Skip to main content

After $380 Million Hack, Clorox Sues Its 'Service Desk' Vendor For Simply Giving Out Passwords

3 weeks 6 days ago
An anonymous reader quotes a report from Ars Technica: Hacking is hard. Well, sometimes. Other times, you just call up a company's IT service desk and pretend to be an employee who needs a password reset, an Okta multifactor authentication reset, and a Microsoft multifactor authentication reset... and it's done. Without even verifying your identity. So you use that information to log in to the target network and discover a more trusted user who works in IT security. You call the IT service desk back, acting like you are now this second person, and you request the same thing: a password reset, an Okta multifactor authentication reset, and a Microsoft multifactor authentication reset. Again, the desk provides it, no identity verification needed. So you log in to the network with these new credentials and set about planting ransomware or exfiltrating data in the target network, eventually doing an estimated $380 million in damage. Easy, right? According to The Clorox Company, which makes everything from lip balm to cat litter to charcoal to bleach, this is exactly what happened to it in 2023. But Clorox says that the "debilitating" breach was not its fault. It had outsourced the "service desk" part of its IT security operations to the massive services company Cognizant -- and Clorox says that Cognizant failed to follow even the most basic agreed-upon procedures for running the service desk. In the words of a new Clorox lawsuit, Cognizant's behavior was "all a devastating lie," it "failed to show even scant care," and it was "aware that its employees were not adequately trained." "Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques," says the lawsuit, using italics to indicate outrage emphasis. "The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox's network, and Cognizant handed the credentials right over. Cognizant is on tape handing over the keys to Clorox's corporate network to the cybercriminal -- no authentication questions asked." [...] The new lawsuit, filed in California state courts, wants Cognizant to cough up millions of dollars to cover the damage Clorox says it suffered after weeks of disruption to its factories and ordering systems. (You can read a brief timeline of the disruption here.)

Read more of this story at Slashdot.

BeauHD

Why 24/7 Trading is a Bad Idea

3 weeks 6 days ago
The New York Stock Exchange and Nasdaq have applied for regulatory permission to extend their trading hours to 22 and 24 hours daily, respectively. Nasdaq expects to implement round-the-clock trading from the second half of 2026. The London Stock Exchange is considering similar extensions, according to Financial Times. Several retail brokers already facilitate overnight trading through alternative platforms and "dark pools" -- off-exchange venues that operate during non-standard hours. Robinhood began offering all-night trading for select stocks in May 2023, while Charles Schwab announced plans to expand its overnight trading service to 1,100 securities this July. Economist argues that 24/7 trading is a bad idea. The publication writes: The problem with such trading is that price discovery can be fraught with difficulty. In fact, this is partly why institutional investors like dark pools: their lighter reporting requirements, compared with exchanges, allow big orders to be executed without alerting the wider market beforehand, which would move the price. Professionals taking the other side of these trades accept the risks and know how to navigate them. Amateurs, getting a worse price than they might have done in daylight, often do not. The witching hours are currently when all manner of dull, but vital, post-trade processes take place, from settlement and valuation to the reconciliation of mistakes. Once trading is non-stop, there will be no pause for the financial plumbing to clear. Nor for traders to rest in the knowledge that the market is resting with them, so there is no need to refresh their screens. In today's always-on world, stock exchanges' limited opening hours might seem old-fashioned. But get ready to miss them once they're gone.

Read more of this story at Slashdot.

msmash