Cathay Pacific Hacked, Compromising the Data of Millions of Passengers

Cathay Pacific Airways Limited, the flag carrier of Hong Kong, admitted having suffered a major data leak affecting up to 9.4 million passengers.

Exposed data includes passport numbers, identity card numbers, email addresses, and credit card details were accessed, information exposed varies for each affected passenger.

“As part of our ongoing IT security processes, we have discovered unauthorized access to some of our passenger data.  Upon discovery, we took immediate action to contain the event, and further strengthen our IT security measures.” reads the official statement published by the airline.

The IT staff at Cathay discovered an unauthorized access of systems containing the passenger data of up 9.4 million people. Hackers also accessed 403 expired credit card numbers and twenty-seven credit card numbers with no CVV were accessed.

The company is notifying the affected passengers through multiple channels.

“We are in the process of contacting affected passengers, using multiple communications channels, and providing them with information on steps they can take to protect themselves,” said Cathay Pacific Chief Executive Officer Rupert Hogg.

“We have no evidence that any personal data has been misused.”

“The following personal data was accessed: passenger name, nationality, date of birth, phone number, email, address, passport number, identity card number, frequent flyer programme membership number, customer service remarks, and historical travel information.” Hogg added.

The company immediately reported the incident to the authorities and launched an investigation.

At the time there is no news about financial compensation for affected passengers.

Anyone who believes they may be affected can contact Cathay Pacific in the following ways:

• Via the dedicated website – infosecurity.cathaypacific.com – which provides information about the event and what to do next

• Via Cathay Pacific’s dedicated call centre available after 12:30/25OCT (GMT+8) (toll free numbers are available on infosecurity.cathaypacific.com)

• Email Cathay Pacific at infosecurity@cathaypacific.com

5 Most Prevalent Phishing Subject Lines

Chances are good there's a phishing scam lurking amid your emails right now. If there isn't, then perhaps there will be tomorrow, or the next day. The question is, will you fall for it?

Phishing emails are getting tougher to block because attackers are crafting their bait to be more convincing to targets, researchers report. And employees are quick to open potentially malicious emails, even when they know they should be on alert.

Here's a look at the most commonly used phishing subject lines, the messages they include, and what they reveal about their attackers' goals and tactics.

'Assist Urgently'

Attackers convey a sense of immediacy when they don't want targets to dwell on their choice to act. It's something they want you to make a decision on quickly.

Maybe the note won't say "assist urgently," but a similar prompt for employees. Related subject lines he commonly sees include "Review" or "Quick Review," both of which demand a person to take action. 'Important: (1) NEW message from' is another popular one.

'Invoice'

"Invoice" is seen in six of the top ten phishing subject lines detected. Financial motivation is far in the lead when considering phishing subject lines.

While the top six scams differ in message content, all try to lure their targets with the word "invoice" as the subject line. Money is a powerful motivator. Attackers know it, and they're using it to their advantage.

'Verify Your Account'

This subject line has less to do with direct financial gain and more to do with credential theft. While there may be a financial component to these types of attacks, credential phishing is typically done to gain a foothold inside a target network.

When talking about this idea of credential phishing, 'verify account' is designed to get you on a landing page to validate your credentials. Attackers want your username and password. To get them, they might try to impersonate a brand you frequently use.

'AMAZON: Your Order no #812-4623 might have ARRIVED'

These types of emails are frequently seen around the holidays. Certain types of attacks were more prevalent during different times of the year: financial and tax-related scams arrived around tax season, and fraudulent messages about deliveries show up at Christmastime.

Most people who frequently shop on Amazon will investigate emails like these to see which order it's referring to, or remind themselves of what they purchased. They'll click the link to see what they ordered, and they realize they've already infected their machine.

'Copy' or 'Document Copy'

While malicious links are increasingly commonplace in phishing emails, attachments continue to be popular – and effective – especially in emails related to invoices, payment notifications and statements, or alerts associated with online ordering and billing.

This aligns with the trend of attackers improving their understanding of business context. If they know employees frequently send documents, they know a malicious spreadsheet or Word file won't seem out of place.

The fact that many phishing subject lines are short – only one or two words – is indicative of attackers' understanding that modern business communication is relatively informal. People in a business context do things in a hurry. It doesn't have to be specific.

Your Facebook Account Has Not Been 'Cloned'

Facebook users are being duped into thinking that their accounts have been cloned thanks to a viral message that made the rounds of the social networking site on Sunday.

The message says that the sender has received a duplicate friend request from the recipient. Then, it tells the receiver to forward the same message to their friends. Many have apparently taken that to mean that they should forward the same message to all of their friends, prompting dozens or even hundreds of others to believe that there may be a problem with their accounts as well.

The message hints that the receiver may have been the victim of a cloning scam. That’s where a malicious user copies images and information from a person’s Facebook account in order to create a duplicate “clone” account, then sends out friend requests to the victim’s friends. The duplicate user may message these friends in an attempt to learn personal information about the cloned user or to spread scam messages.

There appears to be no reason at this time to forward a message telling friends that their account may have been cloned without having actually received a duplicate friend request.

So what should you do if you receive one of these hoax messages? Nothing. Delete the message and move on.

If you are worried you might be the victim of Facebook cloning, try searching for other versions of your account and report duplicate profiles to Facebook.

China Reportedly Used Chips to Spy on US Tech Companies

A media report today revealed details of a significant supply chain attack which appears to be one of the largest corporate espionage and hardware hacking programs from a nation-state.

According to a lengthy report published today by Bloomberg, a tiny surveillance chip, not much bigger than a grain of rice, has been found hidden in the servers used by nearly 30 American companies, including Apple and Amazon.

The malicious chips, which were not part of the original server motherboards designed by the U.S-based company Super Micro, had been inserted during the manufacturing process in China.

The report, based on a 3-year-long top-secret investigation in the United States, claims that the Chinese government-affiliated groups managed to infiltrate the supply chain to install tiny surveillance chips to motherboards which ended up in servers deployed by U.S. military, U.S. intelligence agencies, and many U.S. companies like Apple and Amazon.

"Apple made its discovery of suspicious chips inside Supermicro servers around May 2015, after detecting odd network activity and firmware problems, according to a person familiar with the timeline," the report said.

"Since the implants were small, the amount of code they contained was small as well. But they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere on the internet that were loaded with more complex code; and preparing the device’s operating system to accept this new code."

The chips suspected to have been added to help Chinese government spy on American companies and their users—basically a "hardware hack" that according to the publication is "more difficult to pull off and potentially more devastating, promising the kind of long-term, stealth access that spy agencies are willing to invest millions of dollars and many years to get."

Apple, Amazon, and Super Micro Refute the Bloomberg Report

Apple told Bloomberg that the company has never found malicious chips, "hardware manipulations," or vulnerabilities purposely planted in any of its servers, or it "had any contact with the FBI or any other agency about such an incident."

Apple ended its relationship with Super Micro in 2016. To its best guess, Apple said that the Bloomberg reporters confused their story with a previously-reported 2016 incident in which the company found an infected driver on a single Super Micro server in one of its labs.

Amazon also says it is "untrue" that the company knew of "a supply chain compromise," or "servers containing malicious chips or modifications in data centers based in China," or that it "worked with the FBI to investigate or provide data about malicious hardware."

Meanwhile, Supermicro and Chinese Ministry of Foreign Affairs have also strongly denied Bloomberg's findings by releasing lengthy statements. Here you can find a full list of official statements from Amazon, Apple, Supermicro and Chinese Ministry of Foreign Affairs.

New iPhone Passcode Bypass Hack Exposes Photos and Contacts

Jose Rodriguez, an iPhone enthusiast, has discovered a passcode bypass vulnerability in Apple’s new iOS version 12 that potentially allows an attacker to access photos and contacts, including phone numbers and emails, on a locked iPhone XS and other recent iPhone models.

Rodriguez, who also discovered iPhone lock screen hacks in the past, has posted two videos (in Spanish) on his YouTube channel under the account name Videosdebarraquito demonstrating a complicated 37-step iPhone passcode bypass process.

The iPhone authorization screen bypass flaw works on the latest iPhones, including the iPhone XS, running Apple's latest iOS 12 beta and iOS 12 operating systems.

Video Demonstrations: Here's How to Bypass iPhone Passcode

As you can watch in the video demonstrations, the iPhone hack works provided the attacker has physical access to the targeted iPhone that has Siri enabled and Face ID either disabled or physically covered.

Subscribe for more pascode bypasses coming soon ;) Passcode Bypass (Note) https://m.youtube.com/watch?v=fZh4cM3R0qU

Once these requirements are satisfied, the attacker can begin the complicated 37-step iPhone passcode bypass process by tricking Siri and iOS accessibility feature called VoiceOver to sidestep the iPhone's passcode.

This iPhone passcode bypass method potentially allows the attacker to access the contacts stored in the iPhone, including phone numbers and email addresses, and to access Camera Roll and other photo folders, by selecting a contact to edit and change its image.

Though Apple has some built-in security measures to prevent this from happening, Rodriguez found a way to bypass those security barriers, as you can see in the video.

Here's how to Fix the iPhone Passcode Bypass Bug

The passcode bypass methods work on all iPhones including the latest iPhone XS lineup, but the company does not appear to have patched the vulnerabilities in the latest iOS 12.1 beta.

Until Apple comes up with a fix, you can temporarily fix the issue by just disabling Siri from the lockscreen. Here's how to disable Siri:

• Go to the Settings → Face ID & Passcode (Touch ID & Passcode on iPhones with Touch ID) and Disable Siri toggle under "Allow access when locked."

Of course, disabling Siri would cripple your iOS 12 experience, but would prevent attackers from abusing the feature and breaking into your iPhone.

Meanwhile, just wait for Apple to issue a software update to address the issue as soon as possible.