Things must have been heating up in the offices of the Ministère de la Santé et des Services sociaux (MSSS) on Friday morning. After hammering home that using the QR code as proof of vaccination was 100% secure, two flaws were reported in the media. First, hackers demonstrated that it was possible to download proofs of vaccination that were not intended for them. Second, another individual demonstrated that it was possible to create fake QR codes from scratch. In less than 24 hours.
Recently, an anonymous source sent a photo to Hackfest. This person had gone to a CLSC in the Québec City region. At the front desk sat a computer. On it, the passwords were clearly displayed. Really, plainly visible. They hadn’t been scribbled on a Post-it. No. Someone had gone to the trouble of doing a nice job.
The day after Québec’s Fête nationale, a criminal group claimed an attack against Lareau courtiers d’assurances. Security experts worry that this attack could be used to target other Québec companies.
A new ransomware group has targeted petroleum products distributor Filgo-Sonic. The company shut down some of its IT systems, but deliveries to customers continued.
This morning, Ukrainian police arrested six individuals linked to the Cl0p ransomware group. Authorities announced that they carried out 21 searches of homes and cars belonging to the suspects in the Kyiv region. Computer equipment, cars and nearly 5 million hryvnias (about CA$225,000) were seized.
A column on the cost of loyalty programs drew a reaction from members of the Hackfest community. In this interview with Alexis Dorais-Joncas, head of the R&D centre at ESET Montréal, we discuss some of the potential risks of these programs.
It is never pleasant to learn that our sensitive information has been published on the Web. Last January, a criminal group released confidential documents it claims to have stolen from the company Ventilabec. To confirm the authenticity of this information, we contacted people who no longer work for the company, but who unfortunately appear in this data leak.
Since the threat of leaking stolen documents is not enough in their eyes, some ransomware groups have added denial of service to their arsenal. A Québec City company just learned this the hard way. The Avaddon group recently claimed an attack against this software development company.
The Regional Municipality of Durham in Ontario was the target of a cyber criminal group. The systems have been secured, but the extent of the data breach is still unknown. The Corporate Communications service confirmed that they “recently became aware of a cybersecurity incident related to software provided by a third-party service provider.”
Faxinating Solutions, a Québec company specializing in electronic data interchange (EDI), was targeted by a cybercriminal group. On March 16, the Conti group published confidential documents, which it claims to have stolen from the company, on its site hosted on the “dark web.”
The period for submitting comments on the CRTC’s botnet blocking plan is over. Reading the submissions, it is clear that Internet service providers (ISPs) do not all see the situation the same way. Some even go so far as to question the CRTC’s legitimacy in implementing such a program.
Until March 15, the CRTC is holding a call for comments on its plan to block botnet traffic. It recommends using measures that “strike a balance between effectiveness and ease of implementation” without imposing additional costs on subscribers. An overview of the methods used by botnet operators suggests this will be anything but easy.
Brossard-based company Consortech was the target of a cyberattack in early March. They quickly recovered their data. However, they had to face the threat of seeing it released publicly. The disappearance of information about Consortech from the hackers’ site suggests that they got what they wanted.
The recently dismantled NetWalker ransomware platform was responsible for the cyberattack that paralyzed the servers of the City of Montmagny last January.
