* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Saturday, October 4, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Books about the arts and some haunts for a Denton October – Denton Record-Chronicle

    Uncover Artistic Treasures and Spooky Adventures to Experience in Denton This October

    Taylor Swift Releases New Album The Life of a Showgirl : Listen and Read the Full Credits – Yahoo

    Taylor Swift Releases New Album The Life of a Showgirl : Listen and Read the Full Credits – Yahoo

    Toni Braxton Is Turning Her Biggest Hits Into Lifetime Movies – Yahoo

    Toni Braxton Is Turning Her Biggest Hits Into Lifetime Movies – Yahoo

    Major airline to offer new in-flight entertainment options for passengers – PennLive.com

    Major airline to offer new in-flight entertainment options for passengers – PennLive.com

    Penn State-Themed Restaurant and Entertainment Spot Happy Valley Live Set to Open in State College – StateCollege.com

    Penn State-Themed Restaurant and Entertainment Spot Happy Valley Live Set to Open in State College – StateCollege.com

    The Police Made Chart History With This 1979 Hit Nearly 50 Years Ago – Yahoo

    How The Police Changed Music Forever with Their Iconic 1979 Hit Nearly 50 Years Ago

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    MAC Brings iPad Technology to Football Sidelines Across All 13 Member Schools – Sports Video Group

    MAC Brings iPad Technology to Football Sidelines Across All 13 Member Schools – Sports Video Group

    Technology Is Becoming More Important Than Humans In CX – No Jitter

    Technology Is Becoming More Important Than Humans In CX – No Jitter

    A Tech Expo Shows What China Can Make, but Not Who’ll Buy It All – The New York Times

    Inside China’s Tech Expo: Cutting-Edge Innovations Face Uncertain Demand

    Steampunk Metal Oval Technology Sense Sunglasses Personality Handmade Chain Multicolor Sunglasses UV400 – The San Joaquin Valley Sun

    Steampunk Metal Oval Sunglasses with Handmade Multicolor Chain – Bold UV400 Protection and Unique Style

    STELLA Automotive AI Appoints Fred Seidelman as Chief Technology Officer – Yahoo Finance

    STELLA Automotive AI Appoints Fred Seidelman as New Chief Technology Officer

    Saving Energy and Money with Smart Technology – Terms of Service with Clare Duffy – Podcast on CNN Podcasts – CNN

    Saving Energy and Money with Smart Technology – Terms of Service with Clare Duffy – Podcast on CNN Podcasts – CNN

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Books about the arts and some haunts for a Denton October – Denton Record-Chronicle

    Uncover Artistic Treasures and Spooky Adventures to Experience in Denton This October

    Taylor Swift Releases New Album The Life of a Showgirl : Listen and Read the Full Credits – Yahoo

    Taylor Swift Releases New Album The Life of a Showgirl : Listen and Read the Full Credits – Yahoo

    Toni Braxton Is Turning Her Biggest Hits Into Lifetime Movies – Yahoo

    Toni Braxton Is Turning Her Biggest Hits Into Lifetime Movies – Yahoo

    Major airline to offer new in-flight entertainment options for passengers – PennLive.com

    Major airline to offer new in-flight entertainment options for passengers – PennLive.com

    Penn State-Themed Restaurant and Entertainment Spot Happy Valley Live Set to Open in State College – StateCollege.com

    Penn State-Themed Restaurant and Entertainment Spot Happy Valley Live Set to Open in State College – StateCollege.com

    The Police Made Chart History With This 1979 Hit Nearly 50 Years Ago – Yahoo

    How The Police Changed Music Forever with Their Iconic 1979 Hit Nearly 50 Years Ago

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    MAC Brings iPad Technology to Football Sidelines Across All 13 Member Schools – Sports Video Group

    MAC Brings iPad Technology to Football Sidelines Across All 13 Member Schools – Sports Video Group

    Technology Is Becoming More Important Than Humans In CX – No Jitter

    Technology Is Becoming More Important Than Humans In CX – No Jitter

    A Tech Expo Shows What China Can Make, but Not Who’ll Buy It All – The New York Times

    Inside China’s Tech Expo: Cutting-Edge Innovations Face Uncertain Demand

    Steampunk Metal Oval Technology Sense Sunglasses Personality Handmade Chain Multicolor Sunglasses UV400 – The San Joaquin Valley Sun

    Steampunk Metal Oval Sunglasses with Handmade Multicolor Chain – Bold UV400 Protection and Unique Style

    STELLA Automotive AI Appoints Fred Seidelman as Chief Technology Officer – Yahoo Finance

    STELLA Automotive AI Appoints Fred Seidelman as New Chief Technology Officer

    Saving Energy and Money with Smart Technology – Terms of Service with Clare Duffy – Podcast on CNN Podcasts – CNN

    Saving Energy and Money with Smart Technology – Terms of Service with Clare Duffy – Podcast on CNN Podcasts – CNN

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Business

Ditch SMS-based MFA, urges board investigating Lapsus$ gang’s successful attacks

August 11, 2023
in Business
Ditch SMS-based MFA, urges board investigating Lapsus$ gang’s successful attacks
Share on FacebookShare on Twitter

Many organizations victimized by the Lapsus$ extortion gangs through SIM swapping and tricking employees through social engineering have only themselves to blame for being hacked, suggests a U.S. government report.

The report released Thursday by the Cyber Safety Review Board, a branch of the Department of Homeland Security, had unkind things to say about companies, telecom carriers, and the reliance on easily-bypassed text-based SMS systems for multifactor authentication (MFA).

“Lapsus$ made clear just how easy it was for its members (juveniles, in some instances) to infiltrate well-defended organizations,” the report says in part. “Lapsus$ exploited systemic ecosystem weaknesses to infiltrate and extort organizations, sometimes appearing to do so for nothing more than attention and public notoriety.”

Attacks linked to Lapsus$ and associated groups include:

— accessing one organization’s enterprise tools, including SaaS applications that contained source code and customer data, such as Atlassian, Cloudflare, and Slack;
— stealing source code from a telecommunications provider. This is possibly a reference to an attack on T-Mobile;
— stealing 200 gGB of corporate data from a Kansas-based surgical and rehabilitation center;
— stealing approximately 37 GB of source code for over 250 projects from a technology company, after which Lapsus$ made it available for download in an online torrent posted on its Telegram channel. This appears to be a reference to a Microsoft hack;
— stealing and publishing source code for two flagship games from a gaming company, including related assets from the company’s Confluence and Slack servers;
— and stealing and deleting 50 TB of data, including a COVID-19 database, from a non-U.S. government agency.

“Among its findings,” the agency said in a news release accompanying the report, “the Board saw a collective failure across organizations to account for the risks associated with using text messaging and voice calls for multi-factor authentication.”

In one example cited by the report, in January 2022 the gang gained access to privileged internal tools of an unnamed third-party service provider by compromising the computer of a customer support contractor from one of its business process outsourcers. The real
target of this attack was not the third-party service provider, nor the outsourcer, but the downstream customers of the service provider.

“This is a remarkable example of a creative three-stage supply chain attack used by this
class of threat actors,” the report says.

Although the service provider isn’t named, it is similar to the widely-reported 2022 compromise of a contractor of identity and access manager Okta.

One tactic of the gang: Impersonating police and making fraudulent Emergency Disclosure Requests to wireless carriers to obtain sensitive information about targets.

Some of that information enabled SIM swapping by convincing a carrier — or hacking the account of a carrier’s customer support staff — to switch a target’s mobile phone number to smartphones controlled by the gang. Then it could intercept SMS and voice calls and receive MFA-related messages that control access to online email and bank accounts.

The report describes Lapsus$ as a loosely organized group, which included several juveniles, based mainly in the U.K. and Brazil. It had eight to 10 known members as of April 2022. The previous month, police in England arrested seven individuals in connection with Lapsus$. Two juveniles were charged. In September, U.K. police arrested a 17-year-old on suspicion of hacking. Media reports quoted experts believing the three arrests were related to Lapsus$’s attacks against technology and gaming companies. Then, in October, Brazilian police said they had arrested a Brazilian national suspected of belonging to Lapsus$.

Since then, Lapsus$ activity has disappeared. The report’s authors say they can’t rule out the possibility that other gang members are lying low.

Among the board’s recommendations:

— organizations must “urgently” implement improved access controls and authentication methods, and transition away from voice and SMS-based MFA. It’s a recommendation experts have been making for years. “Those methods are particularly vulnerable,” says the report. Instead, organizations should adopt easy-to-use, secure-by-default, passwordless solutions such as Fast IDentity Online (FIDO)2-compliant, phishing-resistant MFA methods.

To facilitate the transition to passwordless authentication, the board recommends Washington develop a secure authentication roadmap for the U.S.;

— carriers should implement more stringent authentication methods to prevent fraudulent SIM swapping;

— organizations should prioritize resiliency and fast recovery to defend against SIM swapping attacks;

— organizations should plan for disruptive cyber intrusions by requiring their whole business, including outside suppliers, to invest in prevention, detection, response, and recovery capabilities;

— Congress should support the creation of “whole-of-society” programs and mechanisms to prevent juvenile cybercrime.

Lapsus$ was not successful in all its attempted attacks, the report adds. Organizations with mature, defense-in-depth controls were most resilient to these threat actor groups. Organizations that used application or token-based MFA methods or employed robust network intrusion detection systems, including rapid detection of suspicious account activity, were especially resilient.

“Organizations that maintained and followed their established incident response procedures significantly mitigated impacts,” the report noted. “Highly effective organizations employed mechanisms such as out-of-band communications that allowed incident response professionals to co-ordinate response efforts without being monitored by the threat actors.”

“We need better technologies that move us towards a passwordless world, negating the effects of credential theft,” the report concludes. “We need telecommunications providers to design and implement processes and systems that keep attackers from hijacking mobile phone service. We need to double down on zero trust architectures that assume breach. We need organizations to design their security programs to cover not only their own information technology environments, but also those of their vendors that host critical data or maintain direct network access. We need to give law enforcement the means to disrupt all manner of threat actors. And we need to help curious young people use their growing digital skills for positive purposes.”

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : ITBusiness.ca – https://www.itbusiness.ca/news/ditch-sms-based-mfa-urges-board-investigating-lapsus-gangs-successful-attacks/125806

Tags: businessditchSMS-based
Previous Post

Black Hat: Tenable to add AI query module to its Exposure Management platform; DARPA AI Cyber Challenge announced

Next Post

Alberta dental plan administrator paid ransomware gang after attack

‘This is unprecedented:’ Ecology restricts surface water use in the Yakima River Basin – Yakima Herald-Republic

Unprecedented Move: Ecology Imposes New Restrictions on Yakima River Basin Surface Water Use

October 4, 2025
Roane State, TCAT Knoxville mark milestone at new health science campus – Oakridger

Roane State and TCAT Knoxville Celebrate Major Milestone at New Health Science Campus

October 4, 2025
Science Hill blanks Morristown East – Johnson City Press

Science Hill Cruises to a Commanding Shutout Over Morristown East

October 4, 2025
Favorite Halloween candies in Missouri, Oklahoma, Kansas, Arkansas – Yahoo

Discover the Most Beloved Halloween Candies in Missouri, Oklahoma, Kansas, and Arkansas!

October 4, 2025
MAC Brings iPad Technology to Football Sidelines Across All 13 Member Schools – Sports Video Group

MAC Brings iPad Technology to Football Sidelines Across All 13 Member Schools – Sports Video Group

October 4, 2025
Dodgers’ Roki Sasaki opens up about pitching in relief – Yahoo Sports

Dodgers’ Roki Sasaki opens up about pitching in relief – Yahoo Sports

October 4, 2025
Ageing and health – World Health Organization (WHO)

Ageing and health – World Health Organization (WHO)

October 3, 2025
CFOs confident in their own companies but not in the economy – CFO.com

CFOs Reveal Unshakable Confidence in Their Companies Amid Economic Uncertainty

October 3, 2025
Books about the arts and some haunts for a Denton October – Denton Record-Chronicle

Uncover Artistic Treasures and Spooky Adventures to Experience in Denton This October

October 3, 2025
WFSD Announces Northwell Mental Health Partnership – William Floyd School District

WFSD Announces Northwell Mental Health Partnership – William Floyd School District

October 3, 2025

Categories

Archives

October 2025
M T W T F S S
 12345
6789101112
13141516171819
20212223242526
2728293031  
« Sep    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (850)
  • Economy (870)
  • Entertainment (21,744)
  • General (17,397)
  • Health (9,913)
  • Lifestyle (883)
  • News (22,149)
  • People (872)
  • Politics (881)
  • Science (16,081)
  • Sports (21,371)
  • Technology (15,853)
  • World (853)

Recent News

‘This is unprecedented:’ Ecology restricts surface water use in the Yakima River Basin – Yakima Herald-Republic

Unprecedented Move: Ecology Imposes New Restrictions on Yakima River Basin Surface Water Use

October 4, 2025
Roane State, TCAT Knoxville mark milestone at new health science campus – Oakridger

Roane State and TCAT Knoxville Celebrate Major Milestone at New Health Science Campus

October 4, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version