Content by Doug Olenick

As Classes Resume, Schools Face Ransomware Risk

Doug Olenick  •  August 26, 2020

Cybersecurity professionals expect a spike in ransomware attacks against school districts and universities this fall as new hybrid learning environments go online and unpatched equipment that has spent months in the homes of students and faculty is reconnected to school networks.

BEC Scam Costs Trading Firm Virtu Financial $6.9 Million

Doug Olenick  •  August 11, 2020

High-speed trading firm Virtu Financial says it lost $6.9 million in a business email compromise scam in May. The company is now suing its insurer for failure to cover the loss.

Why Flash Player Removal Should Be a Priority

Doug Olenick  •  August 4, 2020

Adobe Flash Player, which has been patched hundreds of times during its lifetime to address vulnerabilities, will no longer be supported after Dec. 31, leaving an attack vector that can be exploited by malicious actors unless it's removed. That's why eliminating all instances of Flash Player is so urgent.

Twitter Hack: Suspects Left Easy Trail for Investigators

Doug Olenick  •  August 3, 2020

Suspects in the epic attack against Twitter were uncovered, in part, by the use of their real photo identification for cryptocurrency accounts they used to broker the sale of stolen usernames. The mistakes proved crucial to their identification, according to court documents.

Twitter Hackers Targeted Employees With Phone Phishing

Doug Olenick  •  July 31, 2020

The hackers who hijacked 130 high-profile Twitter accounts as part of a cryptocurrency scam earlier this month used a telephone-based spear-phishing attack to obtain employee credentials, the social media company says.

Diebold Nixdorf: ATMs in Europe Hacked

Doug Olenick  •  July 17, 2020

Diebold Nixdorf, a major manufacturer of ATMs, has issued an alert about "jackpotting" or "cash-out" attacks that are draining cash from its machines in several European countries. What makes these attacks unusual?

Twitter Hack: A Sign of More Troubles Ahead?

Scott Ferguson , Doug Olenick  •  July 16, 2020

While the Wednesday hijacking of several high-profile and verified Twitter accounts appears to have been confined to a cryptocurrency scam, security experts are warning that the platform's security failures could lead to bigger attacks down the road.

Phishing Campaign Used Chase Fraud Alert as Lure

Doug Olenick  •  July 15, 2020

Fraudsters used phishing emails purporting to be a warning from Chase Bank about "unusual activity" on credit cards in an attempt to steal consumers' account credentials, according to Mariana Pereira of the security firm Darktrace.

Card Skimmer Found Hitting Vulnerable E-Commerce Sites

Doug Olenick  •  July 8, 2020

A credit card skimmer that has been operating since April is specifically targeting sites hosted on Microsoft IIS servers that are currently running an out-of-date version of ASP.NET, according to security firm Malwarebytes. About 27 million websites still use this now unsupported software.

Just How Lucrative Are BEC Scams?

Doug Olenick  •  July 6, 2020

A Nigerian national who has been extradited to the United States allegedly laundered millions of dollars stolen in business email compromise scams, according to the Justice Department. He flaunted his lavish lifestyle on social media, prosecutors say.

Magecart Card Skimmer Hidden in Image's EXIF Metadata

Doug Olenick  •  June 29, 2020

Payment card hackers are now hiding malicious JavaScript inside an image's EXIF metadata and then sneaking the image onto e-commerce sites, according to the security firm Malwarebytes.

Payment Card Skimmer Attacks Hit 8 Cities

Doug Olenick  •  June 26, 2020

Eight U.S. cities recently had payment card data stolen via point-of-sale skimming malware on their Click2Gov online payment platforms, according to Trend Micro, which says five of those cities had already been victims of similar Magecart-style attacks in recent years.

Data Breach Extortion Campaign Relies on Ransomware Fear

Doug Olenick  •  June 16, 2020

Scammers are looking to capitalize on the extortion campaigns being conducted by the Maze ransomware gang and others by demanding thousands of dollars in ransom to not release data they claim to have exfiltrated when in fact no attack took place and no data was removed, according to security firm WebARX.

Bank of America: COVID-19 Loan Data May Have Leaked

Doug Olenick  •  May 21, 2020

Bank of America disclosed this week that some customers' data may have been exposed during the uploading of loan applications related to the Paycheck Protection Program - a U.S. government initiative created to provide business loans during the COVID-19 pandemic.