Trust Wallet’s Post

Saturday Security Stories 3-in-1: TicketMaster, ShinyHunters and the DOJ I'm Peter with Cradlepoint, part of Ericsson, and this is your 3-in-1 Saturday Security Story to kick off June 2024. After 11 days Live Nation has finally confirmed through an SEC filing that the personal data, including credit card information of 560 million Ticketmaster customers, has been compromised from a third party cloud database. ShinyHunters is claiming responsibility for this, putting it on sale on May 27th for a $500,000 on the BreachForum website. Now, that site was supposedly confiscated by the FBI recently, but it's back again. And this all comes on the heels of an antitrust lawsuit against Live Nation from the DOJ and several states claiming monopoly in the ticketing realm. Now, here's the thing. Don't be clicking on suspicious emails. Lock down your credit and just be aware that your info’s out there for the taking. https://lnkd.in/gaKdcx3g https://lnkd.in/gTGYtskF https://lnkd.in/gRu4gWRK https://lnkd.in/gZaycTd8 https://lnkd.in/gYHxPPYs

Okta’s Workforce Identity Cloud has recently further hardened its access to the Admin console + sessions as part of The Secure Identity Commitment on investing in features and enhancements that will better protect Okta orgs. In this Risky.biz video, learn from Brett Winterford and Harish Chakravarthy about these 4 free capabilities that all Okta customers’ can adopt today: 1. ASN session binding - already available and enabled by default in all Okta orgs. If an admin session is coming from a different Autonomous System Number (ASN) then Okta automatically revokes an administrative session observed during an API or web if the request differs from the ASN recorded when the session was established. Reference doc: https://lnkd.in/gMdqf6_K 2. IP ranges for network zones allow list can now be applied to SSWS tokens which means you constrain these API tokens to only be used in your network and cannot be reused outside of this range. Although, the ultimate recommendation is switching to OAuth 2.0 patterns if your application supports it. Reference doc: https://lnkd.in/gmbCzC3q 3. Govern Admin Roles - taking a least privileged approach to creating Okta admin permissions. This feature streamlines the workflow process around requesting and approving admin roles. More eyes on the way these permissions are granted and revoked are key and permissions can have set time limited access for shorter activities like a production change. Not all permissions need to be long-lived, some need to be Just-in-time and then revoked after the activity is done. Reference doc: https://lnkd.in/g872kkFS 4. Protected Actions - this is a step-up MFA on privileged actions in the Admin console. There are at least 10 actions protected so far and this feature will continue to enhance over time. Reference doc: https://lnkd.in/gMdCsRHM https://lnkd.in/gRChb3i2

Clear view from the top, below 👇

Julia Kisielius and I have written about countless threat campaigns over the years, but when we looked at the recent attacks targeting Snowflake customers like Ticketmaster and Lending Tree, we got a little bored tbh. It’s a fairly run-of-the-mill attack pattern: threat actor obtains stolen user credentials, logs in where MFA failed. Unsophisticated and unimaginative, we dubbed this type of attack “boring devastation.” Still, it’s proven effective time and time again, and we continue to see TAs take advantage of the complex and dynamic nature of securing cloud and SaaS identities and access. In this chaos, TAs can afford to be uncreative; defenders cannot. Link to our blog post is in the comments.

This is extremely frightening for our US healthcare infrastructure, especially the revenue cycle side of things. Hospitals are already struggling and now needing to add millions to their cybersecurity framework and policy including what ‘cyber security ready’ vendors they will be able to do business with, etc. The game is definitely changing…quick! Yikes! #cybersecurityawareness #changehealthcare #ransomwareattack

Understand the detail of why access control readers are a critical part of your access control platform. Start by following Wavelynx and let's have a discussion about how our readers are changing the marketplace!

800 MILLION TRANSACTIONS ON INJECTIVE! 🚀💥 The Injective ecosystem continues to break records, showcasing the power and scalability of the network. Start using Injective today and experience the combination of security and lightning-fast transaction processing speed

The current state of the ticket industry gets to the very definition of a "ticket." Is a "ticket" just a right to attend an event or is it something else? It's impossible not to equate a ticket in this case with a software license, but with the latter, you know exactly what you are getting and there are often guarantees such as SLAs in place. It's also impossible to imagine a more glaring use case for antitrust law than Live Nation. Their practice of forcing resales onto their own platforms is just another example of a monopoly doing monopoly things. Could you imagine Chevrolet selling you a car, but requiring you to resell the car through one of their dealerships when you're ready to get rid of it? That would be insane at best, or blatantly illegal at worst. In fact, this whole concept defies logic at every level and it's a big 🖕🏻 to the free market economy. Live Nation is hooked on exorbitant transaction fees, and they couldn't resist their allure in all of the secondary market transactions. Counterfeits are not the problem here, greed is.

By Dillion Hays, New York News New York, May 3, 2024 - A federal judge in the Southern District of New York to take a decisive step in a high-stakes patent infringement lawsuit involving some of the biggest names in the ticketing industry. Major League Baseball (MLB), StubHub, Ticketmaster, and Live Nation find themselves embroiled in a legal battle over a patent that aims to combat digital ticket fraud. The Patent at the Center of the Storm The case, designated SDNY 24-cv-02930, revolves around U.S. Patent No. 9,047,715, which covers technology utilizing periodically changing barcodes to thwart fraudulent activities related to digital tickets. The plaintiff seeks a staggering $720 million in damages from the defendants. Public Statements as Evidence The plaintiff's case gains strength from public statements made by the defendants themselves: MLB: The baseball league explicitly acknowledged the ticket fraud problem and highlighted its "Protect the Barcode technology." This technology features "ticket barcodes that rotate every few seconds," aligning precisely with the patented invention. Ticketmaster: The ticketing giant promotes its "Safe Tix™" feature, powered by a "new and unique barcode that automatically refreshes." This language demonstrates Ticketmaster's understanding of the patent's purpose in addressing ticket duplication. StubHub: While less explicit, StubHub confirms awareness of rotating barcodes as a key security measure against ticket fraud. Their statement indicates that "some types of mobile tickets have a rotating barcode," preventing screenshots from being used at the gate.

@Ledger now supports importing EVM-based chains! Utilize @leap_cosmos to seamlessly manage your INJECTIVE tokens on your Ledger device. Experience convenience without sacrificing security!