A recent report by cyber security research firm Check Point shed new light on one of the largest attacks on mobile devices perpetrated in recent years. The report tracked the spread of the malware called HummingBad which was first discovered in February. Since then it has spread to infect an estimated 10 million Android devices.

The most interesting aspect of the report was less about the scope of the attack and more about its source. The researchers at Check Point discovered that HummingBad was developed by a team working within Yingmob, an advertising analytics firm based out of Beijing.

The team used the IT infrastructure already in place at Yingmob to serve as the foundation for their malware attacks. A total of four groups totaling around 25 people who had been tasked with development on overseas platforms were instead leveraging company resources to attack Android devices.

Devices are exposed to HummingBad after visiting malicious websites. If the malware is not properly installed after the visit, it launches a second attack disguised at an update notification. Once infected, the creators of HummingBad have full control of the device.

Thus far, most of these infected devices have been used to fraudulently generate advertising revenue by forcing the devices to download apps and click ads. Experts estimate that this revenue stream alone nets $300,000 a month.

A far more destructive and lucrative threat could be looming, however. Since HummingBad gives cyber criminal complete access to a device, it’s especially easy to scour the device for sensitive information, or to sell access to a third party. Those in possession of the access could potentially exploit the device in dozens of different ways. Since there is no easy way to identify the presence of HummingBad on a device, most users are unaware of the infection and taking no extra safety precautions.

The majority of the devices that have been infected are located in India and China, with a reported 1.35 million and 1.65 million devices impacted respectively. The US is estimated to have 288,000 infected devices, while countries like the UK and Australia are believed to have fewer than 100,000 infected devices.

The team exposed within Yingmob is an outlier in the cyber crime community since it operated under a well respected front and piggybacked on the IT resources of a major company. That condensed the development time of Hummingbird while significantly extending it’s reach. The group is also suspected of developing malware for Apple devices.

Officials at Google have said they are aware of the malware and are taking steps to detect and block it.

Representatives of the Circle Sport-Leavine Family Racing team revealed that a ransomware scheme targeted the team’s IT infrastructure last spring. The data put at risk was estimated by crew chief Dave Winston to be worth upwards of $2 million. However, the hackers only demanded a ransom of $500 to release the stolen data.

Winston was alerted to the presence of malware when a pop up notification on his computer informed him that all the data on the racing team’s 10-computer network had been encrypted by a third party. This data included information about employees, the cars in the racing fleet, the tracks where races were held, and the competing drivers.

Initially, Winston and his team were unaware of the frequency and consequences of ransomware attacks. The team’s computer network had only minimal security measures in place, and little thought was paid to data security.

After researching ransomware and debating a response, decision makers on the team decided to pay the ransom. Using a Bitcoin ATM, $500 was released to the hackers. A day later the hackers released an encryption key.

Still lacking much cyber security expertise, the team was unable to get the key to work initially. They reached out to the dedicated IT team at Richard Childress Racing who were able to successfully input the encryption key and unlock the data.

Ultimately, the cost of the ransom relative to the value of the information was fairly small. But the attack reveals several troubling facts about the current use of ransomware. First, all data is vulnerable and potentially valuable, even if it has little discernible currency on the open market. In this incidence, few people would be interested in buying highly specific technical racing data. In order to reproduce it, however, the racing team estimated it would have to spend 1,500 man hours, creating a powerful incentive to pay the ransom.

The attack also underscores the growing frequency and creativity of ransomware attacks. Internet security firm Malwarebytes estimate that instances of ransomware attacks have increased by 44% in just the last six months. The technology behind these attacks is relatively unsophisticated but has proved to be consistently successful at exploiting money from victims.

The Circle Sport-Leavine Family Racing team has been advised to upgrade their cyber defenses, institute comprehensive backup procedures, and standardize security protocols across their network. All users are encouraged to take steps to guard themselves against ransomware, even if the personal digital data they store seems benign.

Security firm Trap X Labs has revealed that medical devices like CT Scanners, MRI machines, and dialysis pumps are increasingly being targeted by cyber criminals. These devices have proven to be particularly vulnerable because many run on outdated operating systems with few security measures in place.

Compounding the problem is that antiquated device running Windows 7 or Windows XP s are particularly susceptible to malware from the past. The study specifically studied three instances of the Conflicker worm being used to steal electronic medical records from connected medical devices.

In 2009, the Conflicker worm infected between 9 and 15 million computers. For its time the worm was particularly sophisticated, using regularly updated code to evade security protections and expand its reach. The worm was particularly effective at cracking passwords and enlisting computers in botnet schemes.

The efficacy of the Conflicker worm died out as patches, updates, and stronger machines became available. But computers still running on unprotected platforms remain vulnerable. That has enabled cyber criminals to reuse threats from the past rather than invent new ones for the present.

The contemporary version of the Conflicker worm is based on the architecture of the original but with updates that allow it to move laterally inside of a network and specifically target certain types of devices. The malware is usually delivered through phishing schemes directed at hospital staff, and exploits a vulnerability in Windows XP to gain access to the network.

The presence of the malware often goes unnoticed because medical devices are managed separate from the rest of the hospital’s IT. As a result, they fall outside the hospital’s cyber security protocol and largely go uninspected and unmonitored. Once cyber criminals gain access to a device they can create a backdoor to all the hospital’s networks.

Opportunity is not the only thing motivating the perpetrators of these attacks. In recent years medical records have become a hot commodity on the black market because they facilitate both identity theft and prescription drug fraud. By one estimate, medical records sell illicitly for $10 to $20 each while financial records sell for just $5. Medical records are also frequently used in ransomware schemes.

The work done by Trap X reveals an unexpected friction between IOT and cyber security. When older devices become integrated into networks, they expose those networks to threats that have already been dismissed and forgotten. The cyber criminal’s job is simply to recycle what has worked before.

 

The Hard Rock Hotel & Casino Las Vegas reported on Monday that cyber criminals were able to access customer payment data. The scheme was carried out by using card scrapping malware installed in the casino’s payment system.

The size of the data breach has not been revealed, but officials with the company warned that anyone who used payment cards at the resort between October 27, 2015 and March 21, 2016 could have been exposed to a threat.

An unnamed cyber security firm first identified the malware. The malicious software was able to isolate payment card information as it was routed though the casino’s computer system. Details like card number, expiration date, cardholder name, and the internal verification code were all exposed.

This is the second time that The Hard Rock Hotel & Casino fell prey to a malware attack. Embedded software previously discovered in the company’s computer system was used to steal payment card data from late 2014 to early 2015.

The issue of cyber security, however, is hardly limited to this one resort. Hospitality giants including Hilton, Mandarin Oriental Hotel Group, and Starwood Hotels have all been targeted by cyber criminals in the last year. Hyatt reported in early 2015 that 250 of its global properties had been affected by a data breach.

The overall frequency of large scale breaches has declined in recent years, but the hospitality industry remains a popular target. That is largely due to the fact that resorts collect and share a large volume of highly valuable personal and financial information. Many also rely on outdated IT systems that have not been updated to defend against sophisticated threats.

Hotels are also unique in that they maintain large public Wi-Fi networks. In past incidents, hackers have targeted hotel occupants rather than hotel administrators and successfully stolen user’s sensitive information, including passwords.

Experts warn that the frequency and severity of these breaches is expected to increase. Hotels, resorts, casinos and other businesses without a clear “tech” focus often underestimate the threat of cyber criminals. Many also lack the institutional resources necessary to detect and deflect complex attacks. Until the strength of the defense matches the strength of the offense, resort guests will continue to be put at risk.

Travelers concerned about cyber security are advised to be careful when using public Wi-Fi networks, to avoid untrusted ATM machines, and to keep all devices on your person at all times. Unfortunately, there is no way for travelers to protect their payment card data if a resort is using a vulnerable computer system.

The cyber security monitors at sadbottrue.com have recently discovered almost 3 million Twitter accounts deemed to be fraudulent. Every one of the accounts was created on April 17, 2014 and carries a serialized name falling in the range of @sfa_2000000000 to @sfa2002999999. It is believed that all the accounts were created by a botnet.

The content of these accounts is unknown since the accounts are protected and available only to confirmed followers. The description of each account simply reads “some kida description.” What is clear, however, is that the accounts have been very active. To date, the 3 million accounts have sent 2.6 billion tweets. That figure is equivalent to the cumulative total of all tweets sent over a five day period.

Each account is an identical copy of the rest, but the way that they are being used varies widely. For instance, one account has sent out close to a half million tweets. Another is following more than a million accounts. The content of the accounts may be unknown, but experts do not believe they are being used to distribute spam or advertising messages.

More likely is that the accounts are being used to drive trends on Twitter, as a number of hashtags being used appear in the social network’s top trending categories. This is a backhanded way of driving traffic to reputable accounts.

The 3 million accounts exposed could represent just a drop in the bucket. The account IDs used were all reserved in advance on October 22, 2013. On that same day a total of 168 million account IDs were reserved, though the vast majority have not yet been used to create accounts.

The issue of bots of Twitter is a pervasive one. By some estimates, there are more than 18,000,000 fraudulent accounts among active users, and the vast majority have more friends than they do followers. In essence, these accounts were created just for following other accounts. More than 1 billion fake accounts are “sold” yearly, with it costing about $400 to purchase a million followers.

The discovery of these bots raises questions about both Twitter’s organic traffic, and also about its security measures. Many are wondering how such a large volume of transparently fake accounts could have gone unnoticed by administrators for more than 2 years. One representative from sadbottrue.com suggested that a scheme of this magnitude could only have been perpetrated from the inside, likely by someone with executive credentials.

Twitter has not yet released an official statement on the botnet.