More than a billion records were exposed after a misconfiguration error left a CVS Health cloud database without password protection.

The 240GB of unsecured data was discovered by WebsitePlanet and security researcher Jeremiah Fowler in a cooperative investigation. 

Because of the security oversight by CVS Health, which owns CVS Pharmacy and Aetna, a total of 1,148,327,940 records were exposed.

Information that was left publicly accessible to anyone who knew how to look for it included customers’ search histories detailing their medications, and production records that exposed visitor ID, session ID, and device information (i.e., iPhone, Android, iPad, etc.). 

Personal data was also exposed, with researchers noting that “a sampling search query revealed emails that could be targeted in a phishing attack for social engineering or potentially used to cross reference other actions.”

Researchers said that any threat actors who accessed the database could have gleaned a clear understanding of configuration settings, discovered where data is stored, and accessed a blueprint of how the logging service operates from the backend.

After encountering the unprotected database on March 21, researchers contacted CVS Health, which acted swiftly to restrict public access.

“We were able to reach out to our vendor and they took immediate action to remove the database,” said CVS Health. “Protecting the private information of our customers and our company is a high priority, and it is important to note that the database did not contain any personal information of our customers, members or patients.”

“Misconfigurations like these are becoming all too common. Exposing sensitive data doesn’t require a sophisticated vulnerability, and the rapid growth of cloud-based data storage has exposed weaknesses in processes that leave data available to anyone,” PJ Norris, senior systems engineer at Tripwire, told Infosecurity Magazine.

He continued: “A misconfigured database on an internal network might not be noticed, and if noticed, might not go public, but the stakes are higher when your data storage is directly connected to the internet. Organizations should identify processes for securely configuring all systems, including cloud-based storage, like Elasticsearch and Amazon S3.”

Australians’ lives were disrupted on Thursday by a widespread internet outage that impacted the country’s mail service and multiple businesses, including banks and airlines.

The outage began in the early hours and was caused by a problem at Akamai Technologies, a global content delivery network (CDN) and cybersecurity and cloud service provider. 

Akamai, which is based in Cambridge, Massachusetts, has acknowledged the issue, but has not yet disclosed the cause of service disruptions to its hosting platform, which mitigates against Distributed Denial-of-Service (DDoS) attacks. 

Akamai’s Chris Nicholson told NPR: “Akamai can confirm the segment of our Prolexic platform impacted is up and running and we are continuing to validate services. We will share more details of what transpired, but our first priority is ensuring all customer impact is mitigated.”

Three of the country’s four largest banks – ANZ, Westpac, and the Commonwealth Bank (CBA) – were all affected along with many smaller banks and some credit unions.

On Thursday afternoon, banking customers began reporting on social media that they were experiencing access issues when trying to use online banking services and banking apps.

Banks used social media to let their customers know that they were trying to deal with the situation.

CBA tweeted: “We’re aware some of you are experiencing difficulties accessing our services and we’re urgently investigating.”

The Reserve Bank of Australia said on Thursday night: “We have implemented appropriate mitigations and the website is now back up and running.” 

However, ABC News reported that ongoing technical problems led to the cancellation of some market operations between the Reserve Bank and other commercial banks. 

Services were also disrupted at Southwest Airlines, United Airlines, and Virgin Australia, which stated on social media that it was being impacted by a system outage that had affected its website and contact center.

Virgin, whose services were back online shortly after 5pm, stated that it “was one of many organizations to experience an outage with the Akamai content delivery system today and we are working with them to ensure that necessary measures are taken to prevent these outages from reoccurring.”

The national mail service, Australia Post, said that a number of its services had been knocked offline by an “external outage.” The Hong Kong Stock Exchange‘s website was also impacted.

Australians’ lives were disrupted on Thursday by a widespread internet outage that impacted the country’s mail service and multiple businesses including banks and airlines.

The outage began in the early hours and was caused by a problem at Akamai Technologies, a global content delivery network (CDN), cybersecurity and cloud service provider. 

Akamai, which is based in Cambridge, Massachusetts, has acknowledged the issue, but has not yet disclosed the cause of service disruptions to its hosting platform, which mitigates against Distributed Denial-of-Service (DDoS) attacks. 

Akamai’s Chris Nicholson told NPR: “Akamai can confirm the segment of our Prolexic platform impacted is up and running and we are continuing to validate services. We will share more details of what transpired, but our first priority is ensuring all customer impact is mitigated.”

Three of the country’s four largest banks – ANZ, Westpac, and the Commonwealth Bank (CBA) – were all affected along with many smaller banks and some credit unions.

On Thursday afternoon, banking customers began reporting on social media that they were experiencing access issues when trying to use online banking services and banking apps.

Banks used social media to let their customers know that they were trying to deal with the situation.

CBA tweeted: “We’re aware some of you are experiencing difficulties accessing our services and we’re urgently investigating.”

The Reserve Bank of Australia said on Thursday night: “We have implemented appropriate mitigations and the website is now back up and running.” 

However, ABC News reported that ongoing technical problems led to the cancellation of some market operations between the Reserve Bank and other commercial banks. 

Services were also disrupted at Southwest Airlines, United Airlines, and at Virgin Australia, which stated on social media that it was being impacted by a system outage that had affected its website and contact center.

Virgin, whose services were back online shortly after 5pm, stated that it “was one of many organizations to experience an outage with the Akamai content delivery system today and we are working with them to ensure that necessary measures are taken to prevent these outages from reoccurring”.

The national mail service Australia Post said that a number of its services had been knocked offline by an “external outage”. The Hong Kong Stock Exchange‘s website was also impacted.

Peloton bike users could be spied on while working out, according to new research by McAfee’s Advanced Threat Research team.

The team discovered a vulnerability (CVE-2021-3387) in the touchscreen of the $2,495 Bike+ that allows it to be controlled remotely by a threat actor without any interference to the equipment’s operating system.

Hackers could exploit the flaw to install malicious apps that spoof Netflix or Spotify to steal personal details and login credentials. 

Researchers also found that the vulnerability allowed bad actors to access the Peloton bike’s microphone and camera to spy on users. 

McAfee said that bikes used in hotels and other public spaces were most at risk because hackers had to physically access the screen and infect it with malicious code stored on a USB drive to exploit the flaw. 

The lower-priced Peloton Bike is not affected by the flaw as the fitness device uses a different type of touchscreen. 

But researchers noted: “Further conversations with Peloton confirmed that this vulnerability is also present on Peloton Tread exercise equipment, however, the scope of our research was confined to the Bike+.”  

The flaw was detected in the Peloton bike’s software. After McAfee shared the discovery with Peloton, the two companies joined forces to “responsibly develop and issue a patch.”

A mandatory software update that fixes the issue was released to users by Peloton earlier this month. 

Adrian Stone, Peloton’s Head of Global Information Security, said: “This vulnerability reported by McAfee would require direct, physical access to a Peloton Bike+ or Tread. Like with any connected device in the home, if an attacker is able to gain physical access to it, additional physical controls and safeguards become increasingly important. 

“To keep our members safe, we acted quickly and in coordination with McAfee. We pushed a mandatory update in early June and every device with the update installed is protected from this issue.”

McAfee’s report is the second security issue to hit Peloton in the past two months. In May, the company released an update to stop the leakage of personal account information, including the age, weight and location of its users.

The London Office for Rapid Cybersecurity Advancement (LORCA) has launched a new initiative designed to propel the growth of UK cyber startups.

LORCA Ignite will see six of the most successful companies that have graduated from the LORCA accelerator program during the past three years participate in a new, intensive program, which will help them achieve rapid scale and commercial growth.

LORCA is a government-backed initiative that started in 2018 to accelerate the growth of UK cyber startups. It is delivered by Plexal at the London-based technology hub Here East and is supported by Deloitte and the Centre for Secure Information Technologies (CSIT) at Queen’s University Belfast. The year-long programs help the selected startups to secure investment, access new markets, and even participate in overseas trade missions, alongside mentoring and training sessions.

LORCA has significantly exceeded expectations during that time, with the 72 cyber startups and scaleups to take part in the program so far raising more than £200m in investment and generating over £37m in revenue. The level of investment achieved at this point is a massive 450% higher than LORCA’s original target that was set in 2018.

The new six-month program will enable the six selected firms to attend commercial and technology validation clinics and a showcase event. These firms have collectively raised £27m in investment and grants in the last three years. Additionally, LORCA Ignite will provide them with access to investors, mentoring services, and national and global networks and connect them to companies and security leaders who may require their products and services.

The cohort will also receive professional services expertise from several LORCA’s corporate partners, including AHL Connect, Outfly, Informed Funding, and Infosec People.

The six companies making up the LORCA Ignite cohort are:

• Ampliphae – https://www.ampliphae.com/
• CyberOwl – https://www.cyberowl.io/
• CyberSmart – https://cybersmart.co.uk/
• Risk Ledger – https://riskledger.com/
• Salt Communications – https://saltcommunications.com/
• Crypto Quantique – https://www.cryptoquantique.com/

Digital Infrastructure Minister Matt Warman commented: “Good cybersecurity is the bedrock of our digital economy, and our thriving sector will play a vital role in helping the nation build back better and stronger from the pandemic.

“Through our support for LORCA, we are backing our innovative cyber startups to grow their businesses and develop the cutting-edge solutions people and companies need to stay one step ahead of security threats.”

Saj Huq, director of LORCA, outlined: “LORCA Ignite is the evolution of an accelerator program that has demonstrated the extraordinary success of the British startup ecosystem over the last three years. By combining government support with innovation expertise and access to investors and global tech leaders, LORCA has accelerated the growth of a new generation of world-class British cyber startups. LORCA Ignite will continue that growth trajectory for some of the most high-potential businesses that have participated in our program. The UK has a globally competitive cyber ecosystem, and we need to provide support to the cyber scaleups at the forefront of what is quickly becoming a jewel in the UK’s tech crown.”

This week, it was announced that Risk Ledger, one of the companies that will take part in LORCA Ignite, has been chosen by NHS Test and Trace to help it manage its supply chain cybersecurity risks.

Researchers have admitted they’re baffled by a new piece of malware primarily designed to prevent victims from visiting software piracy sites.

Sophos principal researcher, Andrew Brandt, branded the discovery “one of the strangest cases I’ve seen in a while.”

It’s hidden in pirated copies of various software, including security products, and distributed on game chat service Discord and through Bittorent. Once double-clicked, it works by flashing up a bogus error message on the victim’s screen while executing.

The malware apparently blocks infected users from visiting a large number of piracy sites by modifying the HOSTS file on their systems. Brandt described this as a “crude but effective” strategy — crude because although it works, the malware has no persistence mechanism.

This means that anyone can remove the HOSTS file entries and stay removed unless the program is run a second time. Bizarrely, Brandt claimed to have discovered a malware family that behaved almost identically more than a decade ago.

The malware also downloads and executes a second payload, an executable named “ProcessHacker.jpg.”

It’s detected by Sophos as Mal/EncPk-APV.

Brandt said that the malware developer’s end game is still a mystery.

“On the face of it, the adversary’s targets and tools suggest this could be some kind of crudely compiled anti-piracy vigilante operation. However, the attacker’s vast potential target audience — from gamers to business professionals — combined with the curious mix of dated and new tools, techniques and procedures (TTPs) and the bizarre list of websites blocked by the malware, all make the ultimate purpose of this operation a bit murky,” he added.

“There may not even be an overall purpose to this attack at all. However, that doesn’t reduce the level of risk or the potential disruption for victims.”

Brandt urged users to install a robust security solution to spot such threats and avoid downloading pirated or “too good to be true” software.