Binance hacked, hackers steal over $570M / Company that designed Russian sanctions gets hacked / Meta shuts down 400 malicious apps

Plus: Oort raises $11.5M Series A

Inside.com Part of   Network October 07, 2022

Presented by

Binance has announced that it has been hacked by unknown threat actors who have reportedly stolen $570M in cryptocurrency. Binance is the world's largest crypto exchange. More: The company has consistently updated the amount that hackers have stolen. Initially, the company believed the threat actor stole around $100M, but then the company found out that more tokens had been stolen, leading to the current amount, which stands at $570M. Binance's CEO stated that users' funds are safe from the threat actor and are in their wallets. The threat actor responsible for this attack has not been tracked yet, but it is known that they breached Binance Smart Chain, Binance's own blockchain technology. Binance was founded in 2017 by Chinese entrepreneur Changpeng Zhao. The company is legally based in the Cayman Islands. The crypto exchange platform offers a number of services, such as staking, high-frequency trading, etc. As of 2021, the exchange had close to 30 million users.

Lloyd's of London, a London-based insurance company that was involved in implementing federal sanctions against Russia, has likely been hit by a cyberattack. The company has not given information on whether it has contacted the possible threat actors. More: Lloyd's of London was one of the insurance companies that helped the British government design and implement the sanctions against Russia, voted after the latter invaded Ukraine. The company has stated that it has informed market participants and relevant parties affected by the cyber attack. Company representatives did not state whether the company has been in contact with the possible threat actor, their demands, or technical details regarding the cyber attack. Zoom Out: Hackers consistently target insurance companies due to the amount of personal data they have. In August 2022, the NHS 111 service was hit by a cyberattack that shut it off for more than 24 hours. The attack was deployed when then-prime minister Boris Johnson visited Ukraine to meet Volodymyr Zelensky. French insurance company Axa announced that it would not fulfill any further cyber insurance claims last year and was itself hit by a cyberattack days later. A number of insurance companies have followed suit, claiming that the service has become too costly for them due to a large number of cyberattacks this year.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work.  They are: Manual Inconsistent Take too long Don’t scale Don’t give developers what they need When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Download whitepaper bundle

Meta has stated that it shut down more than 400 login credential-stealing apps so far in 2022. The apps targeted both iOS and Android. More: The apps were falsely designed to look like apps meant for photo editing, gaming, VPN services, business apps, etc. These malicious apps used a fake "log in with Facebook" button that sent the users to a phishing page. Once the users typed their credentials, the hacker gained access to those details and abused the information to breach their accounts. Out of all 403 apps that were found, 356 were in the Google Play store, while 47 were in iOS. The company stated that it will notify over 1 million users who may have been possibly affected by these apps.

Oort, a cybersecurity risk detection platform, has raised an $11.5M Series A funding round. The company is based in Boston. More: The Series A funding round was led by.406 Ventures and Energy Impact Partners with participation from Cisco Investments, 645 Ventures, Bain Capital Ventures, and First Star Ventures. The company offers a solution that enables its clients to enhance their identity attack surface management by using their current identity sources. This software solution uses Snowflake and AWS, making it easier for both the company and the client to carry out daily operations through a proven infrastructure. Oort will use the funds to grow and gain its market share.

Fintech company iPay 88 claims hackers didn't steal card information in a cyberattack that occurred earlier this year. The company is based in Malaysia. More: The company claims that after a months-long investigation process, it can safely claim that the cyberattack didn't affect users who transferred money through e-banking, Android terminals, buy-now-pay-later, etc. According to the financial services company, the investigation was concluded by July 20, 2022. The cyberattack led the Malaysian Central Bank to release a guideline for all financial companies with instructions on what steps they should take in order to increase their safety. According to the Central Bank, iPay 88 has followed these steps.

Quick Hits: Google Ventures (GV) leads a $35M round investing into Courier's notification system joining Twilio, Slack, Bessemer, and Matrix Partners as investors.* A new malware named Maggie is reportedly targeting Microsoft SQL servers worldwide. SQL technology plays a key role in ensuring that data processing is done efficiently, making the threat's damage level potentially high. U.S. President Joe Biden has signed an executive order that aims to protect the privacy of personal data transfers between the EU and the United States. Cybersecurity is expected to be close to 25% of the total AI software spend by the year 2025. A new report claims that cybersecurity incident reporters are having record numbers of mental health issues and stress-related problems. *This is sponsored content.

Upcoming events at Inside: October 11 - AMA with Mike Malone (Smallstep)* (Register Here) October 13 - AMA with Ram Bartov (Chief Accounting Officer at TripActions)* (Register Here) October 19 - AMA with Zecca Lehn (Responsibly VC) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here) November 02 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) December 07 - Live AMA with Deividi Silva ( Head of Developer Relations at Gun.io) (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.