Capital One Has Major Breach

Major US financial institution Capital One has been compromised by a software engineer specializing in cloud technology. The data breach consists of records of 100 million people from the US and 6 million in Canada, including names, addresses, dates of birth, credit scores and transaction data. Additionally, the breach included around 140,000 American Social Security Numbers, 80,000 linked bank account numbers, and around 1 million Canadian Social Insurance Numbers.

On Monday, July 29, 2019, The Department of Justice disclosed the arrest of of Paige A. Thompson, charged with the download of nearly 30 GB of data from Capital One’s cloud service.

Recommendations

If not already enabled, turn on the compromised credentials rule and cyber attack chatter for all relevant entities and ensure relevant emails and 'Capital One' related terms are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

According to an article posted by KrebsOnSecurity, Capital One was informed by an email on July 17th about the possibility of leaked information on a public repository on the mentioned platform. This repository belonged to the ex-Amazon employee, Paige A. Thompson. This person used the moniker ”erratic”, where she posted publicly on Twitter very specific ways she would compromise an organization's AWS infrastructure. The account has already been suspended. This person also used the 'Netcrave Communications' Slack Channel, an instant messaging app commonly used by developers, where she made several posts about being in possession of tens of GBs of data belonging to major companies.

The complaint for Violation of Computer Fraud and Abuse was published by the United States District Court for the Western District of Washington at Seattle, detailing that Thompson had accessed a computer containing information belonging to Capital One Financial Corporation from March 12th 2019 to July 17th 2019, without authorization.

Breaking News - 07.31.2019

Android Ransomware is Back

A new family of Android ransomware has been identified, spread via SMS and other forums. This ransomware spreads malicious links by accessing the contact list and sending texts in 42 different languages based on the phone configuration.

See the full report here: https://www.welivesecurity.com/2019/07/29/android-ransomware-back/

$1.7 Million lost in BEC Scam, North Carolina

North Carolina has fallen victim to a BEC scam. Criminals convinced employees that the bank account information of third-party service providers had changed and routed the payments into attacker-controlled accounts via email.

See the full report here: https://www.bleepingcomputer.com/news/security/north-carolina-county-lost-17-million-in-bec-scam/

Wifiphisher: The new way to get anyone’s Wi-Fi password without cracking

Medium posted a new way to access Wi-Fi passwords by jamming networks and creating an evil-clone that will ask for credentials for people already connected disguising as firmware update.

See the full report here: https://medium.com/@NullByteWht/how-to-hack-wi-fi-get-anyones-wi-fi-password-without-cracking-using-wifiphisher-1d0a6c95f67a