Decrypted: Chegg’s third time unlucky, Okta’s new CSO, Rapid7 beefs up cloud security

Published May 4, 2020

Ransomware is getting sneakier and smarter.

The latest example comes from ExecuPharm, a little-known but major outsourced pharmaceutical company that confirmed it was hit by a new type of ransomware last month. The incursion not only encrypted the company’s network and files, hackers also exfiltrated vast amounts of data from the network. The company was handed a two-for-one threat: pay the ransom and get your files back or don’t pay and the hackers will post the files to the internet.

This new tactic is shifting how organizations think of ransomware attacks: it’s no longer just a data-recovery mission; it’s also now a data breach. Now companies are torn between taking the FBI’s advice of not paying the ransom or the fear their intellectual property (or other sensitive internal files) are published online.

Because millions are now working from home, the surface area for attackers to get in is far greater than it was, making the threat of ransomware higher than ever before.

That’s just one of the stories from the week. Here’s what else you need to know.

THE BIG PICTURE

Chegg hacked for the third time in three years

Education giant Chegg confirmed its third data breach in as many years. The latest break-in affected past and present staff after a hacker made off with 700 names and Social Security numbers. It’s a drop in the ocean when compared to the 40 million records stolen in 2018 and an undisclosed number of passwords taken in a breach at Thinkful, which Chegg had just acquired in 2019.

Those 700 names account for about half of its 1,400 full-time employees, per a filing with the Securities and Exchange Commission. But Chegg’s refusal to disclose further details about the breach — beyond a state-mandated notice to the California attorney general’s office — makes it tough to know exactly went wrong this time.

Ghostery revamps its privacy-focused mobile browsers

Published September 19, 2018

Ghostery is launching new versions of its browsers for iOS and Android. In fact, Director of Product Jeremy Tillman said this is the first big update to Ghostery’s mobile browsers in several years.

It’s not that mobile wasn’t a priority for the team before this, but Tillman said, “In our previous company, we didn’t have a ton of resources — we always had to choose which thing to work on.” Apparently that changed last year with Ghostery’s acquisition by German browser company Cliqz.

The first big launch after the acquisition was Ghostery 8, the latest version of the team’s privacy-focused extension for desktop browsers. Next up: Bringing those features over to mobile.

Tillman said the goal was to create “a browser that can go toe-to-toe with Chrome” while also incorporating Ghostery’s privacy protection capabilities. Those capabilities include the ability to block different kinds of ad tracking by category (tracking for advertising, adult advertising and site analytics are turned on by default).

There’s also a built-in ad blocker, and Ghost Search, a privacy-focused search engine based on Cliqz technology that does not store any personally identifiable information. (If you’re not satisfied with the Ghost Search results, you can also see results from other search engines.) The presentation is different from a standard search engine, with three “dynamic result cards” that surface content as soon as you start entering search terms. And there’s Ghostery Tab, a home screen that highlights your favorite or most visited sites, as well as the latest news stories.

The Android version includes additional features, including AI-powered anti-tracking and “smart blocking” that’s supposed to improve page performance.

Tillman described the result as “a cleaner, faster, safer mobile browsing experience.” He also said that moving forward, Ghostery will be working to provide “an ecosystem of products” that “protect our users wherever they’re interacting with the Internet.”

The launch comes as the big Internet platforms face growing scrutiny over how they handle user data. Tillman argued that by simply giving consumers a more privacy-friendly alternative, “We’re sort of collectively negotiating a better Internet for them” — and he’s hoping Ghostery can be more involved as publishers try to find alternatives to advertising.

“Our goal isn’t to, say, topple Google and Facebook, but to provide that alternative to those that want it — both for content creators but also for users themselves,” he said.