Novant Health hacked / Android update already broken by hackers / New Chrome flaw abused by hackers

Plus: USB drives are still a big hacking risk for enterprises

Inside.com Part of   Network August 17, 2022

Presented by

Novant Health, a U.S.-based healthcare company, is warning customers of a possible breach. The breach may have happened as a result of a Facebook tracking link. More: Novant Health has reportedly sent over 1.3 million emails that have warned users to be careful and to report any irregularities they experience.  The stolen data may include information such as email address, phone number, computer IP address, emergency contacts, appointment type and date, the physician choice button/menu selections, and content typed into free text boxes.  The data theft may have happened in 2020 when the company launched a Facebook marketing campaign in which users were tracked with proprietary tracking tools that Meta has. The mistake is likely to have happened on Meta's side, according to Novant. Zoom Out: This is not the first time that U.S. citizen data has been stolen by breaching healthcare companies. PFC, a debt-collecting company, announced weeks ago that 1.9 million patients had their data stolen from threat actors.

Hackers have already broken Android's new security update. The threat vector used to bypass security protocols is trojan malware. More: Threat actors are using Xenomorph, a trojan previously used to breach bank account log-in credentials.  To spread Xenomorph, hackers are using a new malware tracked as BugDrop. BugDrop is able to bypass Android's security protocols by first tricking victims into putting a test installer on their devices. After installing drop apps, which are usually designed as productivity apps, the user is at risk of having their data stolen.

A message from QUANTUM Effective and Reliable Data Storage Protection that Scales on Your Terms and Budget Data recovery is possible across the entire lifecycle - and air-gapped protection is both the safest and the lowest TCO. Successful Ransomware attacks can take months to fully recover from - especially when targeted campaigns wipe out clusters of servers. So why not choose a solution that protects and recovers at any point in your data’s lifecycle? With different tiers, you’re able to ensure availability of data without compromise. You’re able to balance cost while maximizing efficiency. No one can stop ransomware or fully prevent it from taking place - but you can make sure you’re protecting your customers and your data by ensuring that there is a fully air-gapped solution. Request A Demo

A new Google Chrome security flaw is being abused by hackers. Google claims that it has already fixed the bug. More: The flaw is being tracked as CVE-2022-2856. Google stated that it is aware of the vulnerability and was actively working to solve it, later claiming it successfully managed to do so. According to Google, this flaw was addressed in the most recent update, while researchers claim that threat actors managed to exploit it actively.  This is the fifth zero-day vulnerability that Google patched this year. The list of the other zero-days tracked for 2022 includes: CVE-2022-0609  CVE-2022-1096  CVE-2022-1364  CVE-2022-2294  Google has recommended that users update to version 104.0.5112.101(macOS, Linux) and 104.0.5112.102/101(Windows).

USB thumb drives are still one of the biggest hacking risks for enterprises, according to a new report. 11% of the cases where workers were hacked involved removable media devices such as USBs. More: The major threat vector through which hackers breach their victims is still phishing, representing 78% of the total number of cases. IBM stated that the way hackers breach victims in enterprises is by inserting removable media devices that are infected with malware. The malware then spreads to the entire network as the victim resumes their work as usual. The report stated that USB devices should be removed entirely from use unless they are deemed as absolutely neccessary. 57% of alerted cases used the outdated TLS 1.0 encryption method. In terms of specific industries, manufacturing was the most targeted, with 23% of the cases being related to companies in this space.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work. They are manual, inconsistent, take too long, don’t scale, and don’t give developers what they need. When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Get the whitepapers

Cybersecurity company ThreatX has raised $30M. The Louisville-based company raised a Series B round, led by Harbert Growth Partners. More: Other participants in the round were Vistara Growth, 406 Ventures, Grotech Ventures, and Access Venture Partners. ThreatX offers a 24/7 available platform that increases a company's ability to prepare for, scan for, and react to hacking campaigns. The company specifically focuses on APIs and their vulnerability against DDoS attacks, botnets, phishing campaigns, etc.

Quick Hits: Quality products made specifically for a man's nether region. Get 20% off + free shipping at manscaped.com. Your balls will thank you®.* There were a record number of Identity scam cases recorded in 2021, according to a new report. Cybersecurity company Barracuda has been acquired for $4B by KKR. According to new research, phishing attempts are expected to become more successful at breaching their victims in the near-term future due to the lack of education and training, while long-term, experts believe enterprises can increase their safety levels by a considerable amount. Same old marketing automation not cutting it these days? Get our eBook and power up your customer experiences.* *This is sponsored content.

Upcoming events at Inside: August 17 - AMA with Atin Batra (27V) (Register Here) August 24 - AMA with Matt Mahar (Cana) (Register Here) August 31 - AMA with Sophia Amoruso (Business Class) (Register Here) September 07 - AMA with Andrew Gazdecki (MicroAcquire) (Register Here) September 09 - AMA with Jay Ryan (Security Compass) (Register Here) September 14 - AMA with Brian Dean (Backlinko) (Register Here) September 21 - AMA with Kristen Ruby (Ruby Media Group) (Register Here) September 28 - AMA with Leigh-Ann Buchanan (aīre ventures) (Register Here) October 12 - AMA with Bill Glenn (Crenshaw Associates) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here)

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

With Quantum, we shift the focus from accumulating data to making it work for you.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.

                                                           

Bankrupt Celsius Wins Approval to Sell Mined Bitcoin

ALSO: U.S. Rep. Toomey calls out FDIC, World Bank affiliate taps Chia Network and more |

August 17, 2022 The biggest crypto news and ideas of the day  Was this newsletter forwarded to you? Sign up here. Supported by In today's edition: Bankrupt crypto lender Celsius won approval to sell mined bitcoin. The Federal Deposit Insurance Corporation "improperly" pushed banks to avoid serving crypto companies, one lawmaker says. And Dogechain, a new DOGE-themed exchange, is driving retail interest in "dog tokens."   – Daniel Kuhn Today's must-reads Top Shelf CASH-STRAPPED CELSIUS: Bankrupt cryptocurrency lender Celsius Network, which disclosed Monday that it was running low on money, said it has received  several proposals from firms looking to inject cash into the company, though didn't name names. It also won approval from a U.S. judge to sell bitcoin (BTC) that it mines. Needs money: Celsius, which paused customer withdrawals amid the spring's crypto market rout, needs liquidity. A number of firms are reportedly looking to acquire Celsius, or parts of the bankrupt firm. Money on hand: A recent court document showed that Celsius mined $8.7 million worth of bitcoin in July. It also holds several millions of dollars worth of the platform's CEL token, which has substantially fallen in value and is undergoing a short squeeze. However, the company's operational and capital costs exceed its holdings. PUSHING BACK: U.S. Sen. Pat Toomey (R-Pa.) made public a letter claiming the Federal Deposit Insurance Corporation (FDIC) improperly pressured banks against providing services to cryptocurrency companies, even though those services are legal. Background: Toomey's letter was prompted by whistleblower accounts in an American Banker report, which claimed the federal banking regulator has "downgraded" bank's loans and tried to dissuade financial firms from expanding into crypto without legal basis.   Similar action: Commentators have noted a similar anti-crypto bent in guidance issued by the U.S. Federal Reserve this week, which would expand central bank oversight over the industry. OFFICER, WHAT IS THE LAW? The U.S. Securities and Exchange Commission has filed a complaint against blockchain startup Dragonchain for failing to register more than $16 million in crypto asset securities offerings over the course of five years. This is the latest in a string of small-time actions taken against irrelevant crypto projects by regulators. Looking back: A slew of crypto startups launched ICOs (initial coin offerings) to raise money for their operations amid the bitcoin market boom at the end of 2017, running afoul of the SEC, which considers token sales securities that should be subject to federal securities laws and information disclosure.  Tax evaders hunting: Meanwhile, the Internal Revenue Service can serve a "John Doe" summons on crypto prime dealer SFOX, a court ruled Monday, allowing the tax agency to hunt for potential tax evaders who are using company's services. The IRS has previously served such summons on companies including Kraken and Circle. MORE IN: The World Bank affiliate International Finance Corporation is teaming up with upstart blockchain platform Chia Network to revamp the carbon credit market in a project called the Carbon Opportunities Fund. Some climate activists believe tokenizing carbon credits will make the industry more efficient and effective while others write off these voluntary carbon capture efforts entirely.  New fund: CoinFund, a crypto-specific investment firm, inaugurated a $300 million venture capital fund to back early-stage blockchain projects, a sign of investor confidence in an industry plagued by a bear market.  Elsewhere, Brazil's largest investment bank, BTG Pactual, has launched a crypto trading platform, allowing customers to trade BTC, ETH, SOL, DOT and ADA. DOGE, JUMP! Dogecoin's (DOGE) price has surged this week following increased retail interest in Polygon Edge-based token exchange called Dogechain. Dogechain allows traders to convert dogecoin to wDOGE and allows them to use tokens, non-fungible tokens (NFT) and products built on the network. Zooming out: Meme coins in general are rallying, outperforming bitcoin (BTC) and ether (ETH). While historically such market exuberance over mostly useless tokens has portended a market-wide price crash, analysts say the latest jump appears to be driven by news and doesn't represent a speculative frenzy. – Xinyi Luo Overheard on CoinDesk TV... Sound Bites "The consumer business is dead ... The brand itself is dead."    – 507 Capital founder Thomas Braziel, discussing bankrupt cryptocurrency lender Celsius, on CoinDesk TV's "First Mover" The Right Place for Your Crypto   Nexo marks the spot. As in the right spot for you to grow your crypto wealth and keep it secure.   Buy BTC, ETH, and more with your debit or credit card or swap between 300+ market pairs and get 0.5% in crypto rewards on each transaction.   If you're looking to enhance your spending power, Nexo is the right place. Borrow without selling your crypto at rates starting from 0% and grow your portfolio.   The right place brings you and your friends together and gives you both crypto rewards. Get $25 in BTC for every successful referral. Collect rewards as you go and enter the race for a $50 000 prize pool which will be distributed between the top 50 contestants. Enter the competition until July 26, 2022.   Timing the market can be a tall order. Choosing the right place is not. Grow your crypto on the highly-rated Nexo platform. What others are writing Off-Chain Signals  Inside the Crash of Three Arrows Capital (New York Magazine) OpenSea Volume Sinks to 13-Month Low (The Defiant) Bitcoin miners forced to dump holdings to stay afloat amid market crash (Protos) Crypto Ads Starring Matt Damon, Tom Brady Vanish From Television (Bloomberg) Investment in infrastructure is critical for crypto startups, not a 'nice to have' (Techcrunch) Join 2,000+ attendees from the NEAR and Web3 ecosystem along with hundreds of hackers in the stunning coastal city of Lisbon for NEARCON, "Building Beyond the Hype," September 11-14.  Part conference, part festival, and part IRL hackathon, for 3.5 days NEARCON will bring together authors, economists, artists, politicians, builders, multi-chain collaborators, and makers across many industries. NEARCON will be a welcoming, collaborative atmosphere for all.   Promocode COINDESK for 35% off tickets! Putting the news into perspective The Takeaway  In Crypto, Base Layer Security Isn't Enough Earlier this week a new type of stablecoin (aUSD), built on a platform (Acala), which itself was built on a blockchain (Polkadot), fell from its $1 peg to $0.009 (which rounds to zero as far as I'm concerned), following an attack on one of the platform's liquidity pools. If the words following "attack on" seem to be oddly specific, that's because they are.   Acala wasn't attacked, hacked and thwarted directly. Rather, the iBTC/aUSD liquidity pool, something built on top of Acala, was attacked, hacked and thwarted directly. The exploit was successful and allowed bad actors to create billions of aUSD for themselves. This influx of new aUSD crushed the price of the stablecoin strictly through immense supply dilution.   aUSD has since recovered, but only after the Acala community voted to destroy the billions of the improperly minted aUSD. Never mind that the minted aUSD wasn't really improperly minted and never mind the need for a centralizing force to come in to fix this mistake, let's instead look at how cryptocurrency protocols are only as secure as what's built on top of them. Move fast and break everything aUSD isn't the first crypto thing that has been broken or hacked (e.g. Ronin for $625 million and Wormhole for $326 million) – it's just the flavor of the week. But we should be clear here: aUSD didn't necessarily stop working, and the attackers didn't rappel into a building to physically break into the mainframe or something.    Instead, aUSD worked as designed. Buggy code governed the liquidity pool, and that buggy code allowed attackers to print billions of aUSD.   This is the same as the two other examples provided – with each CoinDesk article accurately using the term "exploit" to describe the attacks. We should do the same here, because exploit, rather than hack, more accurately defines taking advantage of poorly constructed code.    Exploits, of course, aren't isolated to protocols you've never heard of. Acala is built on Polkadot, for instance. Sure, Polkadot's native currency DOT is the 11th-most valuable cryptocurrency, but it's not like Polkadot is Ethereum. Except Ethereum did have an exploit in 2016 – colloquially called The DAO Attack – which led to a messy chain split (look up Ethereum Classic) and a loss of credibility.   This is good ammo for the boomer Bitcoin developers who are hellbent on changing absolutely nothing about Bitcoin because they're afraid that would break the protocol. I'm not coming here in defense of halting new development of Bitcoin or other cryptocurrency protocols, but rather, I simply want to provide some color as a warning given how easy it is to draw a parallel to Silicon Valley tech companies and crypto.   The ethos of Silicon Valley tech is (was?) to "move fast and break things," but the stakes are simply higher for crypto. If a developer at Salesforce introduces a bug that hurts a customer's experience, patching that bug really comes only at the expense of time to fix the mistake (maybe there's a reputational hit, but a company can get through a few mistakes a year with no issue).   Not so in crypto. If a bug is introduced to a crypto protocol through a new shiny product or layer or smart contract or whatever and is eventually exploited, the damage could spread far and wide and could be irreversible. Things should be built on crypto protocols and the protocols themselves should be upgraded, but that should be done with care.   All said, the main point is: It's fine to move fast and break everything, unless you don't want to break everything.   – George Kaloudis Where innovators, changemakers, investors and leaders present their best ideas for investing in the future of the Web 3, digital assets, blockchain and crypto ecosystems. Register now. Starfish Finance II - Attack of the (Dapp) Clones   Far beyond Earth and millions of miles past the moon, there's a planet where Decentralized Finance (DeFi) and NFT-Fi meet on an interoperable network. First observed in 2022, the world known as "Starfish Planet" is home to degens, hodlers, frens and a starfish named Sean.   Starfish Planet is one of the many planets orbiting within the Astar Network ecosystem. While many have traveled to Astar at different times, they all chose this ecosystem for the same reason: the EVMs are being attacked by clones.   Continue reading here    *This is sponsored content from Starfish. The Chaser... The Node A newsletter from CoinDesk Were you forwarded this newsletter? Sign up here. See Previous Editions Copyright © 2022 CoinDesk, All rights reserved.  250 Park Avenue South New York, NY 10003, USA See all of CoinDesk's newsletters | Opt out

Usability in Web3: How to Unlock Mass Adoption

Webinar August 23 at 11:00 a.m. ET Sponsored by NEAR

This webinar explores the challenges in turning blockchain projects into global brands. Featuring companies with a proven track record of building from scratch, join leaders from fast-growing projects such as Fireblocks, Sweat Economy and SailGP and hear about their journeys navigating the Web3 space. NEAR Foundation CEO Marieke Flament, head of the world's fastest-growing, carbon neutral community-led blockchain, will explore the barriers for entry for users into Web3 while sharing insights into how NEAR has become the bridge between Web2 and Web3.   Last but not least, communications expert Nick Lord and Web3 biz dev guru Sergio Silva will share lessons learned building in the world's fastest growing technology sector. Marieke Flament CEO NEAR Foundation  Oleg Fomenko Co-Founder Sweat Economy Sergio Silva Senior Director for Web3 Business Development  Fireblocks Warren Jones Chief Technology Officer SailGP  Moderator Nick Lord Founder Blue Pool Communications Copyright © 2022 CoinDesk, All rights reserved.    250 Park Avenue South New York, NY 10003, USA You can manage your preferences here or unsubscribe from all CoinDesk email.