Here in Italywehavereadreallybad news about Ho Mobile, a low cost mobile companyowned by Vodafone.Theyhavebeenattacked by an hacker thathasstolencustomer’s data, a so-calleddata breach.
According to Wikipedia a data breachis:
[…] a security violation in which sensitive, protected or confidential data iscopied, transmitted, viewed, stolen or used by an individualunauthorized to do so.
Thisattackisusuallycarried out by attackerswilling to sellstolen data in the dark web.Thisiswhathashappenedalsoin the case of the ho.Mobileattack. The attackhasbeenrevealedwhen a researcher of Bank Security hastweetedthis:
“2.5 millioncustomer’s data hasbeensold on a forum, itseems for $ 50.000”.
A couple of weeks ago therewasthis attackagainstMyFreeCam:thefamous online site wasdata breachedby an attackeruisng a SQL injection attack. The attacker stole premium customer datathatshould be worthabout $ 300.000 for the entire database. Insidethatleaked database therewerealso tokens for accessing the attacked site, making the attackerable to access any premium customer account theywould,even private video and credit card numbers.
Regardingvideos, in October2020 a famous attackthat stole about 3 TB of video datawasrevealed.Itseems the attackwasdone by a group ofexpertsin violating IoT devices, suchassurveillance camera.Probablymany of these devices wereconfiguratedverybadly, in somecasestherewasn’tevena passwordrequest to access to the camera.
What does it mean?
Suchattacksregardedpersonaldatacollected bycompanies that are notable to protectcustomers data againstwellknownattacks, suchasSQL injection. Companies, especiallywhenthey serve millions of customers,shouldbeable to protect from suchattacks or shoud use strong passwords foraccessingtheirdevices.
Costs of data breachhavebeenexplainedhere (in italian) so wewon’trepeat the samethingshere. Howeverwewant to show iswhatcouldhappento an unawarevictim of a data breach.
Ho.Mobilestolen and sold data containinformation that make it easy for an attacker to steal the identity of a customer by cloninghis/her SIM. Hence an attacker can access everythingrelated to customer’s phone number, includingcommon application accounts or evenbank accountsbecausethe ICCID (Integrated Circuit Card-IDentity)wasstored in the stolen database.Such anumber can be usedtomake a SIM swapping attack, i.e. the attackerisable to use another SIM for interceptingtokens for 2FA (2 Factor Authentication) to access to any serviceconfigured to use thatkind of security measure.
In case of video, any data leakedcan be the source of blackmails,usingpeople’sprivate video againstthem, or worse, an attackercoulduse videos for bribingpoliticians or influent people.
So? What should happen?
The need of protecting companies’ data isincreasingasitisthe number of worldwideattacks. Here at Security Forge webelieve in protecting data notonlyatrest, whichisnot a sufficientdefense againstdata breacherthathasfoundhow to penetrate common security measures, butduringusage, monitoring where and how data are used.
Questo sito utilizza cookies tecnici funzionali all'esperienza di navigazione e cookies, anche di terze parti, per offrirti servizi in linea con le tue preferenze. Se accetti cliccando su "Accetta e continua" acconsenti all'uso dei cookie. informativa estesaaccetto
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.