How Cyber Safe is Your Drinking Water Supply?
Amid multiple recent reports of hackers breaking into and tampering with drinking water treatment systems comes a new industry survey with some sobering findings: A majority of the 52,000 separate drinking water systems in the United States still haven’t inventoried some or any of their information technology systems — a basic first step in protecting networks from cyberattacks. The Water Sector Coordinating Council surveyed roughly 600 employees of water and wastewater treatment facilities nationwide, and found 37.9 percent of utilities have identified all IT-networked assets, with an additional 21.7 percent working toward that goal. The Council found when it comes to IT systems tied to “operational technology” (OT) — systems responsible for monitoring and controlling the industrial operation of these utilities and their safety features — just 30.5 percent had identified all OT-networked assets, with an additional 22.5 percent working to do so.
Smart thermostats cranked up remotely by Texas energy firms, as consumers swelter in heat wave
Some sweltering residents of Texas are reporting that they are unable to lower the temperature on their Wi-Fi enabled “smart” thermostats after it was mysteriously raised, and they are struggling to understand why. The reason, it transpires, is not that malicious hackers have broken into the IoT devices to cause mayhem but is instead all part of an energy conservation campaign promoted by Texas’s power grid operator struggling to stay online in the Lone Star State. The Electric Reliability Council of Texas (ERCOT) has told residents to conserve as much energy as possible, asking them to set their thermostats to 78 degrees Fahrenheit (25.5 degrees Celsius) or higher during the peak hours of 3-7pm. But what are energy companies supposed to do if people really want their air conditioning to blast away the heat? The answer, it appears, is to take remote control of users’ smart thermostats and bump up the temperature.
Poland says top officials hacked by Russian cyber-attack
Polish intelligence services and those of allied states have “unanimously” agreed that a cyberattack against the emails of top Polish officials and politicians “originated on the territory of the Russian Federation”, Polish deputy prime minister Jarosław Kaczyński said in a statement Friday. The attack was meant to harm “Polish society” and to “destabilise” the country, he added. Russia has recently been accused of similar attacks against Germany and the US.
Brave launches its privacy-focused no-tracking search engine
Today, Brave launched their non-tracking privacy-centric search engine to bring another alternative to finding the information you want on the web without giving up your data. Brave Search is being launched first in Beta so that users can test the new search engine while Brave continues to refine its features. Users who wish to test the latest search engine can try it in any existing browser, and it is the new default search engine for Brave Browser. If you have ever logged into your Google or Microsoft account and looked at the huge amount of data collected about your browsing history, its impossible not to feel uncomfortable. Brave Search’s release hopes to offer a competitive search engine using its own independent search index and privacy-focused features.
Data leak marketplace pressures victims by emailing competitors
Last month, BleepingComputer reported that cybercriminals started to create dedicated data-theft extortion marketplaces that exist solely to sell stolen data. The data sold on these sites are obtained through the marketplace’s own attacks, from other threat actors, or by collecting data released in other attacks, such as ransomware or website data breaches. The stolen data is sold for as low as $100 to tens of thousands of dollars depending on the marketplace. One of these marketplaces, known as Marketo, is now taking it a step further and emailing the victim’s competitors to offer samples of the stolen data and entice them into purchasing it. In April, Marketo claimed to have breached a large, heavy machinery and defense technology company and began selling their stolen data. After we assume they could not find any buyers, Marketo started emailing the communication managers for the victim’s competitors to offer a “demo pack” of the stolen data.
