Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Incident Response

Hack of U.S. Regulator a Blow to Confidence in Financial System

The hack disclosed at the U.S. Securities and Exchange Commission deals a fresh blow to confidence in the security of the financial system weeks after news of a potentially catastrophic breach at a major U.S. credit bureau.

The hack disclosed at the U.S. Securities and Exchange Commission deals a fresh blow to confidence in the security of the financial system weeks after news of a potentially catastrophic breach at a major U.S. credit bureau.

The stock market regulator said late Wednesday a software vulnerability allowed hackers to gain “nonpublic” information that could have enabled them to make profits with inside information.

SEC chairman Jay Clayton said the leaked information from 2016 “may have provided the basis for illicit gain through trading,” while noting that the vulnerability had been patched and that an investigation was underway.

The revelation comes two weeks after Equifax, one of three major credit bureaus which maintain financial and personal data on consumers, announced that attackers had hacked accounts of some 143 million Americans, in what could be the worst-ever breach because of the sensitivity of the information.

Johannes Ullrich, dean of research at the SANS Internet Storm Center, said that while the two events are likely quite different, both could undermine confidence in online financial systems.

“A lot of our financial systems particularly online systems are based on trust, and if that trust is violated people could opt out of these systems,” Ullrich said.

But Ullrich noted that even if people stop using online networks, that may not protect them against hackers.

“Even if you don’t set up online banking the criminal may set it up for you,” he said.

Advertisement. Scroll to continue reading.

“If you don’t want to use your credit card online and give your number over the phone, that person is entering the same information in the system.”

Ullrich said the SEC breach underscores weak cybersecurity in government networks, after the federal Office of Personnel Management breach disclosed in 2015 affecting tens of millions of employees and contractors.

He said government networks “are really behind the curve in designing the right values and the right protection” of data.

Ironically, the SEC now must point a finger at itself for delaying the disclosure which it requires from publicly traded companies.

“The breach itself appears to be fairly minor, but it erodes trust in government organizations where companies are required by law to report confidential or insider information,” said Tatu Ylonen, a computer researcher and founder of SSH Communications Security.

Ylonen said federal cybersecurity guidelines are “in pretty good shape” but that “a problem is that agencies are implementing these measures in different stages, and some agencies haven’t made it a priority.”

– Critical infrastructure at risk –

James Scott, a researcher at the Institute for Critical Infrastructure Technology, said the latest incident highlight the vulnerability of financial networks despite a threat-sharing system which aims to prevent attacks.

“All of our critical infrastructure systems are not doing a sufficient job of protecting their treasure troves of data,” Scott said.

“We are lacking confidence in our election systems, we are lacking confidence in the health system in protecting patient records and now the financial sector.”

Until recently, Scott said the health sector appeared the most vulnerable “but the financial sector is evolving in 2017 as a major problem.”

Scott said the SEC hackers could be from any number of elements including “cyber mercenaries” or nation-states.

“Russia is notorious for gaining access to this type of information but they are not known for acting on it,” he said.

A more likely source, according to Scott, would be an extremist group seeking to raise cash quickly or a state such as North Korea which is “pressed for cash.”

The SEC attack is especially embarrassing because it comes following the July release of a congressional audit which said the agency had failed to implement security recommendations made two years earlier.

The SEC “had not fully implemented 11 recommendations” on protecting data and encrypting sensitive information, said the report by the Government Accountability Office.

Dan Guido, co-founder of the security firm Trail of Bits, said the SEC incident is not surprising given the current state of affairs in cybersecurity.

“It reflects the status quo of our digital security,” Guido said. “It’s not substantially different than the ones that came before it. We will continue to tolerate these repeated breaches until it’s clear that people’s lives are stake.”

Written By

AFP 2023

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Incident Response

Microsoft has rolled out a preview version of Security Copilot, a ChatGPT-powered tool to help organizations automate cybersecurity tasks.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Incident Response

Meta has developed a ten-phase cyber kill chain model that it believes will be more inclusive and more effective than the existing range of...

Cybercrime

Cloud company Rackspace has completed its investigation into the recent ransomware attack and found that the hackers did access some customer resources.