Slashdot Mirror
Deloitte Hit By Cyber-attack Revealing Clients' Secret Emails (theguardian.com)
Accounting firm Deloitte confirmed on Monday it had suffered a cyberattack. From a report: One of the world's "big four" accountancy firms has been targeted by a sophisticated hack that compromised the confidential emails and plans of some of its blue-chip clients, the Guardian can reveal (the company has since confirmed the breach). Deloitte, which is registered in London and has its global headquarters in New York, was the victim of a cybersecurity attack that went unnoticed for months. One of the largest private firms in the US, which reported a record $37bn revenue last year, Deloitte provides auditing, tax consultancy and high-end cybersecurity advice to some of the world's biggest banks, multinational companies, media enterprises, pharmaceutical firms and government agencies. The Guardian understands Deloitte clients across all of these sectors had material in the company email system that was breached. The companies include household names as well as US government departments
Financial data, of course, is what we think of as some of the most private of data.
And it's also some of the data that we would most benefit from knowing.
Deloitte provides auditing, tax consultancy and high-end cybersecurity advice
Not anymore, I imagine.
https://krebsonsecurity.com/2017/09/source-deloitte-breach-affected-all-company-email-admin-accounts/
Source: Deloitte Breach Affected All Company Email, Admin Accounts
Deloitte, one of the world’s “big four” accounting firms, has acknowledged a breach of its internal email systems, British news outlet The Guardian revealed today. Deloitte has sought to downplay the incident, saying it impacted “very few” clients. But according to a source close to the investigation, the breach dates back to at least the fall of 2016, and involves the compromise of all administrator accounts at the company as well as Deloitte’s entire internal email system.
I think we are rapidly approaching the day when the fun and games of the free, open Internet, with every last gadget, device, appliance, phone, tablet, laptop, pc and server all being on that very same Internet.
Why there would need to be direct access from the public Internet to some of the data we've seen compromised recently is beyond me. Cheap bastards in the C-Suites? I get that if I want to see my account in an online banking web site that the web server I access is going to be connected to the public Internet but why wouldn't the back-end, such as the customer database be on a separate network with tightly controlled access from the public facing web servers to the back-end databases. It shouldn't be possible to connect from the public Internet via some exploit in the public-facing web server and then just dump the contents of all the back-end database servers.
Am I just being naive here? Are going to end up requiring all connected devices have licenses/permits?
With all these types of attacks surfacing, I question why we let production machines access the internet at all. I'm talking no email client, no browsers, no FTP or SSH, nothing. All ports to the internet are closed for business.
Instead, all users would have a Citrix or RDP app installed which provides the same apps, Outlook, Chrome, and other internet utilities. The virtual machine those apps are running on a different VLAN (or a physically separated connection), which only has access to the corporate network through ports that support the remote VM session, as well as a single DMZ'd file server.
Any file downloaded through the remote session would be saved to the DMZ, which is processing all files automatically, scanning for malware, objectional content, executable code, steganographically hidden content, etc. Once the file is marked as safe a process running on the corporate network grabs the files and moves them into the corporate network for access.
Likewise, a user who needs to send a file out would save the file to a "pick up" location on their corporate network, and the process would work in reverse. It would be scanned for objectional content, then pushed to the DMZ file pick-up location that the user could then send out by email or other processes.
The wording was about ''cyber-attack'' which sets the tone ''Oh, unfortunate Deloitte'' - where as it should have been something like ''Deloitte is the latest incompetent company to spew client information over the Internet''.
It is about time that these crappy companies were called out for what they are. Oh: put the CEO's head on the block for this: make him pay for what this costs customers out of his own pocket - if it is paid for by Deloitte (or their insurers) then nothing will ever change.
I'm pretty sure the world would be a better place if the secret emails of Deloitte's "blue chip" clients were made public.
You are welcome on my lawn.
Sophisticated, you're kidding, they logged in using an administration account that didn't use two-factor authentication.
Oh how have the mighty fallen. Aren't THEY supposed to be guiding their clients regarding preventing such issues ??
Clive DaSilva Email: clive.dasilva@gmail.com Ubuntu 18.10 Kernel 4.18