmin, Vastaamo, Foxconn, Nintendo, Marriott, EasyJet, Big Basket, Dr. Reddy\u2019s, and Luxottica.<\/span><\/p>\n

<\/figure>\n

Web skimming attacks against ecommerce websites to steal credit card information flourished as well. The operators behind the campaigns stepped up their efforts to hide their malicious code inside image metadata and favicon files, and even <\/span>use Telegram messenger<\/a> to exfiltrate the data.<\/span><\/p>\n

Then came the great <\/span>Twitter hack<\/a> in July, when a number of high profile accounts were taken over to advertise a cryptocurrency scam. Subsequent investigation found that the attackers had tricked an employee into clicking on a phishing site that harvested the credentials of its internal systems. They used this administrative password to reset the passwords of the target Twitter accounts and take control.<\/span><\/p>\n

The most <\/span>devastating of the hacks<\/a> in 2020 was also saved for the last. Threat actors, likely from <\/span>Russia<\/a>, compromised a routine software update released by network monitoring software maker SolarWinds, and used it to deliver a backdoored update to as many as 18,000 customers, including FireEye, Microsoft, Cisco, VMware, and more.<\/span><\/p>\n

The breach came to light earlier on December after cybersecurity firm FireEye disclosed that it had suffered a breach and hackers had stolen its cache of Red Team tools it uses to assess the security infrastructure of its customers.<\/p>\n

What makes the SolarWinds supply chain attack more damaging is the level of sophistication and tradecraft used to stealthily break into the company\u2019s software distribution system as early as October 2019 before making their move in March.<\/p>\n

Cybersecurity is an endless tussle between digital thieves and defenders. It\u2019s a form of modern warfare playing out across an increasingly advanced threat landscape. And if 2020 is any indication, these attacks will only get more sophisticated.<\/span><\/p>\n

What\u2019s trending in security?<\/span><\/h3>\n

US intelligence agencies formally <\/span>accused Russia<\/a> of orchestrating the SolarWinds supply chain attack, police in Singapore can now <\/span>use data<\/a> collected by its COVID-19 contact tracing app to aid criminal investigations, and hackers <\/span>gained access<\/a> to the Finnish Parliament\u2019s IT systems.<\/span><\/p>\n