Author: neil

An estimated 35 million voters information from 19 states went up for sale on a dark web hacking forum. This was uncovered last Monday, October 15, by researchers from Anomali Labs and leading cybercrime intelligence provider, Intel 471. The discovery came just four weeks before the scheduled November 2018 US midterm elections. The data being sold contain full names, physical addresses, phone numbers, and voting history.

The hacked voter records came from the following states:

• Georgia
• Idaho
• Iowa
• Kansas
• Kentucky
• Louisiana
• Minnesota
• Mississippi
• Montana
• New Mexico
• Oregon
• South Carolina
• South Dakota
• Tennessee
• Texas
• Utah
• West Virginia
• Wisconsin
• Wyoming

Out of the mentioned 19 states, 3 states alone comprise 23 million records – Texas (14 million), Wisconsin (6 million), and Louisiana (3 million). They were offered for prices between $1,300 and $12,500. For the remaining 16 states, no record counts were provided but their price ranges from $150 to as high as $4,000.

From Anomali Labs:

“Of note, the seller indicates they receive weekly updates of voter registration data across the states and that they receive information via contacts within the state governments. Certain states require the seller to personally travel to locations in-state to receive the updated voter information. This suggests the information disclosure is not necessarily a technical compromise but rather a likely targeted campaign by a threat actor redistributing possibly legitimately obtained voter data for malicious purposes on a cybercrime forum.

To our knowledge, this represents the first reference on the criminal underground of actors selling or distributing lists of 2018 voter registration data, including US voters’ personally identifiable information and voting history. With the November 2018 midterm elections only four weeks away, the availability and currency of the voter records, if combined with other breached data, could be used by malicious actors to disrupt the electoral process or pursue large-scale identity theft.”

U.S. Department of Homeland Security (DHS) said in a report titled “Threats to Precision Agriculture” that there is an imminent risk and cybersecurity threats relating to the technology used by the agricultural industry. Simply known as precision agriculture, this technology relies on IoT or what is known as the Internet of Things. It aims to improve agricultural and livestock management through GPS, remote sensors and communication systems supporting them. Its adoption has significantly widened thus also increasing the potential security risks associated to it.

Based on the report, threat scenarios like malware infection, phishing, and incorrect usage of external drives like USBs could compromise automated systems with the deployment of precision agriculture. If any of these happen, it can lead to data loss, equipment destruction, loss of resources, and reputational damage. It can also put confidential data at risk for theft.

Best practices were also discussed in the said report which could mitigate the threats.

“Adoption of information security standards for precision agriculture is important for the future success of precision agriculture, along with industry efforts for equipment interoperability and data use / privacy. Vetted best practices, borne from hard experience learned in other sectors which have proceeded agriculture in the digital revolution, offer a proven path for data security.”

The US Department of Justice has announced this week that it has sentenced Nigerian Onyekachi Emmanuel Opara (30) of Lagos, Nigeria to 5 years prison time and was ordered to pay $2.54 million for defrauding victims in its Business Email Compromise (BEC) scam. Opara ran his fraudulent scams for two years (2014-2016) along with co-defendant David Chukwuneke Adindu targeting thousands of victims worldwide including the following countries:

• Australia
• New Zealand
• Singapore
• Sweden
• Switzerland
• United Kingdom
• United States

The sentence was served in Manhattan federal court. Adindu was already sentenced last December 14, 2017 to 41 months in prison and was also ordered to pay about $1.4 million in restitution.

This type of scam, BEC (also known as ‘CEO Fraud’), is very profitable since it only needs to be successful a few times to be highly cost-effective for the criminals. For his operation, Opara sent fake emails to employees of the victim companies pretending to be from their supervisors or from third-party vendors or partners which they had held business relationships with. Because the messages were sent from email account domains that appear to be similar to the true domains of respectable companies or spoofed from legitimate addresses, recipients are easily deceived.

Aside from his BEC scam, the 30-year old fraudster also registered to dating websites posing as an attractive young woman named “Barbara”. He was able to engage in romantic relationships through this and convince individuals in the US to send him money overseas or to accept funds from his BEC scams so he can hide the money trail.

Opara was arrested in December 22, 2016 in Johannesburg, South Africa. He was extradited to the United States a month later, pleading guilty just last April for conspiracy to commit wire fraud and wire fraud leading to his incarceration.