Supported by 1Password and GlitchSecure.
Hi folks,
The last few issues I was surprised by the low number of reported data breaches. For a moment there I had hopes, but turns out either the criminals or the reporters (or both) were just ooo. This week shows a list that's way too long for comfort.
I hope you find it interesting, that you get motivated by the clear indication that there is work to be done, and then have a wonderful weekend :-) Cheers!
Definitely the biggest news this week. The takedown, titled "Operation Duck Hunt", is "the largest U.S.-led financial and technical disruption of a botnet infrastructure", according to the DOJ.
The botnet consisted of over 700,000 infected machines, 200,000 of them residing in the US. It was used as an initial infection vector by several ransomware groups like Conti, REvil and many more.
The FBI was able to redirect botnet traffic through servers controlled by them, which in turn instructed the machines to download a "patch" that uninstalled the malware. They were able to do this by first taking over the computer of one of the botnet admins, where they found files with chatlogs, payment information, and encryption keys that were used to communicate with the botnet. There's a great read on this in more detail here.
Over $8.6 million in crypto currency was also seized, which victims can apply to receive a portion of.
You can find the official announcement here, and watch the FBI Director himself announce the takedown on Youtube. People can check if their devices were infected through Have I been Pwned or through the Check your hack site from the Dutch police.
If you feel like doing a quick pentest every few quarters isn't enough, you are correct. Take a look at the combination of continuous vulnerability assessments and real-time pentesting that GlitchSecure offers. Every finding is verified by highly skilled (and wonderful) humans. (Sponsored)
This is definitely a breach, but different enough that I wanted to highlight it. Several spyware vendors have recently been hacked and put out of business, seemingly in a form of vigilantism. Having those companies shut down is definitely a good thing, but the article rightfully warns against complications, for example when the spyware app stops working, the victim might get blamed.
There is an effort underway on the UN level to draft a treaty against cybercrime. Unfortunately, there seems to be a big divide in what countries believe the term "cybercrime" should include, how to prevent the treaty from becoming a surveillance-enabling tool, and what protections should be given to security researchers.
Interesting read on the changes that have to be made to water-related infrastructure in the US (and presumably in many other places). Among other issues, cybersecurity threats are very hard to tackle with old infrastructure, 30% of the workforce set to retire in the next 10 years, and the inability to attract cybersecurity talent when competing with the private sector.
The new SEC rules, where companies need to disclose breaches within four days and explain how they manage the risk of cyberthreats, go into effect on September 5th. If your company falls under SEC rules, you'll want to deep dive into this.
Apple announced today that iOS security researchers can now apply for a Security Research Device (SRD) by the end of October. If selected you'll get a specially-built device on a 12-month loan with certain security features disabled and with shell access. Any vulnerabilities you find are automatically considered for an Apple Security Bounty.
There are four categories: Tesla, in-vehicle infotainment, electric vehicle chargers, and operating systems. The competition will be hosted at the Automotive World conference, which is scheduled for January 2024, in Tokyo. Remote participants will also be allowed, which is a nice touch.
Interesting deep dive (and long read) on how a China-aligned threat group created malicious versions of Signal and Telegram. Among other things, they were able to spy on a victim's Signal communications by secretly autolinking the compromised device to the attacker's Signal device.
It's rare that increased security goes hand in hand with better user experience. Password managers have always fallen under that category for me. 1Password is working on going one step further on both the security and the UX front though, by supporting the use of passkeys. No more passwords to remember, not even a single one, and being much more secure as a result. (Sponsored)