“Wrapped” Bitcoin worth more than $12m has been stolen from the decentralized finance protocol pNetwork. 

The cross-chain project announced the theft of 277 BTC on September 19 via Twitter, ascribing the hack to a codebase vulnerability. 

The theft was executed on Binance Smart Chain, which featured in the biggest ever DeFi heist in history – the $610m Poly Network hack that took place in August.

pNetwork supports multiple blockchains, including Ethereum, xDAI, EOS, Polygon, Binance Smart Chain, Telos and Ultra. Wrapped tokens increase interoperability between different blockchains by making it possible for currency created on one blockchain to cross onto another.

“We’re sorry to inform the community that an attacker was able to leverage a bug in our codebase and attack pBTC on BSC, stealing 277 BTC (most of its collateral),” said pNetwork.

“The other bridges were not affected. All other funds in the pNetwork are safe.”

The DeFi platform said it had identified the bug but would keep certain data bridges closed until a fix was found.

In a bid to recover the stolen cryptocurrency, pNetwork has publicly offered to pay its attacker 12.5% of their total illegal haul. 

“To the black hat hacker. Although this is a long shot, we’re offering a clean $1,500,000 bounty if funds are returned,” said the platform on Twitter.

“Finding vulnerabilities is part of the game, unfortunately, but we all want [the] DeFi ecosystem to continue growing, returning funds is a step in that direction.”

pNetwork is undertaking an investigation which it described as “a detailed post-mortem.”

“We want to assure everyone that we are prioritizing security over speed,” said the platform, adding, “Bridges are being extensively reviewed for that and similar exploits.”

On Monday, pNetwork said that while its Telos and EOS bridges had been safely restored, they would be “running with extra security measures in place for the first few days.”

In its most recent update, posted at around 6 pm Eastern Time on September 20, the platform said that the pUOS on Ultra bridge was not affected and is now back up.

“A detailed post-mortem will be shared tomorrow. Updates to follow on the gradual reactivation of all other bridges,” said pNetwork. 

The University of Minnesota has announced a new center that aims to ensure that medical devices are safe and secured against cybersecurity threats. 

The Center for Medical Device Cybersecurity (CMDC) was created after members of the medical device manufacturing industry called for a collaborative hub to facilitate discovery, outreach, and workforce training in device security. 

CMDC will foster university-industry-government collaborations focusing on developing new education and training, technologies, and research to address potential threats to the cybersecurity of medical devices. 

Collaborators already signed up to work with the CMDC include the University of Minnesota College of Science and Engineering, the Technological Leadership Institute, the Office of the Vice President for Research, and the Earl E. Bakken Medical Devices Center.

“Cultivating innovative and transformational partnerships, like the CMDC, is a core focus of MPact 2025, our new systemwide strategic plan,” said University of Minnesota president Joan Gabel. “I’m excited about how this new innovative center will enhance the security of our state’s thriving medtech sector and beyond.”

The Technological Leadership Institute (TLI), an interdisciplinary center at the University of Minnesota that is sited within the College of Science and Engineering, will house the new CMDC.

“The center aligns perfectly with our mission and merges the expertise within our Medical Device Innovation and Security Technologies masters programs,” said TLI director Allison Hubel. 

“While manufacturers can ensure a high level of safety through testing, the security of connected devices remains a growing and moving target, making this collaboration and the work of the CMDC critical to the industry and all those it serves.”

Plans for the center’s first year include a hackathon, roundtables, organizing networking and training opportunities, implementing a medical device cybersecurity short course that TLI will launch this fall, and establishing a medical device cybersecurity internship program. 

Health industry companies Boston Scientific, Smiths Medical, Optum, Medtronic, and Abbott Laboratories provided much of the funding for the CMDC.

The United States remains the largest medical device market globally, with 40% of the global medical device market (valued at $156bn) in 2017. By 2023, the medical device market in the US is expected to grow to $208bn.

The United Kingdom’s Ministry of Defense has apologized for sending an email that exposed the data of more than 250 Afghan interpreters who worked for British forces. 

The impacted interpreters are seeking to be relocated to the UK either from Afghanistan, where many are currently in hiding from the Taliban, which seized power in August, or from another country to which they have relocated. 

The email – in which the interpreters’ email addresses, names, and some linked profile images were exposed – was sent by the team in charge of the UK’s Afghan Relocations and Assistance Policy (ARAP) to Afghan interpreters who have either left Afghanistan or who remain in the country. 

One of the email’s recipients told the BBC: “This mistake could cost the life of interpreters, especially for those who are still in Afghanistan. Some of the interpreters didn’t notice the mistake and they replied to all the emails already and they explained their situation which is very dangerous.”

The MoD has reportedly suspended an official and launched an investigation into the data breach, which UK defense secretary Ben Wallace has described as “unacceptable.”

An MoD spokesperson said: “We apologize to everyone impacted by this breach and are working hard to ensure it does not happen again.”

Commenting on ARAP’s failure to utilize the BCC email feature, Labour shadow defense secretary John Healey said: “We told these Afghans interpreters we would keep them safe, instead this breach has needlessly put lives at risk.”

Martin Jartelius, CSO at Outpost24, said that while this type of email-based data breach could easily occur, it was “sad and unnecessary in most organizations.”

“It’s so extremely easy to, by mistake and in stress, send an email with recipients listed openly instead of in BCC,” said Jartelius. “Still, for example, in the Office365 suite, there are solutions, of which the easiest to at least give an additional notice is the feature mail tips.

“Here you can set the flag to warn for ‘Large Audience,’ and even as an organization sets what [that] level is – the default is 25 if enabled. Organizations that do not want to make the same mistake can set a warning this way.” 

Corporate end-users should be on high alert for phishing attacks in the final quarter of the year as this is when most malicious emails are likely to land, according to new research from Tessian.

The email security vendor analyzed four billion messages sent between July 2020 and July 2021 to compile its Spear Phishing Threat Landscape 2021 report.

It found 45% more malicious emails sent in October, November and December 2020 than in the previous quarter. That’s perhaps not surprising given the number of opportunities for threat actors at the end of the year to capitalize on current events.

November 2020 saw the most significant spike, with around 90,000 malicious emails detected in the week of the Black Friday sales.

Overall, employee inboxes received 14 malicious emails per year, rising dramatically to 49 on average in the retail sector, 31 in manufacturing, and 22 in the food and drink industry. Employees working in research and development received 16, and those with tech roles received 14.

Organizations don’t just need to keep an eye out for phishing and scam emails in the fourth quarter; they should also train staff to be watchful at specific hours of the day.

The report revealed that malicious emails are typically delivered around 2 pm and 6 pm, perhaps trying to hit inboxes when employees are at their most distracted — just after lunch and at the end of the day.

The most common tactics detected by Tessian were impersonation techniques like display name spoofing (19%), as well as domain impersonation (11%) and account takeover (2%).

The most spoofed brands over the year were Microsoft, ADP, Amazon, Adobe Sign and Zoom.

Tessian CISO, Josh Yavor, argued that staff training alone is not enough to mitigate the threat from malicious emails.

“Gone are the days of the bulk spam and phishing attacks, and here to stay is the highly targeted spear-phishing email. Why? Because they reap the biggest rewards,” he added.

“Cyber-criminals are always finding ways to bypass detection and reach employees’ inboxes, leaving people as the last line of defense. Businesses need a more advanced approach to email security to stop the threats that are getting through because it’s not enough to rely on your people 100% of the time.”

Emerging technologies like blockchain and AI should be seen as an opportunity and a threat, according to Professor Lisa Short, director and co-founder of Hephaestus Collective, whose rousing opening keynote addressed attendees of Infosecurity Magazine’s Autumn Online Summit – EMEA 2021.

Short began by describing the vast digital shift that has taken place in recent years, noting that advancements in technology mean “revolutions” are now occurring in less than a generation. For example, the development of technologies like AI, blockchain and IoT has meant that in the past two years, tech changes that previously would have taken seven years are now being achieved in just six months.

She also provided some startling statistics around the rate of information being created and published since the advent of social media and user-generated content. Short observed that from the beginning of recorded history to 2003, the entire written works of humanity amounted to five exabytes of data. Since 2003, this same amount of data has been created every two days on average.

These trends provide enormous benefits — as highlighted by the ability to shift to remote working during the COVID-19 pandemic. However, there are reasons for concern. Technologies such as GPT-3 are now capable of recording our habits and knowledge “and influence our thoughts,” making the digital world very “pervasive.” Currently, over half the world’s population are internet users, and this is quickly growing.

Short added it is estimated that by 2023, 70% of all enterprise workloads will be in the cloud, meaning there will be a “lot of material going into a pervasive digital space that is in fact not our computer, it’s on somebody else’s.”

This rapid digitization increases the risk of data breaches. The cost is predicted to surpass $6tn in 2021 and $10.5tn in 2025. Short pointed out this cost, which is just one aspect of infosecurity, is higher than every natural disaster globally in a year and is “considered a bigger threat to humanity than nuclear weapons of mass destruction.” The entire sector spend on cybersecurity, including ransomware costs, is believed to have reached $1tn per annum.

She highlighted that many security experts cite the pace of technology adoption as a significant contributing factor to the increasingly dangerous cyber-threat landscape. This view is because “many of the latest tech-powered business strategies — such as storing massive amounts of data — introduce exponentially more risk.”

Short, therefore, believes a mindset shift is needed, which views advanced technologies as an opportunity to enhance safety and trust online rather than a threat. As Short put it, “invest more in what we have to gain than what we spend to lose.”

This investment must aim to enhance digital trust, most notably by “prioritizing education of people and establishing a culture within businesses and the economy about digital health and trust being a way of life rather than a choice.”

Blockchain and other emergent technologies can help provide governance and assurance over the digital world, if used properly, according to Short. The key to this is fully understanding these technologies and their underlying philosophy. Short emphasized this does not necessarily mean knowledge of the technicalities, such as coding, but rather what it is, how it works and why it helps. These fall into four philosophical concepts:

• Ontology — what is it
• Epistemology — what is it helping us know and understand
• Axiology — how is it changing behavior
• Methodology — strategy and justification of deployment

Short said, according to estimates, achieving this understanding is critical, as blockchain technology can boost global GDP by $1.76tn over the next ten years. Additionally, if just 1% of SMEs adopt, deploy, and understand this technology, this could offer a further boost of $1.42tn. This requires an “inward-facing look at our own self, our businesses and the economy,” which is something organizations typically fail to do, handing over responsibility for areas like cybersecurity to others.

Unfortunately, there is currently a severe lack of knowledge of blockchain across society and the economy; Short said less than 3% of academics, government decision-makers, and board members and leaders have any science and tech expertise, and less than that with knowledge of blockchain. This lack of insights leads to poor outcomes. One example she gave was the UK Financial Conduct Authority banning crypto derivatives and exchange-traded notes to retail investors, which led to these funds simply being taken out of the UK economy.

There is also a significant lack of knowledge of the cybersecurity industry, which contributes to false information and social engineering being spread around blockchain.

Short pointed out that “the front door keys to the digital world are digital identity,” and blockchain offers “amazing potential” in this respect, especially regarding its encryption and evidentiary capabilities. For example, blockchain-enabled a digital trail to be followed to help recover 80% of the funds paid to the DarkSide ransomware gang following the attack on Colonial Pipeline earlier this year.

Other opportunities technologies like blockchain and IoT offer include turning non-performing assets into corporate intelligence and sharing assets without moving data around. “We can cyber-harden the resilience and go straight to the core by making sure we anchor to blockchain and cryptographically encode data,” thereby preventing malicious actors from accessing the data in the first place. Short added: “These technologies have profound abilities to value create and protect assets rather than stopping people getting into the business.”

Short concluded by stating it is the responsibility of the cyber industry to keep up with the pace of technology development and not fear it, thereby providing accurate information over its potential. “It is up to us as an industry to ensure that we give the correct information, that we do bust those myths. If we don’t understand, we seek an understanding,” she outlined.

An Iowan agricultural group hit by ransomware over the weekend appears to have claimed that the impact of the attack on the US public could be worse than the Colonial Pipeline incident.

The attack has been traced to BlackMatter, a group that some believe has links to the DarkMatter outfit responsible for the days-long oil supply outage in May, which sent prices soaring on the East Coast.

According to reports, it targeted New Cooperative, a major US grain producer, with a $5.9m ransom demand.

However, screenshots of the negotiations between the two parties posted on Twitter by security researchers shed some interesting light on the attack’s significance.

In one, the cooperative’s spokesperson suggests that the ransomware group has misjudged the scale of the impact a resulting supply chain outage could have.

“The impact of this attack will likely be much worse than the pipeline attack for context, and we have no way to control that given the disruption this has already caused,” they said. “I am just telling you this so you are not surprised as it does not seem like you understood who we are and what role our company plays in the food supply chain.”

The threat actors appeared unmoved, demanding the firm come up with the money.

The to-and-fro between victim and extorter has added significance given the Biden administration has made it clear to the Kremlin that 16 critical infrastructure sectors of the US economy are off-limits to cybercrime groups thought to be operating from Russia.

After a relatively quiet summer, this attack would appear to be testing those red lines.

“There is going to be very very public disruption to the grain, pork and chicken supply chain. About 40% of grain production runs on our software and 11 million animals feed schedules rely on us,” the spokesperson said, according to another screenshot.

“This will break the supply chain very shortly, and we will have to report this to our regulators and likely the public if this disruption continues … CISA is going to be demanding answers from us within the next 12 hours or so and we are going to have to tell them exactly what has happened.”

Hank Schless, senior manager of security solutions at Lookout, argued that firms would need better to protect themselves in place of any geopolitical breakthrough.

“BlackMatter claimed that New Cooperative doesn’t reach the threshold that the President laid out. Threat actors already operate outside the bounds of the law, so why would they suddenly comply? If this is the attitude Russia-based threat actors have towards the President’s warnings, then this could be indicative of similar attacks to come,” he added.