Updates

Cybercrime

2018

Reddit revealed it had been hacked between June 14 and June 18, when its storage systems were accessed. The company suspects that SMS-based 2FA (two factor authorization) was the root cause of the incident, claiming that the main attack was via SMS intercept. User data accessed was all Reddit data from 2005 to 2007, including usernames, salted hashed passwords and email addresses, as well as email digests sent by Reddit in June 2018, which connect a username to the associated email address. Other data was accessed as well, including Reddit source code, internal logs, configuration files and other employee workspace files. The company specified hackers didn’t get write access to Reddit system and no data was altered, but will prompt users affected to change their passwords.

Dixons Carphone revealed that 10 million of its customers may have been affected in the data breach in 2017, 4 million higher than its previous estimates. While the company previously reported that financial and non-financial personal data had been accessed, it now noted that payment card or bank account details were not compromised. However, personal data of 10 million customers may have been obtained in the breach.

SingHealth, Singapore's largest healthcare group, has suffered a data breach in which hackers obtained personal information on 1.5 million patients, including their name, address, gender, race, date of birth, and National Registration Identity Card numbers, Ministry of Health of Singapore confirmed. The hackers also obtained information on the outpatient dispensed medicines' of about 160,000 patients, including Singapore's Prime Minister and few other ministers. The Ministry of Health of Singapore stated that hackers specifically and repeatedly targeted the Prime Minister's personal particulars and information on his outpatient dispensed medicine. The investigations by the Cyber Security Agency of Singapore and the Integrated Health Information System are underway and confirm that the cyber-attack was deliberate, targeted, and well-planned.

The US Department of Justice (DoJ) issued a comprehensive assessment of the Department's work in the cyber area, carried out by the Department’s Cyber-Digital Task Force. It includes background on malign foreign influence operations generally, and outlines five types of foreign influence operations aimed at either elections or broader political issues in the US. It also describes how DoJ counters these operations, including efforts designed to protect the upcoming 2018 midterm elections, and presents the Department of Justice Policy on Disclosure of Foreign Influence Operations. The assessment also discusses sophisticated cybercrime schemes, ways to detect, deter, and disrupt them, and the role of the Federal Bureau of Investigation (FBI) in responding to cyber incidents. It further explains how the DoJ recruits and trains cybersecurity experts, and describes the Task Force’s future work in the cyber area.

Russia plans to present two new draft resolutions in the field of cybersecurity to the United Nations General Assembly in autumn, Kommersant reports. The first proposal, “Advances in the field of information and telecommunications in the context of international security,” will be based on Shanghai Cooperation Organisation’s “International Code of Conduct for Information Security”. The proposal will introduce a new Code of Conduct for states, prohibiting the use of ICT to interfere in the internal affairs of other states and to undermine their stability, preventing states from abusing their dominant position in information technology and guaranteeing that all states play the same role in Internet Governance. The second proposal, “Countering the use of Information and Communication Technologies for Criminal Purposes,” is envisioned as an alternative to the Council of Europe Convention on Cybercrime (Budapest Convention) of which Russia is not a signatory. The Russian draft resolution will also provide for a data exchange, but "on a different, purely legal basis." The aim is to change the precondition of being a signatory of the Budapest Convention in order to debate the issue of cybercrime.

The European Commission has called for improved capacity of the EU and its Member States to attribute cyber attacks. In its joint communication to the European Parliament, the European Council and the Council, “Increasing resilience and bolstering capabilities to address hybrid threats", the Commission emphasised the importance of attribution to deterring potential aggressors and holding the culprits accountable. Member States were encouraged to continue their work on attribution of cyber-attacks and the practical use of the cyber diplomacy toolbox to step up the political response to cyberattacks. The Commision also urged the European Parliament and the Council to swiftly agree on the proposed legislation on gathering electronic evidence, as it would significantly enhance the ability of law enforcement to investigate and prosecute cybercrime.

Pages

 

The GIP Digital Watch observatory is provided by

 

 

and members of the GIP Steering Committee



 

GIP Digital Watch is operated by

Scroll to Top