Security News > 2021 > May
American Express has been fined 0.009 per cent of its annual profits by the Information Commissioner's Office after spamming people who opted out of its marketing emails with 4.1 million unwanted messages. "Between 1 June 2018 and 21 May 2019, 4,098,841 of those emails were marketing emails, designed to encourage customers to make purchases on their cards which would benefit Amex financially. It was a deliberate action for financial gain by the organisation. Amex also did not review its marketing model following customer complaints," said the ICO in a statement.
Endpoint security provider ThreatLocker this week announced that it secured $20 million in a Series B funding round that brings the total capital raised by the company to $24.5 million. Founded in 2017, the Florida, U.S.-based company offers enterprise-level cybersecurity tools aimed at securing both servers and endpoints.
The attacks used fake order receipts and phone numbers in an attempt to steal credit card details from unsuspecting victims, says Armorblox. A standard phishing campaign uses email to try to trick people into divulging confidential information.
The United States Department of Justice this week announced the sentencing of a Russian national for his role in a group that attempted to obtain $1.5 million in tax refunds from the Department of the Treasury. According to court documents, between June 2014 and November 2016, Bogdanov and co-conspirators hacked into the computers of private tax preparation firms in the US and stole personally identifiable information, including Social Security numbers and dates of birth.
Apple is using the growing threat of malware on its Mac platform as a defense in a lawsuit that could force the company to open up new channels of applications for its mobile iOS platform. In testimony in a California court Wednesday, Apple head of software engineering, Craig Federighi called the level of malware threat against the Mac platform one that the company finds "Unacceptable" and continue to defend against with restrictive application-distribution platforms, according to a published report on CNET. Federighi's comments were made as Apple executives begin testifying in a court case Epic Games-the maker of the hugely popular Fortnite-have brought against the tech giant for what Epic views as restrictive policies on the iOS App Store.
Google has updated its May 2021 Android security bulletin to alert users that four vulnerabilities appear to have been exploited in attacks. Rolling out to users since early May, the latest Android security update patches over 40 flaws, including four with a severity rating of critical.
Security researchers discovered that personal data of more than 100 million Android users has been exposed due to various misconfigurations of cloud services. The data was found in unprotected real-time databases used by 23 apps with download counts ranging from 10,000 to 10 million and also includes internal developer resources.
The Israeli Air Force has claimed that in the past week its fighter jets bombed two buildings allegedly used by the cyber unit of Hamas, the Palestinian militant group that runs Gaza. The first announcement was made on May 14, when Israel announced a strike on what it described as a "Cyber-equipment storage site of the Hamas terror organization cyber unit." The Air Force said the building was located in the northern Gaza Strip and it belonged to Hamas military intelligence.
The hackers who carried out the massive SolarWinds intrusion were in the software company's system as early as January 2019, months earlier than previously known, the company's top official said Wednesday. SolarWinds had previously traced the origins of the hack to the fall of 2019 but now believes that hackers were doing "Very early recon activities" as far back as the prior January, according to Sudhakar Ramakrishna, the company's president and CEO. "The tradecraft that the attackers used was extremely well done and extremely sophisticated, where they did everything possible to hide in plain sight, so to speak," Ramakrishna said during a discussion hosted by the RSA Conference.
Adversaries are typically quick to take advantage of newly disclosed vulnerabilities, and they started scanning for vulnerable Microsoft Exchange Servers within five minutes after Microsoft's announcement, Palo Alto Networks reveals in a new report. Between January and March, threat actors started scanning for vulnerable systems roughly 15 minutes after new security holes were publicly disclosed, and they were three times faster when Microsoft disclosed four new bugs in Exchange Server on March 2.