Story image

'No way' to stop sale of 46 million Malaysians' personal data after crippling breach

14 Nov 17

Two weeks ago news broke of a major data breach that affected 46 million Malaysian mobile phone users and many telecommunications providers in 2014.

New findings from Quann Malaysia say that the data involved in the breach is for sale for RM32,000 (around 1.16 Bitcoin at time of publication) and there is 'no way' to stop the data from being sold.

According to Quann Malaysia general manager Ivan Wen, customers who have not changed their SIM cards since 2014 should do so as soon as possible.

“Perhaps telecommunication companies should ensure these customers are able to change their SIM cards free of charge to encourage quicker resolution to this massive data breach incident,” he says.

The leaked data includes postpaid and prepaid numbers, customer details, addresses as well as sim card information – including unique IMEI and IMSI numbers. Cyber criminals may use that information to conduct social engineering attacks or phone cloning.

Wen says it is almost impossible to stop the sales unless the affected companies pay a ransom to the data thief.

“However, paying a ransom does not guarantee that the data will not be leaked. As such, we do not encourage companies to do so. This extremely attractive pricing for so much data will lead to a rise in the number of buyers who are confident they cannot be tracked,” he explains.

While Quann Malaysia says it is unclear if attackers have demanded a ransom from telecommunications providers, the Bitcoin blockchain means that any company or person can buy the entire list of data from the criminal.

Bitcoin processes also mean that the identities of both buyer and seller remain anonymous. Wen says that few countries have implemented proper Know-Your-Customer regulations around Bitcoin purchases.

“It is high time that we take a different approach to dealing with the spiralling number of worldwide ransomware demands,” he explains.

We hope that regulators and policy makers will take action to put in more defined processes and regulations, for example in the upcoming Cyber Security law, to track the purchase and dealings in Bitcoin among Malaysians, so that fraudulent (data) purchases can be tracked.”

“Individuals or companies found purchasing these leaked data, should be penalised. Only when the buying stops, then only will the hacking stop as there are no more buyers to fund these hackers.”

Wen calls on the likes of Bank Negara, which will able to stop the fraudulent purchase of the compromised data.

 “The Malaysian Communications and Multimedia Commission (MCMC) is most well equipped to aid Bank Negara in drafting air tight regulations to stop fraudulent buying.”

SonicWall secures hybrid clouds by simplifying firewall deployment
Once new products are brought online in remote locations, administrators can manage local and distributed networks.
What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.