* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Friday, May 30, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Weekly Entertainment Report May 29-June 1: Where to find lively arts, music, and shows – Manchester Ink Link

    Weekly Entertainment Report May 29-June 1: Where to find lively arts, music, and shows – Manchester Ink Link

    Aziz Ansari made Keanu Reeves Indian food so he wouldn’t feel ‘freaked out’ directing him in Good Fortune (exclusive) – Entertainment Weekly

    Aziz Ansari Whips Up Indian Cuisine for Keanu Reeves to Ease Directing Jitters in Good Fortune

    Cassie Ventura welcomes third child – crossroadstoday.com

    Cassie Ventura Joyfully Welcomes Her Third Child!

    Drew Brees opens Surge Entertainment Center in Metairie hot spot for new businesses – NOLA.com

    Drew Brees Unveils Exciting New Surge Entertainment Center in Metairie!

    Will Gio Stay Or Go On May 27 General Hospital? – Yahoo

    Will Gio Make a Shocking Exit on May 27th’s General Hospital

    First look: Disney shows star villains, Little Mermaid, tech – Yahoo

    Unveiling Disney’s Dark Side: A Sneak Peek at Iconic Villains, The Little Mermaid, and Cutting-Edge Technology!

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    4Liberty Announces Collaboration with Itron to Drive Innovation in Utility Technology Adoption and Optimization – FinancialContent

    4Liberty Partners with Itron to Revolutionize Utility Technology and Boost Innovation

    Q1 2025 Quantum Technology Investment: What’s Driving the Surge in Quantum Investment? – The Quantum Insider

    Unleashing the Future: Exploring the Surge in Quantum Technology Investments for Q1 2025

    MIT Team Releases Tempting Report on Electric Aircraft Technology – AVweb

    MIT Team Releases Tempting Report on Electric Aircraft Technology – AVweb

    MSE, DXC Technology expand tech partnership – Sports Business Journal

    MSE, DXC Technology expand tech partnership – Sports Business Journal

    Technology Driving Performance: How Elite MA Plans Leverage Data, Care Coordination, and Advanced Analytics to Thrive Amid CMS’s Rigorous 2025 Standards, Black Book – Newswire.com

    Unlocking Success: How Top MA Plans Harness Data and Analytics to Excel Under CMS’s 2025 Standards

    Arqit acquires Ampliphae’s technology IP, enhancing its global encryption portfolio – GlobeNewswire

    Arqit Boosts Global Encryption Portfolio with Strategic Acquisition of Ampliphae’s Technology IP

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Weekly Entertainment Report May 29-June 1: Where to find lively arts, music, and shows – Manchester Ink Link

    Weekly Entertainment Report May 29-June 1: Where to find lively arts, music, and shows – Manchester Ink Link

    Aziz Ansari made Keanu Reeves Indian food so he wouldn’t feel ‘freaked out’ directing him in Good Fortune (exclusive) – Entertainment Weekly

    Aziz Ansari Whips Up Indian Cuisine for Keanu Reeves to Ease Directing Jitters in Good Fortune

    Cassie Ventura welcomes third child – crossroadstoday.com

    Cassie Ventura Joyfully Welcomes Her Third Child!

    Drew Brees opens Surge Entertainment Center in Metairie hot spot for new businesses – NOLA.com

    Drew Brees Unveils Exciting New Surge Entertainment Center in Metairie!

    Will Gio Stay Or Go On May 27 General Hospital? – Yahoo

    Will Gio Make a Shocking Exit on May 27th’s General Hospital

    First look: Disney shows star villains, Little Mermaid, tech – Yahoo

    Unveiling Disney’s Dark Side: A Sneak Peek at Iconic Villains, The Little Mermaid, and Cutting-Edge Technology!

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    4Liberty Announces Collaboration with Itron to Drive Innovation in Utility Technology Adoption and Optimization – FinancialContent

    4Liberty Partners with Itron to Revolutionize Utility Technology and Boost Innovation

    Q1 2025 Quantum Technology Investment: What’s Driving the Surge in Quantum Investment? – The Quantum Insider

    Unleashing the Future: Exploring the Surge in Quantum Technology Investments for Q1 2025

    MIT Team Releases Tempting Report on Electric Aircraft Technology – AVweb

    MIT Team Releases Tempting Report on Electric Aircraft Technology – AVweb

    MSE, DXC Technology expand tech partnership – Sports Business Journal

    MSE, DXC Technology expand tech partnership – Sports Business Journal

    Technology Driving Performance: How Elite MA Plans Leverage Data, Care Coordination, and Advanced Analytics to Thrive Amid CMS’s Rigorous 2025 Standards, Black Book – Newswire.com

    Unlocking Success: How Top MA Plans Harness Data and Analytics to Excel Under CMS’s 2025 Standards

    Arqit acquires Ampliphae’s technology IP, enhancing its global encryption portfolio – GlobeNewswire

    Arqit Boosts Global Encryption Portfolio with Strategic Acquisition of Ampliphae’s Technology IP

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Business

Ditch SMS-based MFA, urges board investigating Lapsus$ gang’s successful attacks

August 11, 2023
in Business
Ditch SMS-based MFA, urges board investigating Lapsus$ gang’s successful attacks
Share on FacebookShare on Twitter

Many organizations victimized by the Lapsus$ extortion gangs through SIM swapping and tricking employees through social engineering have only themselves to blame for being hacked, suggests a U.S. government report.

The report released Thursday by the Cyber Safety Review Board, a branch of the Department of Homeland Security, had unkind things to say about companies, telecom carriers, and the reliance on easily-bypassed text-based SMS systems for multifactor authentication (MFA).

“Lapsus$ made clear just how easy it was for its members (juveniles, in some instances) to infiltrate well-defended organizations,” the report says in part. “Lapsus$ exploited systemic ecosystem weaknesses to infiltrate and extort organizations, sometimes appearing to do so for nothing more than attention and public notoriety.”

Attacks linked to Lapsus$ and associated groups include:

— accessing one organization’s enterprise tools, including SaaS applications that contained source code and customer data, such as Atlassian, Cloudflare, and Slack;
— stealing source code from a telecommunications provider. This is possibly a reference to an attack on T-Mobile;
— stealing 200 gGB of corporate data from a Kansas-based surgical and rehabilitation center;
— stealing approximately 37 GB of source code for over 250 projects from a technology company, after which Lapsus$ made it available for download in an online torrent posted on its Telegram channel. This appears to be a reference to a Microsoft hack;
— stealing and publishing source code for two flagship games from a gaming company, including related assets from the company’s Confluence and Slack servers;
— and stealing and deleting 50 TB of data, including a COVID-19 database, from a non-U.S. government agency.

“Among its findings,” the agency said in a news release accompanying the report, “the Board saw a collective failure across organizations to account for the risks associated with using text messaging and voice calls for multi-factor authentication.”

In one example cited by the report, in January 2022 the gang gained access to privileged internal tools of an unnamed third-party service provider by compromising the computer of a customer support contractor from one of its business process outsourcers. The real
target of this attack was not the third-party service provider, nor the outsourcer, but the downstream customers of the service provider.

“This is a remarkable example of a creative three-stage supply chain attack used by this
class of threat actors,” the report says.

Although the service provider isn’t named, it is similar to the widely-reported 2022 compromise of a contractor of identity and access manager Okta.

One tactic of the gang: Impersonating police and making fraudulent Emergency Disclosure Requests to wireless carriers to obtain sensitive information about targets.

Some of that information enabled SIM swapping by convincing a carrier — or hacking the account of a carrier’s customer support staff — to switch a target’s mobile phone number to smartphones controlled by the gang. Then it could intercept SMS and voice calls and receive MFA-related messages that control access to online email and bank accounts.

The report describes Lapsus$ as a loosely organized group, which included several juveniles, based mainly in the U.K. and Brazil. It had eight to 10 known members as of April 2022. The previous month, police in England arrested seven individuals in connection with Lapsus$. Two juveniles were charged. In September, U.K. police arrested a 17-year-old on suspicion of hacking. Media reports quoted experts believing the three arrests were related to Lapsus$’s attacks against technology and gaming companies. Then, in October, Brazilian police said they had arrested a Brazilian national suspected of belonging to Lapsus$.

Since then, Lapsus$ activity has disappeared. The report’s authors say they can’t rule out the possibility that other gang members are lying low.

Among the board’s recommendations:

— organizations must “urgently” implement improved access controls and authentication methods, and transition away from voice and SMS-based MFA. It’s a recommendation experts have been making for years. “Those methods are particularly vulnerable,” says the report. Instead, organizations should adopt easy-to-use, secure-by-default, passwordless solutions such as Fast IDentity Online (FIDO)2-compliant, phishing-resistant MFA methods.

To facilitate the transition to passwordless authentication, the board recommends Washington develop a secure authentication roadmap for the U.S.;

— carriers should implement more stringent authentication methods to prevent fraudulent SIM swapping;

— organizations should prioritize resiliency and fast recovery to defend against SIM swapping attacks;

— organizations should plan for disruptive cyber intrusions by requiring their whole business, including outside suppliers, to invest in prevention, detection, response, and recovery capabilities;

— Congress should support the creation of “whole-of-society” programs and mechanisms to prevent juvenile cybercrime.

Lapsus$ was not successful in all its attempted attacks, the report adds. Organizations with mature, defense-in-depth controls were most resilient to these threat actor groups. Organizations that used application or token-based MFA methods or employed robust network intrusion detection systems, including rapid detection of suspicious account activity, were especially resilient.

“Organizations that maintained and followed their established incident response procedures significantly mitigated impacts,” the report noted. “Highly effective organizations employed mechanisms such as out-of-band communications that allowed incident response professionals to co-ordinate response efforts without being monitored by the threat actors.”

“We need better technologies that move us towards a passwordless world, negating the effects of credential theft,” the report concludes. “We need telecommunications providers to design and implement processes and systems that keep attackers from hijacking mobile phone service. We need to double down on zero trust architectures that assume breach. We need organizations to design their security programs to cover not only their own information technology environments, but also those of their vendors that host critical data or maintain direct network access. We need to give law enforcement the means to disrupt all manner of threat actors. And we need to help curious young people use their growing digital skills for positive purposes.”

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : ITBusiness.ca – https://www.itbusiness.ca/news/ditch-sms-based-mfa-urges-board-investigating-lapsus-gangs-successful-attacks/125806

Tags: businessditchSMS-based
Previous Post

Black Hat: Tenable to add AI query module to its Exposure Management platform; DARPA AI Cyber Challenge announced

Next Post

Alberta dental plan administrator paid ransomware gang after attack

UMC Health System, Texas Tech HSC to honor endowed chairs, professors – Lubbock Avalanche-Journal

Celebrating Excellence: UMC Health System and Texas Tech HSC Honor Distinguished Professors and Endowed Chairs

May 30, 2025
Paris on Politics: Israel-Gaza conflict gets personal in Chicago’s City Council – FOX 32 Chicago

Paris on Politics: Israel-Gaza conflict gets personal in Chicago’s City Council – FOX 32 Chicago

May 30, 2025
Anduril and Meta Team Up to Transform XR for the American Military – Anduril

Revolutionizing Military Training: Anduril and Meta Join Forces to Enhance XR Technology

May 30, 2025
Tennessee Sports Wagering Council cracks down on illegal sportsbooks – WKRN News 2

Tennessee Sports Wagering Council cracks down on illegal sportsbooks – WKRN News 2

May 29, 2025
Geographic redistributions are insufficient to mitigate exposure to climate change in North American birds – Nature

Why Geographic Shifts Alone Won’t Save North American Birds from Climate Change

May 29, 2025
News: NATO Science for Peace and Security Programme launches new call for research proposals , 23-May.-2025 – NATO – Homepage

News: NATO Science for Peace and Security Programme launches new call for research proposals , 23-May.-2025 – NATO – Homepage

May 29, 2025
Trump’s Executive Order Puts Science Under the Thumb of Politics – The Equation – Union of Concerned Scientists

Trump’s Executive Order: A New Era of Political Control Over Science

May 29, 2025
CBS Sports Secures Media Rights to PBA World Series of Bowling in New Two-Year Agreement – PBA Tour

Exciting New Era: CBS Sports Lands Exclusive Media Rights for PBA World Series of Bowling!

May 29, 2025
Utah Tourist Economy to Take $132 Million Annual Blow from Sundance Film Festival Moving to Colorado – SnowBrains

Utah’s Tourist Economy Faces $132 Million Hit as Sundance Film Festival Heads to Colorado

May 29, 2025
Weekly Entertainment Report May 29-June 1: Where to find lively arts, music, and shows – Manchester Ink Link

Weekly Entertainment Report May 29-June 1: Where to find lively arts, music, and shows – Manchester Ink Link

May 29, 2025

Categories

Archives

May 2025
MTWTFSS
 1234
567891011
12131415161718
19202122232425
262728293031 
« Apr    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (650)
  • Economy (663)
  • Entertainment (21,570)
  • General (15,248)
  • Health (9,706)
  • Lifestyle (665)
  • News (22,149)
  • People (665)
  • Politics (672)
  • Science (15,885)
  • Sports (21,170)
  • Technology (15,651)
  • World (651)

Recent News

UMC Health System, Texas Tech HSC to honor endowed chairs, professors – Lubbock Avalanche-Journal

Celebrating Excellence: UMC Health System and Texas Tech HSC Honor Distinguished Professors and Endowed Chairs

May 30, 2025
Paris on Politics: Israel-Gaza conflict gets personal in Chicago’s City Council – FOX 32 Chicago

Paris on Politics: Israel-Gaza conflict gets personal in Chicago’s City Council – FOX 32 Chicago

May 30, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version