* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Saturday, July 26, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    City of Pelham announces entertainment district plans for former Oak Mountain Amphitheatre site – WVTM

    Pelham Unveils Exciting New Entertainment District Plans for Former Oak Mountain Amphitheatre Site

    Black Box Players presents ‘The Three Musketeers’ – CBS 19 News

    Experience the Adventure: Black Box Players Bring ‘The Three Musketeers’ to Life!

    AP Entertainment SummaryBrief at 1:51 p.m. EDT – Channel 3000

    Entertainment Highlights: Key Updates You Can’t Miss

    ‘Devil Wears Prada 2’ casts Anne Hathaway’s love interest replacing Adrian Grenier’s Nate – Entertainment Weekly

    Devil Wears Prada 2′ Casts New Love Interest for Anne Hathaway, Replacing Adrian Grenier’s Nate

    12 ‘Late Show’ Moments Proving Stephen Colbert Can’t Be Replaced – The Mountaineer

    12 Unforgettable ‘Late Show’ Moments That Prove Stephen Colbert Is Truly One of a Kind

    Canes owner Tom Dundon’s real estate firm eyes entertainment complex near RDU – The Business Journals

    Canes Owner Tom Dundon’s Real Estate Firm Unveils Plans for Thrilling New Entertainment Complex Near RDU

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

    Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

    WhoFi: New surveillance technology can track people by how they disrupt Wi-Fi signals – Tech Xplore

    WhoFi: New surveillance technology can track people by how they disrupt Wi-Fi signals – Tech Xplore

    Google Cloud Announced as a Key Technology Partner for Odoo Connect 2025 in San Francisco – GlobeNewswire

    Google Cloud Announced as a Key Technology Partner for Odoo Connect 2025 in San Francisco – GlobeNewswire

    Behind the Screens: The Impact of Technology on Real Estate – TRREB

    Behind the Screens: How Technology is Transforming the Future of Real Estate

    Sustainserv and Palau Announce Technology Partnership to Leverage Innovative AI Platform to Advance Sustainability Reporting – Business Wire

    Sustainserv and Palau Team Up to Transform Sustainability Reporting with Breakthrough AI Technology

    Morgan Adamski Joins PwC in Newly Created Cyber, Data & Technology Risk Division – HSToday

    Morgan Adamski Leads the Charge in PwC’s Cutting-Edge Cyber, Data & Technology Risk Division

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    City of Pelham announces entertainment district plans for former Oak Mountain Amphitheatre site – WVTM

    Pelham Unveils Exciting New Entertainment District Plans for Former Oak Mountain Amphitheatre Site

    Black Box Players presents ‘The Three Musketeers’ – CBS 19 News

    Experience the Adventure: Black Box Players Bring ‘The Three Musketeers’ to Life!

    AP Entertainment SummaryBrief at 1:51 p.m. EDT – Channel 3000

    Entertainment Highlights: Key Updates You Can’t Miss

    ‘Devil Wears Prada 2’ casts Anne Hathaway’s love interest replacing Adrian Grenier’s Nate – Entertainment Weekly

    Devil Wears Prada 2′ Casts New Love Interest for Anne Hathaway, Replacing Adrian Grenier’s Nate

    12 ‘Late Show’ Moments Proving Stephen Colbert Can’t Be Replaced – The Mountaineer

    12 Unforgettable ‘Late Show’ Moments That Prove Stephen Colbert Is Truly One of a Kind

    Canes owner Tom Dundon’s real estate firm eyes entertainment complex near RDU – The Business Journals

    Canes Owner Tom Dundon’s Real Estate Firm Unveils Plans for Thrilling New Entertainment Complex Near RDU

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

    Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

    WhoFi: New surveillance technology can track people by how they disrupt Wi-Fi signals – Tech Xplore

    WhoFi: New surveillance technology can track people by how they disrupt Wi-Fi signals – Tech Xplore

    Google Cloud Announced as a Key Technology Partner for Odoo Connect 2025 in San Francisco – GlobeNewswire

    Google Cloud Announced as a Key Technology Partner for Odoo Connect 2025 in San Francisco – GlobeNewswire

    Behind the Screens: The Impact of Technology on Real Estate – TRREB

    Behind the Screens: How Technology is Transforming the Future of Real Estate

    Sustainserv and Palau Announce Technology Partnership to Leverage Innovative AI Platform to Advance Sustainability Reporting – Business Wire

    Sustainserv and Palau Team Up to Transform Sustainability Reporting with Breakthrough AI Technology

    Morgan Adamski Joins PwC in Newly Created Cyber, Data & Technology Risk Division – HSToday

    Morgan Adamski Leads the Charge in PwC’s Cutting-Edge Cyber, Data & Technology Risk Division

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Business

Ditch SMS-based MFA, urges board investigating Lapsus$ gang’s successful attacks

August 11, 2023
in Business
Ditch SMS-based MFA, urges board investigating Lapsus$ gang’s successful attacks
Share on FacebookShare on Twitter

Many organizations victimized by the Lapsus$ extortion gangs through SIM swapping and tricking employees through social engineering have only themselves to blame for being hacked, suggests a U.S. government report.

The report released Thursday by the Cyber Safety Review Board, a branch of the Department of Homeland Security, had unkind things to say about companies, telecom carriers, and the reliance on easily-bypassed text-based SMS systems for multifactor authentication (MFA).

“Lapsus$ made clear just how easy it was for its members (juveniles, in some instances) to infiltrate well-defended organizations,” the report says in part. “Lapsus$ exploited systemic ecosystem weaknesses to infiltrate and extort organizations, sometimes appearing to do so for nothing more than attention and public notoriety.”

Attacks linked to Lapsus$ and associated groups include:

— accessing one organization’s enterprise tools, including SaaS applications that contained source code and customer data, such as Atlassian, Cloudflare, and Slack;
— stealing source code from a telecommunications provider. This is possibly a reference to an attack on T-Mobile;
— stealing 200 gGB of corporate data from a Kansas-based surgical and rehabilitation center;
— stealing approximately 37 GB of source code for over 250 projects from a technology company, after which Lapsus$ made it available for download in an online torrent posted on its Telegram channel. This appears to be a reference to a Microsoft hack;
— stealing and publishing source code for two flagship games from a gaming company, including related assets from the company’s Confluence and Slack servers;
— and stealing and deleting 50 TB of data, including a COVID-19 database, from a non-U.S. government agency.

“Among its findings,” the agency said in a news release accompanying the report, “the Board saw a collective failure across organizations to account for the risks associated with using text messaging and voice calls for multi-factor authentication.”

In one example cited by the report, in January 2022 the gang gained access to privileged internal tools of an unnamed third-party service provider by compromising the computer of a customer support contractor from one of its business process outsourcers. The real
target of this attack was not the third-party service provider, nor the outsourcer, but the downstream customers of the service provider.

“This is a remarkable example of a creative three-stage supply chain attack used by this
class of threat actors,” the report says.

Although the service provider isn’t named, it is similar to the widely-reported 2022 compromise of a contractor of identity and access manager Okta.

One tactic of the gang: Impersonating police and making fraudulent Emergency Disclosure Requests to wireless carriers to obtain sensitive information about targets.

Some of that information enabled SIM swapping by convincing a carrier — or hacking the account of a carrier’s customer support staff — to switch a target’s mobile phone number to smartphones controlled by the gang. Then it could intercept SMS and voice calls and receive MFA-related messages that control access to online email and bank accounts.

The report describes Lapsus$ as a loosely organized group, which included several juveniles, based mainly in the U.K. and Brazil. It had eight to 10 known members as of April 2022. The previous month, police in England arrested seven individuals in connection with Lapsus$. Two juveniles were charged. In September, U.K. police arrested a 17-year-old on suspicion of hacking. Media reports quoted experts believing the three arrests were related to Lapsus$’s attacks against technology and gaming companies. Then, in October, Brazilian police said they had arrested a Brazilian national suspected of belonging to Lapsus$.

Since then, Lapsus$ activity has disappeared. The report’s authors say they can’t rule out the possibility that other gang members are lying low.

Among the board’s recommendations:

— organizations must “urgently” implement improved access controls and authentication methods, and transition away from voice and SMS-based MFA. It’s a recommendation experts have been making for years. “Those methods are particularly vulnerable,” says the report. Instead, organizations should adopt easy-to-use, secure-by-default, passwordless solutions such as Fast IDentity Online (FIDO)2-compliant, phishing-resistant MFA methods.

To facilitate the transition to passwordless authentication, the board recommends Washington develop a secure authentication roadmap for the U.S.;

— carriers should implement more stringent authentication methods to prevent fraudulent SIM swapping;

— organizations should prioritize resiliency and fast recovery to defend against SIM swapping attacks;

— organizations should plan for disruptive cyber intrusions by requiring their whole business, including outside suppliers, to invest in prevention, detection, response, and recovery capabilities;

— Congress should support the creation of “whole-of-society” programs and mechanisms to prevent juvenile cybercrime.

Lapsus$ was not successful in all its attempted attacks, the report adds. Organizations with mature, defense-in-depth controls were most resilient to these threat actor groups. Organizations that used application or token-based MFA methods or employed robust network intrusion detection systems, including rapid detection of suspicious account activity, were especially resilient.

“Organizations that maintained and followed their established incident response procedures significantly mitigated impacts,” the report noted. “Highly effective organizations employed mechanisms such as out-of-band communications that allowed incident response professionals to co-ordinate response efforts without being monitored by the threat actors.”

“We need better technologies that move us towards a passwordless world, negating the effects of credential theft,” the report concludes. “We need telecommunications providers to design and implement processes and systems that keep attackers from hijacking mobile phone service. We need to double down on zero trust architectures that assume breach. We need organizations to design their security programs to cover not only their own information technology environments, but also those of their vendors that host critical data or maintain direct network access. We need to give law enforcement the means to disrupt all manner of threat actors. And we need to help curious young people use their growing digital skills for positive purposes.”

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : ITBusiness.ca – https://www.itbusiness.ca/news/ditch-sms-based-mfa-urges-board-investigating-lapsus-gangs-successful-attacks/125806

Tags: businessditchSMS-based
Previous Post

Black Hat: Tenable to add AI query module to its Exposure Management platform; DARPA AI Cyber Challenge announced

Next Post

Alberta dental plan administrator paid ransomware gang after attack

Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

July 25, 2025
From sports day to shelter: Thai family flees shelling from Cambodia – Reuters

From sports day to shelter: Thai family flees shelling from Cambodia – Reuters

July 25, 2025
When can we detect lianas from space? Toward a mechanistic understanding of liana-infested forest optics – ESA Journals

Unveiling Forest Canopies: How Satellite Technology Detects Lianas from Space

July 25, 2025
China launches world’s first robot that can run by itself 24/7 — watch it change its own batteries in unsettling new footage – Live Science

China launches world’s first robot that can run by itself 24/7 — watch it change its own batteries in unsettling new footage – Live Science

July 25, 2025
Enjoy Indoor Summer Fun at This Science Center in Rye, New Hampshire – Only In Your State

Discover Exciting Indoor Summer Adventures at This Science Center in Rye, New Hampshire

July 25, 2025
Superhero Lifestyle Collections – Trend Hunter

Discover the Ultimate Superhero Lifestyle Collections Transforming Everyday Living

July 25, 2025
How to watch Katie Ledecky at the 2025 World Swimming Championships – NBC Sports

Don’t Miss a Second: How to Watch Katie Ledecky Shine at the 2025 World Swimming Championships

July 25, 2025
Space Foundation Study: Space economy worth $600bn+ – news.satnews.com

Space Foundation Study: Space economy worth $600bn+ – news.satnews.com

July 25, 2025
City of Pelham announces entertainment district plans for former Oak Mountain Amphitheatre site – WVTM

Pelham Unveils Exciting New Entertainment District Plans for Former Oak Mountain Amphitheatre Site

July 25, 2025
Advocates talk benefits of single-payer health care in Greenfield forum – Athol Daily News

Advocates Highlight the Benefits of Single-Payer Health Care at Greenfield Forum

July 25, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (738)
  • Economy (762)
  • Entertainment (21,643)
  • General (16,102)
  • Health (9,800)
  • Lifestyle (770)
  • News (22,149)
  • People (764)
  • Politics (771)
  • Science (15,977)
  • Sports (21,260)
  • Technology (15,745)
  • World (745)

Recent News

Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

Validea’s Top Information Technology Stocks Based On Peter Lynch – 7/25/2025 – Nasdaq

July 25, 2025
From sports day to shelter: Thai family flees shelling from Cambodia – Reuters

From sports day to shelter: Thai family flees shelling from Cambodia – Reuters

July 25, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version