January 6, 2025

SEC Examines Response From Financial Advisory, Brokerage Firms to Cyber Threats

Posted on February 5, 2015 by in Security

An overwhelming majority of brokerage and investment advisory firms examined by the U.S. Securities and Exchange Commission (SEC) have been the subject of a cyber-attack.

In its recent ‘Cybersecurity Examination Sweep Summary‘ report, the SEC took a look at 57 registered broker-dealers and 49 registered investment advisors. Eighty-eight percent of the broker-dealers and 74 percent of the advisers stated that they have experienced cyber-attacks either directly or through one or more of their vendors.

The majority of the cyber-related incidents are related to malware and fraudulent email. In fact, more than half of the broker-dealers (54 percent) and 43 percent of the advisers reported receiving fraudulent emails seeking to transfer client funds. More than a quarter of those broker-dealers reported losses in excess of $ 5,000 related to these emails, with no single loss being greater than $ 75,000. Twenty-five percent of the broker-dealers confessing losses related to the emails said the damage was the result of employees not following their firm’s identity authentication procedures.

<a href="http://redirect.viglink.com?key=11fe087258b6fc0532a5ccfc924805c0&u=http%3A%2F%2Fwww.securityweek.com%2Fcybersecurity-healthcare-retail-sectors-lags-behind-utility-and-financial-industries-report%22%3E"Brokers and advisors, especially those who handle very wealthy clients, are used to dealing with substantial sums of money, but they’re also human beings who can be duped by a well-crafted phishing scam,” said Tim Erlin, director of IT security and risk strategy at Tripwire. “Not all of these brokerages are as big as Wells Fargo and Morgan Stanley. Small and medium financial firms are gaining visibility because criminals are walking away with meaningful sums of money. The criminals are becoming more savvy about which kinds of transactions remain under the radar, and the more success they have with these targets, the more of these businesses they go after.”

The good news is the vast majority of examined broker-dealers (93 percent) and advisers (83 percent) have adopted written information security policies, and 89 percent of the broker-dealers and 57 percent of the advisers conduct periodic audits to determine compliance with these policies. For the majority of both broker-dealers (82 percent) and the advisers (51 percent), these written policies discuss mitigating the effects of a cyber-security incident and/or outline the plan to recover from such an incident. These policies however generally did not address how firms determine whether they are responsible for client losses associated with cyber incidents.

While firms identified misconduct by employees and other authorized users of their networks as a significant concern, only a small proportion of the broker-dealers (11 percent) and the advisers (four percent) reported incidents in which insiders engaged in misconduct resulting in the misappropriation of funds, securities, sensitive client or firm information, or damage to the firms’ networks. 

The vast majority of examined firms conduct firm-wide risk assessments on a periodic basis to identify cybersecurity threats, vulnerabilities and any potential impact to business. While most of the broker-dealers (93 percent) and advisers (79 percent) reported considering such risk assessments in establishing their cybersecurity policies and procedures, fewer firms applied these requirements to their vendors. While 84 percent of the brokerage firms require cyber-security risk assessments of vendors with access to their firm’s networks, only 32 percent of the advisers do so.

“Cybersecurity threats know no boundaries,” said SEC Chair Mary Jo White, in a statement. “That’s why assessing the readiness of market participants and providing investors with information on how to better protect their online investment accounts from cyber threats has been and will continue to be an important focus of the SEC. Through our engagement with other government agencies as well as with the industry and educating the investing public, we can all work together to reduce the risk of cyber attacks.”

Subscribe to the SecurityWeek Email Briefing

view counter

Brian Prince is a Contributing Writer for SecurityWeek.

Previous Columns by Brian Prince:


SecurityWeek RSS Feed

US Spies on Mobile Phones From the Sky: Report

Posted on November 13, 2014 by in Security

SAN FRANCISCO – US justice officials are scooping up mobile phone data from unwitting Americans as part of a sophisticated airborne surveillance program designed to catch criminals, the Wall Street Journal reported Thursday.

Small aircraft deployed by the US Marshals Service from at least five major airports have been taking to the skies with “dirtbox” equipment designed to mimic signals from cell towers, according to the Journal.

That in turn tricks mobile phones into revealing unique identifying numbers and general locations, according to the report.

The name “dirtbox” was said to be derived from an acronym of Digital Recovery Technology Inc., the Boeing subsidiary that makes the device.

The range of aircraft in the program covers most of the US population, the Journal reported, citing unnamed sources familiar with the operation.

Details of flights were not given, but they were said to take place regularly with each outing potentially gathering data from tens of thousands of mobile phones.

The Journal reported that the US Justice Department declined to comment for the story other than to say that its agencies comply with the law when it comes to surveillance.

Mobile phones are programmed to connect with the closest signal tower, but trust signals from towers or imposters when it comes to making decisions, hackers have demonstrated.

Boxes in planes could automatically assure mobile phones they are the optimal signal tower, then accept identifying information from handsets seeking connections.

Fake cell towers could then pass connections onto real signal towers, remaining as a conduit with the ability to tune into or block digital transmissions.

Hackers refer to such tactics as “man-in-the-middle attacks.”

The Journal quoted American Civil Liberties Union chief technologist Christopher Soghoian as calling the program “dragnet surveillance” that is “inexcusable.”

The program is reportedly in place to reveal locations of mobile phones associated with criminals or those suspected of crimes, but collect data about other handsets that connect, according to the Journal.

After sifting through data collected, investigators could determine the location of a targeted mobile phone to within about three meters, the report indicated.

Similar devices are used by US military and intelligence officials operating in other countries to locate terrorist suspects, according to the Journal.

Trust in US authorities has already been shaken by revelations about a sweeping Internet surveillance program.

Subscribe to the SecurityWeek Email Briefing

view counter

© AFP 2013


SecurityWeek RSS Feed

Cyber Attacks From Las Vegas Spiked During Black Hat, Defcon: Imperva

Posted on August 22, 2014 by in Security

The days when the Black Hat USA and Defcon conferences are ongoing are two times when surfing the Internet in Las Vegas can be a gamble all on its own.

According to Imperva, there was a spike in malicious activity emanating from Sin City two weeks ago when the conferences were under way.

“I decided to test for attack traffic originating in Las Vegas during BlackHat and Defcon, and a month prior to that in order to correlate to baseline,” blogged Barry Shteiman, Imperva’s director of security strategy. “In order to do that, we collected all of the security events during that time period from our Community Defense system, mapped Geo IPs for Nevada state, and Las Vegas specifically, then we queried the Community Defense data set for all source IPs that were in the US. Finally, we summarized by date and where the city itself is Las Vegas.”

Here’s what the company found. Typically, it detects roughly 20 attacks originating from Las Vegas on a normal day. However, during the conferences that number peaked at 2,612. There was a significant drop off as Black Hat began winding down. On Aug. 6, the conference’s second to last day, there were just 20 detected attacks. The start of Defcon – which is also the final day of Black Hat – erased that decline however and the number of attacks shot back up to 1,916 on Aug. 7.

On the final day of Defcon, Aug. 10, the number of detected attacks fell to 7.

Chart of Attacks Coming from Las Vegas

Imperva also noted a jump in attack volume during the NAACP conference in July, which indicates one of a few possibilities: either a large crowd in a conference-scale event causes a growth in attack volume due to malware on computers, or attackers are attending the conference and performing their attacks from there, Shteiman wrote. As for Black Hat and Defcon, they are not exactly typical conferences, he added.

“They have some of the brightest security/hacking minds in the world attending,” he blogged. “Those guys who read every link before they click, run custom operating systems in cases and are generally very aware to security and therefore are less likely to be drive-by victims of hacking – for that reason, seeing numbers that high is more substantial at a hacker conference than in other conferences.”

Brian Prince is a Contributing Writer for SecurityWeek.

Previous Columns by Brian Prince:


SecurityWeek RSS Feed

Hackers Steal User Data From Kickstarter

Posted on February 16, 2014 by in Security

Kickstarter, a web site that serves as a funding platform for creative projects, said on Saturday that malicious hackers gained unauthorized access to its systems and accessed user data.

“On Wednesday night, law enforcement officials contacted Kickstarter and alerted us that hackers had sought and gained unauthorized access to some of our customers’ data,” Yancey Strickler, Kickstarter’s CEO, wrote in a security notice. “Upon learning this, we immediately closed the security breach and began strengthening security measures throughout the Kickstarter system.”

According to Strickler, customer information accessed by the attacker(s) included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords.

Security“Actual passwords were not revealed, however it is possible for a malicious person with enough computing power to guess and crack an encrypted password, particularly a weak or obvious one,” Strickler said.

The company said via Twitter that “old passwords used salted SHA1, digested multiple times. More recent passwords use bcrypt.”

Strickler said that no credit card data was accessed by the attackers, and that so far only two Kickstarter user accounts have seen evidence of unauthorized activity.

Kickstarter did not say how many user accounts were affected in the breach, but the company says that since launching in 2009, more than 5.6 million people have pledged $ 980 million, funding 56,000 creative projects through its platform.

“As a precaution, we strongly recommend that you create a new password for your Kickstarter account, and other accounts where you use this password,” the advisory suggested.

“We have since improved our security procedures and systems in numerous ways, and we will continue to do so in the weeks and months to come,” Strickler wrote. “We are working closely with law enforcement, and we are doing everything in our power to prevent this from happening again.”

*Updated with additional details on password encryption.

Managing Editor, SecurityWeek.

Previous Columns by Mike Lennon:


SecurityWeek RSS Feed

Hackers Steal Law Enforcement Inquiry Documents from Microsoft

Posted on January 25, 2014 by in Security

Recent Phishing Attacks Compromised Employee Email, Social Media Accounts at Microsoft

Microsoft on Friday said that attackers breached the email accounts of a “select number” of employees, and obtained access to documents associated with law enforcement inquiries.

According to the company, a number of Microsoft employees were targeted with attacks aiming to compromise both email and social media accounts, and in some cases, the attacks were successful.

“While our investigation continues, we have learned that there was unauthorized access to certain employee email accounts, and information contained in those accounts could be disclosed,” Adrienne Hall, General Manager at Microsoft’s Trustworthy Computing Group, wrote in a blog post. 

Microsoft Employee Email Accounts Hacked“It appears that documents associated with law enforcement inquiries were stolen,” Hall said.

“If we find that customer information related to those requests has been compromised, we will take appropriate action,” Hall continued. “Out of regard for the privacy of our employees and customers – as well as the sensitivity of law enforcement inquiries – we will not comment on the validity of any stolen emails or documents.”

The software giant did not say how many documents might have been obtained or exposed as a result of the attacks, or who they believe may have been behind the attacks.

Targeted attacks like this are not uncommon, especially for an organization like Microsoft. What’s interesting about this is that the incident was significant enough to disclose, indicating that a fair number of documents could have been exposed, or that the company fears some documents will make their way to the public if released by the attackers—which may be the case if this was a “hacktivist” attack.

“In terms of the cyberattack, we continue to further strengthen our security,” Hall continued. “This includes ongoing employee education and guidance activities, additional reviews of technologies in place to manage social media properties, and process improvements based on the findings of our internal investigation.”

In a Microsoft Law Enforcement Requests Report that covered the first half of 2013, Microsoft (including Skype) said that it received 37,196 requests from law enforcement agencies potentially impacting 66,539 accounts.  

Microsoft has recently faced a barrage of attacks claimed by the Syrian Electronic Army (SEA), hackers who support President Bashar al-Assad’s regime. While no attacks have resulted in any significant data loss or company-wide impact, the company did have social media accounts and blogs compromised this month.

It is unclear if the attacks may be related to the Syrian Electronic Army.

SecurityWeek has reached out to Microsoft for additional details and this story will be updated when a response is received.

Related: Yes, Virginia, There Really is Social Engineering

RelatedSocial Engineering is Alive and Well. How Vulnerable is Your Organization?

Managing Editor, SecurityWeek.

Previous Columns by Mike Lennon:


SecurityWeek RSS Feed

Hacker Barnaby Jack Died from Accidental Overdose: Coroner

Posted on January 3, 2014 by in Security

SAN FRANCISCO – The sudden death of prominent hacker Barnaby Jack was due to an accidental overdose of heroin, cocaine and other drugs, a coroner’s report said Friday.

The New Zealand-born Jack, 36, a software wizard famous for remotely hacking ATMs and medical devices, was found dead in his bed by his girlfriend in July.

An autopsy found “no visible or palpable evidence of trauma” on the body. There was “blood inside the nostrils” and “sparse white foam inside the mouth,” the report from the San Francisco Medical Examiner’s office said.

A toxicology screen found evidence of “acute mixed drug … intoxication” from heroin, cocaine, the antihistamine diphenhydramine and Xanax, which combined to cause Jack’s death, the medical examiner said.

Barnaby Jack

The New Zealand native and San Francisco resident worked as a software security researcher at IOActive Labs.

An admired member of the hacker community, Jack said in an IOActive blog post months before his death he had been spending the majority of his time researching vulnerabilities in new model wireless pacemakers and Implantable Cardioverter Defibrillators (ICDs).

Three years earlier, Jack demonstrated his “ATM jackpotting” discovery for an overflow crowd of hackers during a presentation at the infamous DefCon hacker gathering held on the heels of Black Hat annually in Las Vegas.

Jack found a way to access ATMs remotely using the Internet. Once in the machines, he could command them to spit out cash or transfer funds.

He didn’t reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.

He was admired by his fellow hackers, who took to Twitter last year after his sudden death to pay tribute.

“Lost but never forgotten our beloved pirate, Barnaby Jack has passed,” IOActive said in a message at the company’s Twitter account. “He was a master hacker and dear friend. Here’s to you Barnes!”

Related ReadingBarnaby Jack (1977-2013): Farewell to a Daring Wunderkind

Related VideoBarnaby Jack Demonstrates ATM Hacking at Black Hat

Related ReadingBarnaby Jack Leaves McAfee to Return To IOActive

© AFP 2013


SecurityWeek RSS Feed

Website aggregates compromised accounts from many information breaches

Posted on October 22, 2013 by in Security

A unique site built by Troy Hunt allows potential information breach victims to discover compromised accounts from many high-profile breaches.

SearchSecurity: Security Wire Daily News