Connect with us

News

Uber Breaches: Sophos Advices Organisations To Be More Security Conscious

Published

on

Kindly share this post

By peter oluka

Following reports of massive data breaches suffered, but covered by Uber in 2016, Sophos has advised corporation to be more security conscious.

A report by Bloomberg indicates the data of 57,000,000 drivers and customers was stolen, after which Uber not only kept the breach secret from the victims, but also paid the hackers $100,000 to “delete the data [and] keep quiet”.

Apparently, Uber’s security chief, Joe Sullivan, lured to Uber from Facebook in 2015, has been sacked in the fallout, according report.

Bloomberg quotes Uber as follows:

Compromised data from the October 2016 attack included names, email addresses and phone numbers of 50 million Uber riders around the world… The personal information of about 7 million drivers was accessed as well, including some 600,000 US driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken.

Going by a report by Nakedsecurity, It seems that Uber’s programmers uploaded security credentials to a GitHub repository – GitHub is a place where you are supposed to store source code, not the keys to the castle! – where the hackers stumbled across them.

From there, the crooks were able to get into Uber servers hosted on Amazon, and from there to access the personal information involved in the breach.

If this sounds terribly familiar, Uber suffered a breach with a similar cause just over three years ago, an intrusion that was discovered in May 2014 but not disclosed until February 2015.

Reliable details of what data was stolen this time round are not yet available.

As mentioned above, driving licence details were acquired by the hackers, meaning that Uber certainly ought to have declared the breach promptly, because sensitive data was involved.

Uber’s claim that customer details such as credit card data and social security numbers were not involved in the heist is a slight silver lining, but how many customers are willing to believe Uber at this point is anybody’s guess.

What to do?

There’s so much still untold in this story that the only sensible recommendation we can make to Uber customers is: “Keep your eyes open for what comes out next.”

If you’re a programmer, repeat these words to anyone who will listen: “GitHub is for code, not for security keys!”

As our friend and colleague Chester Wisniwewski bluntly put it: Uber’s breach demonstrates once again how developers need to take security seriously and never embed or deploy access tokens and keys in source code repositories. I would say it feels like I have watched this movie before, but usually organisations aren’t caught while actively involved in a cover-up as well. Putting the drama aside and the potential impacts from the upcoming GDPR enforcement in Europe, this is just another careless development team with shared credentials and poor security practices. Sadly, this is common more often than not in “agile” development environments, especially in high-growth technology startups.

Commenting on the report, Sophos Principal Research Scientist Chester Wisniewski, believes,

“Uber’s breach demonstrates once again how developers need to take security seriously and never embed or deploy access tokens and keys in source code repositories. I would say it feels like I have watched this movie before, but usually organizations aren’t caught while actively involved in a cover-up. Putting the drama aside and the potential impacts from the upcoming GDPR enforcement, this is just another development team with poor security practices that has shared credentials. Sadly, this is common more often than not in agile development environments.”

From his perspective, Sophos Cyber Security Advisor, James Lyne says: “Uber isn’t the only and won’t be the last company to hide a data breach or cyberattack. Not notifying consumers puts them at greater risk of being victimized with fraud. It’s for precisely this reason that many countries are driving to regulations with mandatory breach disclosure.”

For Uber customers and drivers, Sophos advises that they monitor their credit scores and keep their eyes peeled for additional information on what was stolen.

 


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

News

EXIM Bank of the United States, NEXIM Bank Sign MoU to Strengthen Economic Cooperation

Published

on

Kindly share this post

The Export-Import Bank of the United States (EXIM) has signed a memorandum of understanding (MOU) with the Nigerian Export-Import Bank (NEXIM) that will deepen collaboration and trade ties between the United States and Nigeria.

The agreement was signed by Exim President and Chair, Reta Jo Lewis, on behalf of Export Import Bank of United states, while Abba Bello, Managing Director/ Chief Executive of NEXIM signed on behalf of the Nigerian Export-Import Bank.

During the signing ceremony, EXIM President and Chair, Reta Jo Lewis, highlights increased opportunities for U.S. exports to Nigeria in critical minerals, clean energy, aviation and infrastructure.

Also, NEXIM MD/CE, Abba Bello, highlights that the partnership is a significant milestone for Nigeria and the US that will provide increased access to trade financing for Nigerian businesses whilst facilitating smoother and more robust mutually beneficial trade flows between the two countries.

The MOU demonstrates a shared desire to identify and promote trade and economic cooperation between the two countries, especially in sectors like clean energy, critical minerals, aviation, maritime transport, digital connectivity, and infrastructure, amongst others.

“Nigeria is the second largest U.S. export destination in Sub-Saharan Africa, but there is so much opportunity to grow,” said Chair Lewis.

“This MOU with NEXIM sends a strong market signal to Nigeria that EXIM is eager to forge a stronger commercial relationship by supporting U.S. exports in key sectors.”

The MD/CE NEXIM in his own remarks noted that, “This collaboration marks a significant milestone in our efforts to strengthen trade ties between Nigeria and the United States.

We are confident that this partnership will open new avenues for economic growth and development”. The MOU, signed virtually marks a significant milestone for the United States and Nigeria.

The MOU will enhance the competitiveness of companies in both nations and strengthen collaboration by exploring options for utilizing EXIM’s medium- and long-term loan guarantees and/or direct loans to finance U.S. exports to Nigeria.

This MOU contributes directly to EXIM’s Sub-Saharan Africa mandate. Over the past three years, EXIM has approved approximately $4 billion of authorizations in support of U.S. exports to sub-Saharan Africa.

The Export-Import Bank of the United States (EXIM) is the nation’s official export credit agency with the mission of supporting American jobs by facilitating U.S. exports.

To advance American competitiveness and assist U.S. businesses as they compete for global sales, EXIM offers financing including credit insurance, working capital guarantees, loan guarantees, and direct loans.

As an independent federal agency, EXIM contributes to U.S. economic growth by supporting tens of thousands of jobs in exporting businesses and their supply chains across the United States.


Kindly share this post
Continue Reading

News

EFCC to Arraign Otudeko, Others on Monday over Alleged N12.3Bn Fraud

Published

on

Chief Oba Otudeko, chairman, Honeywell Group, and Stephen Olabisi Onasanya, former managing director, First Bank
Kindly share this post

Economic and Financial Crimes Commission (EFCC) has filed a 13-count charge of N12.3 billion fraud against Chief Oba Otudeko, chairman, Honeywell Group, and Stephen Olabisi Onasanya, the former managing director, First Bank of Nigeria (FBN).

EFCC to Arraign Otudeko, Others on Monday over Alleged N12.3Bn Fraud

Chief Oba Otudeko, chairman, Honeywell Group, and Stephen Olabisi Onasanya, former managing director, First Bank

The charges were filed at the Federal High Court in Lagos.

They are joined by Soji Akintayo, a former board member of Honeywell, and Anchorage Leisure Limited, a company linked to Otudeko.

The four defendants are accused of orchestrating a fraudulent scheme involving the diversion of N12.3 billion from First Bank, with the fraudulent activities allegedly occurring between 2013 and 2014.

The charges against them include claims that they unlawfully obtained funds in multiple transactions, including N5.2 billion, N6.2 billion, N6.15 billion, N1.5 billion, and N500 million.

These funds were allegedly obtained under the false pretence of credit facilities for V-Tech Dynamic Links Limited and Stallion Nigeria Limited.

The EFCC further alleged that the defendants falsified documents to mislead First Bank into processing these transactions.

In the first charge, the defendants were accused of conspiring to fraudulently obtain N12.3 billion from First Bank, misrepresenting that it was for V-Tech Dynamic Links Limited and Stallion Nigeria Limited, despite knowing the information to be false.

In the second charge, they allegedly obtained N5.2 billion from First Bank on November 26, 2013, by falsely claiming it was for V-Tech Dynamic Links Limited.

Between 2013 and 2014, the defendants are accused of obtaining N6.2 billion from First Bank, falsely claiming it was for Stallion Nigeria Limited.

The EFCC also alleged that, on or about September 3, 2013, the defendants forged documents, including a “Letter of Application” to deceive First Bank into believing that the documents were from V-Tech Dynamic Links Limited.

In a similar manner, they were accused of forging a document titled “Authorization to Issue Investment Certificate to First Bank” with the intent to mislead the bank.

Additionally, the charges included accusations that the defendants procured the transfer of N6.2 billion from Stallion Nigeria Limited’s account at First Bank to conceal fraudulent activities.

On December 11, 2013, the defendants allegedly facilitated a transfer of N2.09 billion from Stallion Nigeria Limited’s account to Emmerado Logistics Limited as part of the fraudulent scheme.

Alos, Chief Otudeko is accused of failing to declare a personal interest in a loan facility of N6.15 billion sought by V-Tech Dynamic Links Limited, in breach of banking regulations.

The charges are based on violations of the Advance Fee Fraud and Other Fraud Related Offences Act 2006, the Miscellaneous Offences Act, the Money Laundering (Prohibition) Act 2011, and the Banks and Other Financial Institutions Act 2004.

The four defendants are expected to face serious legal consequences if found guilty.

The case is set to proceed on January 20, 2025, and could set an important precedent in the fight against financial fraud in Nigeria’s banking sector.


Kindly share this post
Continue Reading

News

TikTok Plans to Shut Down App in US on Sunday- Sources

Published

on

Kindly share this post

TikTok plans to shut U.S. operations of its social media app used by 170 million Americans on Sunday, when a federal ban is set to take effect, barring a last-minute reprieve, people familiar with the matter said.

The Washington Post reported President-elect Donald Trump, whose term begins a day after a ban would start, is considering issuing an executive order to suspend enforcement of a shutdown for 60 to 90 days. The report did not say how Trump could legally do so.

Users who have downloaded TikTok would theoretically still be able to use the app, except that the law also bars U.S. companies starting Sunday from providing services to enable the distribution, maintenance, or updating of it.

The Trump transition team did not have an immediate comment. Trump has said he should have time after taking office to pursue a “political resolution” of the issue.

“TikTok itself is a fantastic platform,” Trump’s incoming national security adviser Mike Waltz told Fox News on Wednesday. “We’re going to find a way to preserve it but protect people’s data.”

The New York Times separately reported that Tiktok CEO has been extended an invitation to attend the President-elect’s inaugration and sit in “a position of honor”.

A White House official told Reuters Wednesday President Joe Biden has no plans to intervene to block a ban in his final days in office if the Supreme Court fails to act and added Biden is legally unable to intervene absent a credible plan from ByteDance to divest TikTok.


Kindly share this post
Continue Reading

Trending