Bank Negara Temporarily Suspends CCRIS Access For Agencies After Alleged Cyber Attack

Bank Negara Malaysia (BNM) has temporarily suspended all access to the Credit Control Reference Information System (CCRIS). The suspension comes after what is believed to have been a cyberattack by hackers whose target was the personal data of all individuals available on the CCRIS database.

It should be pointed out that the suspension has affected all credit reporting agencies (CRAs), chief among them being CTOS, Credit Bureau Malaysia, and Experian. In light of the cyberattack and with regards to Experian, the agency says that it has temporarily paused its services to the BNM-owned CCRIS. Further, the agency also says that it has conducted its own in-depth security investigations into the matter and says that it found no evidence that its systems, servers, or facilities had been compromised during the cyberattack.

CTOS also made a similar statement, stating that all of its assets were secure, despite the attack. In an effort to allay any fears among its clientele, the credit agency also made its CTOS SecureID to them, should they decide that they would like to monitor the dark web for any evidence of their personal data being sold.

BNM has also assured users that access will be restored once CRAs gain control over their own security. In the meantime, it says that financial consumers can continue to access their CCRIS reports via the provided link.

At the time of writing, BNM has yet to confirm if an investigation is underway. However, considering that the attack caused BNM to suspend all access to CCRIS, it is highly likely that the threat actors who attacked its security are individuals with advanced knowledge of the system’s API.

Microsoft Says Russian Hackers Going After Govt Agencies, Think Tanks, NGOs

Microsoft said that the Russia-based hacker group designated Nobelium has this week targeted government agencies, think tanks, consultants, and non-governmental organisations. Nobelium is also blamed for the notorious SolarWinds cyberattacks that breached multiple departments of the US federal government last year.

In a blog post, the Redmond-based software giant revealed that the hackers went after 3,000 email accounts at over 150 different organisations in at least 24 countries – although the organisations in the US took the brunt of the cyberattacks. At least a quarter of the affected organisations worked on international development, humanitarian, and human rights issues.

The hackers apparently began their attacks by obtaining access to the Constant Contact account of USAID, the US government agency responsible for foreign aid and developmental assistance. Then they sent out phishing emails with a link that, when clicked, installs a backdoor that Microsoft calls NativeZone, which can be used for a variety of actions like stealing data or infecting other computers on a network.

Hackers backed by the Russian government have been blamed for quite a few high-profile breaches in the US. For example, they’re suspected to have stolen thousands of emails from the US State Department, and penetrating the National Nuclear Security Administration – which oversees the US nuclear weapons stockpile.

Earlier in the year, Microsoft blamed China-backed hackers for compromising its mail server software Microsoft Exchange in order to access email accounts. That breach was so serious that the FBI eventually decided to access private computers in the US to purge them of backdoors.

Mobile Ad Agencies Form Alliance To Prepare For Apple iOS Privacy Changes

A group of mobile advertising companies have banded together to form the Post-IDFA Alliance, a partnership designed to help marketers and app developers adapt to Apple’s iOS privacy plans. This consists of six agencies including Liftoff, Fyber, Chartboost, Singular, InMobi and Vungle – all of which will be affected by the App Tracking Transparency changes on the upcoming iOS 14.5 update.

IDFA, an abbreviation for Identifier for Advertisers, is a unique, random and resettable device identifier assigned to a user’s iOS device. Advertisers rely on this to track and identify a user (without revealing personal information) in order to deliver customised advertising based on their behaviour as well as interactions with certain in-app event triggers.

As previously reported, Apple will be giving iPhone users the ability and choice to permit or block IDFA tracking in the upcoming iOS 14.5 update, which is already available via its beta release. Users will be able to disable IDFA on an app-by-app basis, where every application on the platform is required to prompt users to ask for their permission for tracking.

Ad companies are predicting that a majority of users will opt out from this, which will heavily impact mobile advertising – at least for iOS devices. This significant change in ad tracking also caused the ongoing stir between Apple and social media giant Facebook, which saw both sides trading blows through various means – often publicly.

As a result, the Post-IDFA Alliance aims to help advertisers and developers by providing tips and best practices. This would ensure effective ads are placed in front of relevant customers and the effectiveness of those ads can still be measured once the iOS changes are rolled out.

According to Liftoff chief executive Mark Ellis, the group plans to offer these through videos, webinars and other materials to help the aforementioned understand how to use data in an “Apple-friendly manner.” Most of these and other relevant resources are available via the alliance’s website, which is aptly named “No IDFA? No Problem” (link provided below).

On a related note, other independent marketing agencies are already offering their services on how to tackle the upcoming privacy changes as well. These include companies such as Adjust, Appsflyer, Tinuiti and many others.