Novant Health hacked / Android update already broken by hackers / New Chrome flaw abused by hackers

Plus: USB drives are still a big hacking risk for enterprises

Inside.com Part of   Network August 17, 2022

Presented by

Novant Health, a U.S.-based healthcare company, is warning customers of a possible breach. The breach may have happened as a result of a Facebook tracking link. More: Novant Health has reportedly sent over 1.3 million emails that have warned users to be careful and to report any irregularities they experience.  The stolen data may include information such as email address, phone number, computer IP address, emergency contacts, appointment type and date, the physician choice button/menu selections, and content typed into free text boxes.  The data theft may have happened in 2020 when the company launched a Facebook marketing campaign in which users were tracked with proprietary tracking tools that Meta has. The mistake is likely to have happened on Meta's side, according to Novant. Zoom Out: This is not the first time that U.S. citizen data has been stolen by breaching healthcare companies. PFC, a debt-collecting company, announced weeks ago that 1.9 million patients had their data stolen from threat actors.

Hackers have already broken Android's new security update. The threat vector used to bypass security protocols is trojan malware. More: Threat actors are using Xenomorph, a trojan previously used to breach bank account log-in credentials.  To spread Xenomorph, hackers are using a new malware tracked as BugDrop. BugDrop is able to bypass Android's security protocols by first tricking victims into putting a test installer on their devices. After installing drop apps, which are usually designed as productivity apps, the user is at risk of having their data stolen.

A message from QUANTUM Effective and Reliable Data Storage Protection that Scales on Your Terms and Budget Data recovery is possible across the entire lifecycle - and air-gapped protection is both the safest and the lowest TCO. Successful Ransomware attacks can take months to fully recover from - especially when targeted campaigns wipe out clusters of servers. So why not choose a solution that protects and recovers at any point in your data’s lifecycle? With different tiers, you’re able to ensure availability of data without compromise. You’re able to balance cost while maximizing efficiency. No one can stop ransomware or fully prevent it from taking place - but you can make sure you’re protecting your customers and your data by ensuring that there is a fully air-gapped solution. Request A Demo

A new Google Chrome security flaw is being abused by hackers. Google claims that it has already fixed the bug. More: The flaw is being tracked as CVE-2022-2856. Google stated that it is aware of the vulnerability and was actively working to solve it, later claiming it successfully managed to do so. According to Google, this flaw was addressed in the most recent update, while researchers claim that threat actors managed to exploit it actively.  This is the fifth zero-day vulnerability that Google patched this year. The list of the other zero-days tracked for 2022 includes: CVE-2022-0609  CVE-2022-1096  CVE-2022-1364  CVE-2022-2294  Google has recommended that users update to version 104.0.5112.101(macOS, Linux) and 104.0.5112.102/101(Windows).

USB thumb drives are still one of the biggest hacking risks for enterprises, according to a new report. 11% of the cases where workers were hacked involved removable media devices such as USBs. More: The major threat vector through which hackers breach their victims is still phishing, representing 78% of the total number of cases. IBM stated that the way hackers breach victims in enterprises is by inserting removable media devices that are infected with malware. The malware then spreads to the entire network as the victim resumes their work as usual. The report stated that USB devices should be removed entirely from use unless they are deemed as absolutely neccessary. 57% of alerted cases used the outdated TLS 1.0 encryption method. In terms of specific industries, manufacturing was the most targeted, with 23% of the cases being related to companies in this space.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work. They are manual, inconsistent, take too long, don’t scale, and don’t give developers what they need. When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Get the whitepapers

Cybersecurity company ThreatX has raised $30M. The Louisville-based company raised a Series B round, led by Harbert Growth Partners. More: Other participants in the round were Vistara Growth, 406 Ventures, Grotech Ventures, and Access Venture Partners. ThreatX offers a 24/7 available platform that increases a company's ability to prepare for, scan for, and react to hacking campaigns. The company specifically focuses on APIs and their vulnerability against DDoS attacks, botnets, phishing campaigns, etc.

Quick Hits: Quality products made specifically for a man's nether region. Get 20% off + free shipping at manscaped.com. Your balls will thank you®.* There were a record number of Identity scam cases recorded in 2021, according to a new report. Cybersecurity company Barracuda has been acquired for $4B by KKR. According to new research, phishing attempts are expected to become more successful at breaching their victims in the near-term future due to the lack of education and training, while long-term, experts believe enterprises can increase their safety levels by a considerable amount. Same old marketing automation not cutting it these days? Get our eBook and power up your customer experiences.* *This is sponsored content.

Upcoming events at Inside: August 17 - AMA with Atin Batra (27V) (Register Here) August 24 - AMA with Matt Mahar (Cana) (Register Here) August 31 - AMA with Sophia Amoruso (Business Class) (Register Here) September 07 - AMA with Andrew Gazdecki (MicroAcquire) (Register Here) September 09 - AMA with Jay Ryan (Security Compass) (Register Here) September 14 - AMA with Brian Dean (Backlinko) (Register Here) September 21 - AMA with Kristen Ruby (Ruby Media Group) (Register Here) September 28 - AMA with Leigh-Ann Buchanan (aīre ventures) (Register Here) October 12 - AMA with Bill Glenn (Crenshaw Associates) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here)

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

With Quantum, we shift the focus from accumulating data to making it work for you.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.