Supported by 1Password.
Hi folks,
I hope this particular newsletter finds you well :-) My last exam was a success, I made it through the gaunlet, and now I can focus on regular work again! Just in time for the holidays ^^
This week is a doozy, lot's of interesting articles to share, but I've tried to keep it as short as possible. It feels like most reporters and researchers are pushing stuff out the door before a two-week vacation :-)
Enjoy the read, and enjoy the upcoming holidays!
Cheers,
The article describes an unusually long-running campaign targeting white-, grey- and blackhats alike, gathering SSH credentials, AWS keys, Wordpress credentials and even command line history through a number of avenues like backdoored open-source packages and phishing. It's unknown who is collecting all this data, so the researchers are calling them MUT-1244, for “mysterious unattributed threat.”
This one definitely surprised me. It also surprised me to learn that TP-Link currently has 65% of the US SOHO market, and that they are apparently selling their hardware below the manufacturing price. Will be interesting to see how this turns out.
It's a binding directive ordering federal civilian agencies to secure their Microsoft 365 cloud environments by implementing a list of required configuration baselines, and requiring them to deploy CISA-developed config assessment tooling. Sounds like a very good thing.
Curious to see how that will pan out. We're pretty sure that there's already a big back-and-forth between the two nations, despite a 2015 treaty pledging to not digitally attack eachother.
I had missed this one last month, so I'm including it this week in case you missed it too. Whomever comes next has some big shoes to fill.
So do engineers. So I guess we're all in agreement?
I don't think most developers realise how valuable 1Password can be. It doesn't just hold passwords, it also hold your SSH keys, signs your Git commits, injects token and other secrets in CLI scripts when you want, and much more. (Sponsored)