The data breach at Epsilon dominated headlines this week, as companies worried about potential phishing attacks. Several reports also highlighted malware and targeted attacks for mobile devices.
The week began with EMC announcing its acquisition of network forensics vendor NetWitness. EMC was already a customer, as the RSA Security chairman had disclosed on a conference with analysts that the RSA breach had been detected by NetWitness. Industry observers predicted the deal could result in more companies shopping for network forensics vendors.
There were new data breaches reported this week, but the focus was on Epsilon Interactive, an email marketing services company with 2,500 clients. Thieves made off with customer email addresses in what may turn out to be the largest breach ever. While it could have been worse, the Better Business Bureau reminded customers to be careful about potential phishing scams. Several members of the Congress were concerned that Epsilon had yet to announce how many customers had been affected. Epsilon has said two percent of its client list had been hit by the attack.
Epsilon’s parent company Alliance Data said the focus was to reassure clients the necessary fixes will be implemented to prevent future attacks. Organizations are once again concerned about sharing any data with third-party providers. Email service providers have to also step up to ensure they are following industry best practices to protect client data.
Two reports highlighted mobile security. The Symantec report found that mobile attacks increased in 2010, and Panda Security found that mobile malware was a top threat during the first quarter of 2011. Threats ranged from new malware, malicious applications and social engineering tricks targeting users on mobile browsers. Federal investigators convened a grand jury to investigate whether mobile application makers, including music service Pandora, were collecting and sharing customer data without consent.
A report from Hewlett-Packard also found that cyber-criminals were launching automated attacks using readily available kits to compromise Websites. The United States Postal Service was compromised by the Blackhole Exploit Kit, a highly customizable kit, this week. The site redirected users to an attack portal which served up Trojans tailor-made to their operating systems, Active X and Java installations and browser type.
Google announced that it will be adding security features into its Chrome browser to protect users from drive-by-download attacks. For now, Google is test-driving its anti-drive-by download feature, which borrows heavily from the Safe Browsing API, for a subset of users. The features may be available in the next stable release of Google Chrome, version 11.
The week ended with Microsoft announcing its largest Patch Tuesday of the year, fixing 64 vulnerabilities in 17 bulletins. Micorsoft said the fixes will cover operating systems from Windows XP to Windows 7, Microsoft Excel and PowerPoint, Internet Explorer and assorted developer tools.
The Patch Tuesday update will be available April 12.