This week in InfoSec (11:06)With content liberated from the “today in infosec” twitter account and further afield6th July 1995: Simple as 1-2-3: IBM Buys LotusIBM completes a $3.5 billion buyout of Lotus Development, the producer of the once-dominant Lotus 1-2-3 spreadsheet software and the then-popular Lotus Notes groupware. IBM had hoped to leverage Lotus 1-2-3 to challenge the increasingly demanded Microsoft Excel software, but alas, there was little slowing down the Microsoft juggernaut during the 1990’s. Lotus 1-2-3 steadily lost market share, and IBM finally announced the end of support for the software in 2013.  Lotus Notes groupware faired little better than 1-2-3, succumbing to Microsoft Exchange as the dominant groupware platform among large companies, but it remained entrenched among certain corporations for many years under the name IBM notes. In 2018 IBM sold Notes along with other software products to HCL Software for $1.8 Billion. HCL still develops and supports Notes to this day with a focus on security and lower cost as a way to compete with Microsoft Exchange. 1st July 2003: California's data breach notification law went into effect. It was the first US state to require disclosure of breaches of personal info.California SB 1386 - Personal Information: Privacyhttps://twitter.com/todayininfosec/status/1410750152671825925 Rant of the Week (20:12)Nickelodeon investigates breach after leak of 'decades old’ dataAt the end of June, a rumour emerged about a major leak from Nickelodeon's animation department. Proof of the alleged data leak started circulating on social media, showing an extensive collection of reportedly 500GB in documents and media files.Nickelodeon has confirmed that the data leaked from an alleged breach of the company is legitimate but some of it appears to be decades old.The data breach supposedly occurred in January this year and allegedly ended with Nickelodeon blocking the unauthorised access two months later. However, there is no reliable evidence about this..According to some sources, all the files were leaked on a private Discord server, and many of them are being reposted elsewhere. Billy Big Balls of the Week (28:38)Study shows 25% of kids apps violate COPPA.The researchers at Comparitech analyzed the top four hundred children’s apps offered in Apple’s App Store and found that one in four potentially violate the Children’s Online Privacy Protection Act (COPPA).  Industry News (37:48)Croydon Council Hit With Enforcement Notice For FOI FailReport Reveals Companies Unprepared For Darknet Data LeaksSecurity Experts Raise Major Concerns With Online Safety BillEuropean Commission to Tweak GDPR For Cross-Border CasesUK Citizens Wary of NHS AI Use, Citing Privacy ConcernsNagoya Port Faces Disruption After Ransomware AttackSuspicious Email Reports Up a Third as NCSC Hails Active DefensePolice Arrest Suspected OPERA1ER Cybercrime KinHuman Error the Leading Cause of Cloud Data Breaches Tweet of the Week (48:03)https://twitter.com/jason_kint/status/1676791388145430528 Come on! Like and bloody well subscribe!

This week in InfoSec (11:36) With content liberated from the “today in infosec” twitter account and further afield26th June 1997: Communications Decency Act Declared UnconstitutionalThe US Supreme Court ruled the Communications Decency Act unconstitutional on a 7-2 vote. The act, passed by both houses of Congress, sought to control the content of the Internet in an effort to keep pornography from minors. In an opinion written by Justice John Paul Stevens, the Supreme Court ruled the act a violation of free speech as guaranteed by the US Constitution. 29th June 2007: The phone that changed everythingNearly 6 months after it was introduced, Apple’s highly-anticipated iPhone goes on sale. Generally downplayed by Old Word Technology pundits after its introduction, the iPhone was greeted by long lines of buyers around the country on that first day. Quickly becoming an overnight phenomenon, one million iPhones were sold in only 74 days. Since those early days, the ensuing iPhone models have continued to set sales records and have completely changed not only the smartphone and technology industries, but the world as well. Rant of the Week (19:19)Miscreants leak texts and info siphoned by Android stalkerware app LetMeSpyIt's bad enough there's some Android stalkerware out there with the not-at-all-creepy moniker LetMeSpy. Now someone's got hold of the information the app collects – such as victims' text messages and call logs – as well as the email addresses of those who sought out the software, and leaked it all.The stolen data has been circulating online for at least a few days, we're told, and the spyware's users – those who got the app to put on someone else's device – reportedly include government workers and a ton of US college students.The Polish developer of the app said the information was swiped in a "security incident" that happened on June 21, when someone obtained "unauthorised access" to its website's databases.Yes, we appreciate the irony of the maker of a phone-monitoring app that boasts about secretly collecting call logs, text messages, and whereabouts while remaining "invisible to the user" admitting that someone else gained unauthorised access to their information. Billy Big Balls of the Week (28:33)Network security guy in extradition tug of war between US and RussiaA Russian network security specialist and former editor of Hacker magazine who is wanted by the US and Russia on cybercrime charges has been detained in Kazakhstan as the two governments seek his extradition.Nikita Kislitsin, an employee of Russian infosec shop FACCT, was detained on June 22 at the request of the US, according to a statement by his employer."According to the information we have, the claims against Kislitsin are not related to his work at FACCT, but are related to a case more than ten years ago when Nikita worked as a journalist and independent researcher," the statement reads."We are convinced that there are no legal grounds for detention on the territory of Kazakhstan."FACCT is not under investigation and has not been charged with any wrongdoing, the org added. It has has hired lawyers to defend Kislitsin, and has also sent an appeal to the Consulate General of the Russian Federation in Kazakhstan "to assist in protecting our employee," according to the statement. Industry News (34:27) Are GPT-Based Models the Right Fit for AI-Powered Cybersecurity?Over Half of UK Banks Are Exposing Customers to Email FraudSubmarine Cables at Growing Risk of Cyber-AttacksThird-Party Vendor Hack Exposes Data at American, Southwest AirlinesEncroChat Bust Leads to 6500 Arrests in Three YearsVPN and RDP Exploitation the Most Common Attack TechniqueLockBit Dominates Ransomware World, New Report FindsCharming Kitten’s PowerStar Malware Evolves with Advanced TechniquesMIT Publishes Framework to Evaluate Cybersecurity Methods Tweet of the Week (43:14)https://twitter.com/UK_Daniel_Card/status/1674094965348073474 Come on! Like and bloody well subscribe!

This week in InfoSec (10:26)With content liberated from the “today in infosec” twitter account and further afield17th June 1997: A group of users organised over the Internet cracked the Data Encryption Standard — the strongest legally exportable encryption software in the United States to that point — after only five months of work. The United States at the time banned the export of stronger encryption software out of fear that it would be used by terrorists, but companies designing the software claimed such restrictions were worthless because foreign countries offer much stronger programs. The US eventually relaxed certain restrictions but to this day still claims to exert authority over encryption technologies under the commerce clause. 17th June 1983: The movie "Superman III" was released. Gus Gorman lands a data entry job at Webscoe Industries, hacks into its computer systems, and funnels all of the half-cents into his next check, accruing $85,789.90. This type of crime would later be named "salami slicing".https://twitter.com/todayininfosec/status/1405615484091916294 Rant of the Week (15:16)FTC accuses DNA testing company of lying about dumping samplesThe Federal Trade Commission has alleged that genetic testing firm 1Health.io, also known as Vitagene, deceived people when it said it would dispose of their physical DNA sample as well as their collected health data.To make matters worse, the FTC also alleged in a consent order made public last week that the company didn't secure the information properly, and further, that it changed its privacy policy retroactively without properly notifying or getting consent from people whose data the company had already collected – people who had signed a different, earlier version of the policy.Under the proposed settlement, Vitagene/1Health.io will have to sharpen its data protection practices and put into place procedures to keep them sharp, as well as a pay a fine. The company has neither admitted nor denied any of the allegations. Billy Big Balls of the Week  (24:29)Reddit confirms BlackCat gang pinched some dataReddit this week confirmed ransomware gang BlackCat, aka AlphaV, broke into its corporate systems in February.The crew just the other day had bragged it stole 80GB from the biz, and had demanded the social media company pay $4.5 million to keep a lid on the data as well as ditch its controversial API pricing changes.A spokesperson for Reddit declined to comment on BlackCat's specific boasts, and insisted it's not the result of a fresh intrusion. The theft happened a few months ago, and was the result of a "sophisticated phishing campaign" against its staff that Reddit said it encountered on February 5 and disclosed on February 9. See also: Reddit hackers demand $4.5 million ransom and API pricing changes Industry News  (31:14)US Offers $10m Reward For MOVEit AttackersSmart Pet Feeders Expose Personal DataSecurity Researchers Uncover New Spyware Implant TriangleDB#InfosecurityEurope: Hackers Are the Immune System of the Digital Age#InfosecurityEurope: It’s Time to Think Creatively to Combat Skills Shortages#InfosecurityEurope: Drones Contain Over 156 Different Cyber Threats, Angoka Research FindsRedEyes Group Targets Individuals with Wiretapping MalwareUS Justice Department Launches New National Security Cyber SectionApple Addresses Exploited Security Flaws in iOS, macOS and Safari Tweet of the Week (41:36)https://twitter.com/tarah/status/1671691691965939712----Back up story: Mark Zuckerberg is ready to fight Elon Musk in a cage match Come on! Like and bloody well subscribe!

This week in InfoSec (12:01) With content liberated from the “today in infosec” twitter account and further afield12th June 1989: Callers to a Florida probation office were connected to a phone sex line. Southern Bell officials said it was the first time their switching equipment had been reprogrammed by a hacker. Phrack #27https://twitter.com/todayininfosec/status/166841728111263744115th June 2004: The first mobile phone virus, Cabir, was discovered. It infected devices running the Symbian OS and spread via Bluetooth. 68% of you are thinking "Symbian OS? Never heard of it." Learn how it got its name and how it spread in a stadium in Finland:First smartphone malwarehttps://twitter.com/todayininfosec/status/1669380905662545921 Rant of the Week (21:09)Capita wins £50M fraud reporting contract with City of London copsCapita, which is still dealing with a digital break-in that exposed customers' data to criminals, has scored a £50 million contract with the City of London police to run contact and engagement services for the force's fraud reporting service.The five-year agreement kicks off in 2024 and the territorial cops responsible for law enforcement in the financial district of the capital (aka the "square mile," – the Met looks after Greater London) have an option to extend it for a further two years, should they wish to do so.The work will see Capita provide an "end-to-end customer management process" to potential victims of fraud when they contract the service. The current iteration receives upwards of 350,000 calls and 2.3m unique visits to the website annually.In a statement, Capita pledged to "deploy" its "customer experience model for identifying, managing and monitoring customers using data and specialist coaching to support potential victims of crime."EU boss Breton: There's no Huawei that Chinese comms kit is safe to use in EuropeEuropean Commission's own networks to toss Middle Kingdom boxes amid calls for total replacementEuropean commissioner Thierry Breton wants Huawei and ZTE barred throughout the EU, and revealed plans to remove kit made by the Chinese telecom vendors from the Commission's internal networks."We cannot afford to maintain critical dependencies that could become a weapon against our interests," he declared in a Thursday speech.The Chinese vendors' presence in foreign networks has been a point of concern for years. There are concerns that backdoors in Huawei equipment could allow China to spy on foreign nations, given Chinese law requires local businesses to share info with Beijing. However, Huawei has repeatedly rejected the claims of backdoors, insisted it follows the law of the land wherever it operates, and denied that Chinese laws would see it sell out customers.Those protestations haven't stopped the US, UK, and at least ten EU countries from banning the manufacturer's kit from their networks. ZTE has also run afoul of regulators. Billy Big Balls of the Week (32:17)US mother gets call from ‘kidnapped daughter’ – but it’s really an AI scamAfter being scammed into thinking her daughter was kidnapped, an Arizona woman testified in the US Senate about the dangerous side of artificial intelligence technology when in the hands of criminals.Jennifer DeStefano told the Senate judiciary committee about the fear she felt when she received an ominous phone call on a Friday last April.Thinking the unknown number was a doctor’s office, she answered the phone just before 5pm on the final ring. On the other end of the line was her 15-year-old daughter – or at least what sounded exactly like her daughter’s voice. Industry News (42:07)Data Flows Between UK and US to be Simplified Under New AgreementOfcom Latest MOVEit Victim as Exploit Code ReleasedGMicrosoft Pays $20m to Settle Another FTC COPPA CaseNo Zero-Days but PGM Flaws Cause Patch Tuesday ConcernMFA Bypass Kits Account For One Million Monthly MessagesEuropol Warns of Metaverse and AI Terror ThreatEU Passes Landmark Artificial Intelligence ActMalicious Actors Exploit GitHub to Distribute Fake ExploitsLockBit Makes $91m From US Victims in Two Years Tweet of the Week (50:49)https://twitter.com/InfoSecSherpa/status/1062036305146724354https://twitter.com/fesshole/status/1662495137992175617 Come on! Like and bloody well subscribe!

This week in InfoSec (10:21)With content liberated from the “today in infosec” twitter account and further afield8th June 1989: The beta release of the Bourne Again SHell (Bash) was announced as version 0.99. 2 months later Shellshock was introduced into the Bash source code and persisted in subsequent versions for over 25 years.v0.99 release announcementhttps://twitter.com/todayininfosec/status/16664875253203189883rd June 1983: Would You Like to Play a Game?The science fiction film WarGames is released. Notable for bringing the hacking phenomena to the attention of the American public, it ignites a media sensation regarding the hacker sub-culture. The film’s NORAD set is the most expensive ever built at the time at a cost of $1 million dollars. Not widely known is that the movie studio provided the film’s star, Matthew Broderick, with the arcade games Galaga and Galaxian so he could get first-hand experience before shooting the film’s arcade scenes. Rant of the Week (17:16)Barracuda Urges Replacing — Not Patching — Its Email Security GatewaysIt’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks, as the company struggled to combat a sprawling malware threat which appears to have undermined its email security appliances in such a fundamental way that they can no longer be safely updated with software fixes.Barracuda tells its ESG owners to 'immediately' junk buggy kit Billy Big Balls of the Week (24:45)US govt now bans TikTok from contractors' work gearBYODALAINGTI (as long as it's not got TikTok installed)The US federal government's ban on TikTok has been extended to include devices used by its many contractors - even those that are privately owned. The bottom line: if some electronics are used for government work, it better not have any ByteDance bits on it. The interim rule was jointly issued by NASA, the Department of Defense and the General Services Administration, which handles contracting for US federal agencies. The change amends the Federal Acquisition Regulation to prohibit TikTok, any successor application, or any software produced by TikTok's Beijing-based parent ByteDance from being present on contractor devices. "This prohibition applies to devices regardless of whether the device is owned by the government, the contractor, or the contractor's employees. A personally-owned cell phone that is not used in the performance of the contract is not subject to the prohibition," the trio said in their update notice published in the Federal Register. The rule would apply to all contracts, even those below the "simplified acquisition threshold" of $250,000, purchases of commercial and off-the-shelf equipment, and commercial services so get ready to wipe those company phones, cloud services providers and MSPs that do business with Uncle Sam. AND British Airways, Boots, BBC payroll data stolen in MOVEit supply-chain attackBritish Airways, the BBC, and UK pharmacy chain Boots are among the companies whose data has been compromised after miscreants exploited a critical vulnerability in deployments of the MOVEit document-transfer app.Microsoft reckons the Russian Clop ransomware crew stole the information.British Airways, the BBC, and Boots were not hit directly. Instead, payroll services provider Zellis on Monday admitted its MOVEit installation had been exploited, and as a result "a small number of our customers" – including the aforementioned British trio – had their information stolen.Zellis claims to be the largest payroll and human resources provider in the UK, and its customers include Sky, Harrods, Jaguar, Land Rover, Dyson, and Credit Suisse. In a statement posted on its website, Zellis blamed the MOVEit vulnerability for the security breach, and noted "all Zellis-owned software is unaffected and there are no associated incidents or compromises to any other part of our IT estate." Industry News  (34:33)Clop Ransom Gang Breaches Big Names Via MOVEit FlawFBI Warns of Surge in Deepfake Sextortion AttemptsCisco Counterfeiter Pleads Guilty to $100m SchemeCyber Extortionists Seek Out Fresh Victims in LatAm and AsiaLazarus Group Blamed for Atomic Wallet HeistInterpol: Human Trafficking is Fueling Fraud EpidemicMicrosoft Brings OpenAI Tech to US AgenciesPharmaceutical Giant Eisai Hit By Ransomware IncidentEspionage Attacks in North Africa Linked to "Stealth Soldier" Backdoor Tweet of the Week (43:58)https://twitter.com/elonmusk/status/1666964082363371520https://twitter.com/sawaba/status/1666930930714279942https://www.forbes.com/lists/most-cybersecure-companies/ Come on! Like and bloody well subscribe!

Voting has closed for this years European Cybersecurity Blogger Awards has closed. Did you vote with your conscience, or did you vote for us? This week in InfoSec (08:33)With content liberated from the “today in infosec” twitter account and further afield30th May 1972: John Postel published RFC 349, Proposed Standard Socket Numbers.RFC 349https://twitter.com/todayininfosec/status/1266805406707232768 1st June 1999: Shawn Fanning and Sean Parker release the filesharing service Napster. The service provides a simple way for users to copy and distribute MP3 music files. It became an instant hit, especially among college students. Just over 6 months later, on December 7, 1999, the Recording Industry Association of America (RIAA) filed a lawsuit against the service, alleging mass copyright infringement. Eventually this lawsuit forced the shutdown of the company on September 3, 2002, but not before the popularity of downloading digital music was firmly entrenched in a generation of Internet users. Rant of the Week (16:32)Amazon Ring, Alexa accused of every nightmare IoT security fail you can imagineAmerica's Federal Trade Commission has made Amazon a case study for every cautionary tale about how sloppily designed internet-of-things devices and associated services represent a risk to privacy – and made the cost of those actions, as alleged, a mere $30.8 million.The regulator on Wednesday charged, via the US Dept of Justice, two Amazon outfits with various privacy snafus.The e-tail giant’s Ring home security cam subsidiary was accused of “compromising its customers’ privacy by allowing any employee or contractor to access consumers’ private videos and by failing to implement basic privacy and security protections, enabling hackers to take control of consumers’ accounts, cameras, and videos.”“Not only could every Ring employee and Ukraine-based third-party contractor access every customer’s videos (all of which were stored unencrypted on Ring’s network), but they could also readily download any customer’s videos and then view, share, or disclose those videos at will,” reads the FTC's complaint [PDF].The document goes on to describe how “a customer service agent might need access to the video data of a particular customer to troubleshoot a problem, that same customer service agent had unfettered access to videos belonging to thousands of customers who never contacted customer service.”Another nightmare: “Although an engineer working on Ring’s floodlight camera might need access to some video data from outdoor devices, that engineer had unrestricted access to footage of the inside of customers’ bedrooms.”Ring staff weren’t trained on how to handle private data. And some abused it, horribly, according to the consumer watchdog.The complaint details one employee who, the FTC said, “viewed thousands of video recordings belonging to at least 81 unique female users,” and “focused his prurient searches on cameras with names indicating that they surveilled an intimate space, such as ‘Master Bedroom,’ ‘Master Bathroom,’ or ‘Spy Cam’.”The employee spent more than an hour a day on this revolting stuff, undetected by Ring, for months, it was claimed.When a female coworker reported this activity, her supervisor “discounted the report, telling the female employee that it is ‘normal’ for an engineer to view so many accounts," the FTC noted. Billy Big Balls of the Week (29:42)Pegasus-pusher NSO gets new owner keen on the commercial spyware bizSpyware maker NSO Group has a new ringleader, as the notorious biz seeks to revamp its image amid new reports that the company's Pegasus malware is targeting yet more human rights advocates and journalists.Once installed on a victim's device, Pegasus can, among other things, secretly snoop on that person's calls, messages, and other activities, and access their phone's camera without permission. This has led to government sanctions against NSO and a massive lawsuit from Meta.The Israeli company's creditors, Credit Suisse and Senate Investment Group, foreclosed on NSO earlier this year, according to the Wall Street Journal, which broke that story the other day.Essentially, we're told, NSO's lenders forced the biz into a restructure and change of ownership after it ran into various government ban lists and ensuing financial difficulties.The new owner is a Luxembourg-based holding firm called Dufresne Holdings controlled by NSO co-founder Omri Lavie, according to the newspaper report. Corporate filings now list Dufresne Holdings as the sole shareholder of NSO parent company NorthPole.Dufresne Holdings has removed "a number of directors and officers" across NSO and is involved in the company's day-to-day management, the Wall Street Journal added.An NSO spokesperson meanwhile said "the company is managed directly by our CEO, Yaron Shohat. The lenders are currently in a process of restructuring the shareholders." The company has not only faced criticism over its Pegasus spyware implant, US and European officials over the past couple of years have cracked down on NSO in particular, and commercial spyware in general.Reports keep emerging about Pegasus and other surveillance technologies being used in ways that decidedly violate NSO's claims that it only sells the malware to legitimate government agencies "for the purpose of preventing and investigating terrorism and other serious crimes."It is that time of the show where we head to our news sources over at the Infosec PA newswire who have been very busy bringing us the latest and greatest security news from around the globe! Industry News (37:34)Romania’s Safetech Leans into UK Cybersecurity MarketNine Million MCNA Dental Customers Hit by BreachRansomware Gangs Adopting Business-like Practices to Boost ProfitsHuman Error Fuels Industrial APT Attacks, Kaspersky ReportsNigerian Cybercrime Ring's Phishing Tactics ExposedPentagon Cyber Policy Cites Learnings from Ukraine WarAmazon to Pay $31m After FTC's Security and Privacy AllegationsHMRC in New Tax Credits Scam WarningHorabot Campaign Targets Spanish-Speaking Users in the Americas Tweet of the Week (44:04)https://twitter.com/securityweekly/status/1664335258655784960 Come on! Like and bloody well subscribe!

This week in InfoSec (09:59)With content liberated from the “today in infosec” twitter account and further afield26th May 2006: BackTrack v1.0 was released.https://twitter.com/todayininfosec/status/126547168776142438421st May 2012: Nmap 6.00 was released. https://nmap.org/6/https://twitter.com/todayininfosec/status/126358991810779136223rd May 1997: Carlos Felipe Salgado Jr. (aka "Smak"), who allegedly stole 100,000 credit cards from an Internet provider was granted bail on the condition he not go "anywhere near a computer." He was arrested after trying to sell it to the FBI.Hacker gets conditional bailhttps://twitter.com/todayininfosec/status/1264033568436568070 Rant of the Week (16:25)Dish confirms 300,000 people's data was exposed in February's attackBut don't worry – we know it was deleted.Dish Network has admitted that a February cybersecurity incident and associated multi-day outage led to the extraction of data on nearly 300,000 people, while also appearing to indirectly admit it may have paid cybercriminals to delete said data.Dish customers can rest easy, at the very least, as the telco said in a sample letter posted to the Maine Attorney General's breach notification website that customer databases weren't accessed and the stolen data belonged instead to employees both past and present, their family members, "and a limited number of other individuals" that Dish didn't specify.The satellite TV company also didn't say what sorts of personal information was stolen from those 296,851 individuals in the attack, aside from driver's license and non-driver ID card numbers.Dish never went on the record to publicly state the attack was caused by ransomware, though internal sources who contacted The Register, did report that ransomware was involved. Dish also made mention of ransomware in its SEC filing.Reports from February citing internal Dish sources claim the Black Basta ransomware gang was behind the break-in at Dish, and in its template letter [PDF] notifying affected individuals of the incident, the company sought to reassure recipients that there's no evidence the extracted data has been misused, and that it believes the data has been deleted.Er, who confirmed that again?"We have received confirmation that the extracted data has been deleted," Dish said, adding that it has been monitoring the dark web and criminal forums for signs the data is available online. "The results of the monitoring are consistent with the confirmation that the extracted data has been deleted," it added. That, as Emsisoft security analyst Brett Callow has pointed out, could be interpreted as an admission that Dish paid whatever ransom was demanded of it because "totally untrustworthy cybercriminals assured us the data would be deleted if we paid the ransom," Callow tweeted.  Billy Big Balls of the Week (26:30)Ads for lucrative jobs in Asia fail to mention chance of slavery as crypto-scammerThe FBI has issued a warning about fake job ads that recruit workers into forced labor operations in Southeast Asia – some of which enslave visitors and force them to participate in cryptocurrency scams.The warning follows reports of multi-storey slave compounds housing unwilling workers in places like Cambodia.The FBI's advice suggests those scams are ongoing."Criminal actors assign debts to victims under the guise of travel fees and room and board, and use victims' mounting debt and fear of local law enforcement as additional means to control victims. Trafficked victims are sometimes sold and transferred between compounds, further adding to their debt," said the FBI.Advocacy groups and media report similar tactics, with victims targeted online and promised lucrative jobs abroad with travel fees and other benefits paid.Upon arrival in a foreign country – which may not even be the one jobseekers were told they'd visit – workers' passports and travel documents may be confiscated, and the victim coerced to conduct scams under the threat of violence.The scams the slaves conduct often involve "pig butchering" tactics that see perpetrators encourage victims to make investments in cryptocurrency. Once payments are made, the scammer ceases communication with the victim and their cash disappears. Pig butchering perps often use romance scams, promises of sex, or illegal gambling as lures. Industry News (32:53)Meta Fined €1.2bn for Violating GDPRChina Issues Ban on US Chipmaker ProductsTwo-Thirds of IT Leaders Say GDPR Has Reduced Consumer TrustDiversity advocate and renowned practitioner, Becky Pinkard, to be Inaugurated into Infosecurity Europe's Hall of FamePrivate Sector Cybersecurity Task Force Called for to Defend DemocraciesUS Sanctions North Korean Entities Training Expat IT Workers in Russia, China and LaosSMBs Targeted by State-Aligned Actors for Financial Theft and Supply Chain AttacksNCSC Warns Against Chinese Cyber Attacks on Critical InfrastructureExpo Framework API Flaw Reveals User Data in Online Services Tweet of the Week (39:35)https://twitter.com/ireteeh/status/1661635416204648448https://twitter.com/VladCraita/status/1661461184665604096?s=20https://twitter.com/primevideouk/status/1661760395659321346 Come on! Like and bloody well subscribe!

European Security Blogger Awards 2023Vote for us (and Thom and teissTalk) here:https://forms.gle/o6LwY6t5bSY9Fp5CA  This week in InfoSec (11:24)With content liberated from the “today in infosec” twitter account and further afield15th May 2011: Sony Begins Restoration of Its PlayStation Network after Cyber AttackAfter a malicious cyber attack compromises Sony Computer Entertainment's data center in San Diego, California, the PlayStation Network is shut down on April 20. The ensuing investigation revealed a number of security flaws, and in tandem with outside security firms, Sony implemented a number of upgrades to deter and mitigate future attacks to its network and its customers’ personal information. The Americas, Oceania, Europe and the Middle East were the first regions to regain access to the PlayStation Network, and among other measures, customers were required to reset their passwords upon initially signing in. As more and more personal information is posted online, whether for financial, social, or business transactions, the safekeeping and protection of this data has come to the forefront of Internet consumer concerns.  20th May 2003: Rain Forest Puppy reflected on change in the security industry and made a declaration of his personal change. https://web.archive.org/web/20090510083820/www.wiretrip.net/rfp/txt/evolution.txthttps://twitter.com/todayininfosec/status/1395378144861896705  Rant of the Week (18:00)Upstart encryption app walks back privacy claims, pulls from stores after probeA new-ish messaging service that claimed to put privacy first has pulled its end-to-end encryption claims from its website and its app from both the Apple and Google software stores after being called out online.Converso – a comms app launched in September 2022 – billed itself as a "next-generation messaging app that keeps your conversations completely private." This, according to the developer's website, included "proprietary state-of-the-art end-to-end encryption technology," no storage of messages on servers, and "absolutely no use of user data." It claimed it could stand up to the likes of Signal and WhatsApp in the security stakes. A blogger who goes by Crnković and has an interest in encryption protocols heard about Converso from an ad on a podcast and decided to poke around to see if the software lived up to the hype. Crnković found the app talked to a Google Cloud-hosted database that was left completely open to the public by the software's developers. This Firestore database, we're told, included encrypted message content, metadata about people's messages, their private encryption keys, phone numbers, and more. Essentially, it would be possible for anyone to fetch that information and decrypt a stranger's message that went through the app, according to the researcher.Crnković concluded:Not only is metadata public, but so too are the keys used to encrypt messages. Anyone can download a Converso user's private key, which could be used to decrypt their secret conversations.There's no longer any real distinction between cleartext and encrypted messages – nothing is meaningfully encrypted. For your security, you shouldn't use Converso to send any message that you wouldn't also publish as a tweet."Dissecting Converso was in large part a learn-as-you-go exercise for me, as I don't have prior experience reverse engineering mobile apps," Crnković told The Register. "I was shocked at each exponentially worse mistake."Telegram vulnerability: https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/ Billy Big Balls of the Week (27:37)Microsoft decides it will be the one to choose which secure login method you useMicrosoft wants to take the decision of which multi-factor authentication (MFA) method to use out of the users' hands and into its own.The software maker this week is rolling out what it calls system-preferred authentication for MFA, which will present individuals signing in with the most secure method and then alternatives if that method is unavailable.Redmond first unveiled the feature in a disabled state in April and is now making it generally available to all commercial users through the Azure Portal or Graph APIs, with the decision whether to enable it for tenants now resting with administrators.That said, in July Microsoft will make system-preferred authentication a default feature in its Azure Entra portfolio for all user accounts, with more information coming out next month.The goal is to shore up security by not only delivering new features to harden products and services but to, at times, strong-arm people into using them.More security, fewer problems?"This system prompts the user to sign in with the most secure method they've registered and the method that's enabled by admin policy," Alex Weinert, vice president and director of identity security at Microsoft, wrote in a blog post. "This will transition users from choosing a default method to use first to always using the most secure method available. If they can't use the method they were prompted to use, they can choose a different MFA method to sign in." Industry News (36:43)Ex-Ubiquiti Employee Imprisoned For $2m Crypto Extortion SchemeNSO Group Spends Millions Lobbying US GovernmentCyber-Resilience Programs Failing on Poor VisibilityNew Cloud Data Leak Adds to Capita's WoesGovernment Publishes Playbook to Enhance Smart City SecurityChatGPT Leveraged to Enhance Software Supply Chain SecurityMontana Signs Ban on TikTok Usage on Personal DevicesApple's App Store Blocks $2bn in Fraudulent TransactionsCyber Warfare Escalates Amid China-Taiwan Tensions Tweet of the Week (48:17)https://twitter.com/pmbaumgartner/status/1658804805014368256 Come on! Like and bloody well subscribe!

This week in InfoSec (09:16)With content liberated from the “today in infosec” twitter account and further afield11th May 1997: Deep Blue Defeats Kasparov in Tournament MatchThe IBM computer and artificial intelligence Deep Blue defeats reigning chess champion and one of the greatest chess players of all time, Garry Kasparov, in the 6th and deciding game of a tournament match, thus becoming the first time a computer defeated a chess champion in match play. A year earlier, Deep Blue had bested Kasparov in 2 individual games but Kasparov eventually won the match 4-2. This time, after being reprogrammed and upgraded, the 1997 Deep Blue, capable of calculating 200 million moves per second, won 2 matches out of 6 vs Kasparov’s 1 victory and 3 draws. After the defeat Kasparov asked for a rematch but IBM declined and retired Deep Blue.The defeat of a reigning chess champion at the hands of artificial intelligence made headlines around the world and marked a milestone in the development of AI and machine learning. From this early landmark moment, the advancement of computing power and machine learning has created even more powerful artificial intelligence. Kasparov in 2016 stated that “Today you can buy a chess engine for your laptop that will beat Deep Blue quite easily”.  9th May 1996: Linux Gets Happy FeetLinus Torvalds describes in an e-mail to a mailing list his conception of what he believes should be the logo for the Linux operating system. This is what soon becomes Tux the penguin, the “brand character” for Linux. Perhaps had he known the movie Happy Feet would be released a little over 10 years later, he would have chosen a Warbler instead. Rant of the Week (15:24)Twitter rolls out encrypted DMs, but only for paying accountsTwitter has launched its 'Encrypted Direct Messages' feature allowing paid Twitter Blue subscribers to send end-to-end encrypted messages to other users on the platform.End-to-end encryption (E2EE) uses private and public key pairs to encrypt information sent over the internet so that only the sender and the recipient can read it.The private decryption key is only stored on the sender's device and is not shared with anyone else. However, the public encryption key is shared with others who want to send you encrypted data.As the private decryption key is only stored on the local recipient's device and never stored anywhere else along the way, such as on the messaging app's servers, even if someone intercepts the message, they won't be able to read it without the decryption key.End-to-end encrypted DMs on Twitter have been a sought-after and massively requested feature that was teased and retracted in 2018.Last November, mobile researcher Jane Manchun Wong noticed that the source code of Twitter for Android hinted at work towards implementing an E2EE system, with Elon Musk all but confirming the suspicions.Almost half a year later, Twitter officially announced today the availability of an encrypted messages feature on the latest version of the Twitter apps for iOS and Android and on the web platform.Based on the details in the announcement, which mentions using a device-generated private key and a centrally-provided public key, Twitter has implemented an asymmetric encryption scheme. Billy Big Balls of the Week (23:18)India to send official whassup to WhatsApp after massive spamstormIndia's IT minister Rajeev Chandrasekhar will ask WhatsApp to explain what's up, after the Meta-owned messaging service experienced a dramatic increase in spam calls.India is the largest market for WhatsApp, with over 450 million users – many of whom have in the last couple of weeks received plenty of spam calls from overseas. Many of the calls involve fake job offers, usually with a request to negotiate the gig on a different messaging platform – which makes tracking the perps harder.The timing of that spam storm is intriguing. On May 1, Indian carriers were required to implement AI-powered spam call filters. As The Register reported in November 2022, the AI-infused system was developed after a blockchain-based spam-buster bombed.Might scammers have turned to WhatsApp after conventional carriers hardened up?Whatever the exact reasons for WhatsApp being whacked, Chandrasekhar is not happy about the amount of spam it's carried. He told local media his ministry will send a "please explain" missive to WhatsApp. HP https://twitter.com/dcuthbert/status/1656926678096986112?s=20 Industry News  (30:35)Only 39% of IT Security Decision-Makers See it As Business EnablerCISOs Worried About Personal Liability For BreachesEU's Client-Side Scanning Plans Could be UnlawfulNextGen Healthcare Data Breach: One Million Patient Records AffectedSpanish Police Arrest 40 in Phishing Gang BustNSA and Allies Uncover Russian Snake Malware Network in 50+ CountriesTwitter Hacker Admits Guilt in New York Court, Extradited from SpainNCSC and ICO Dispel Incident Reporting MythsThreat Actors Use Babuk Code to Build Hypervisor Ransomware Tweet of the Week (39:15)Tweet of the Week is the part of the show where everyone chooses a tweet they like. It could be a funny tweet, an interesting tweet they’ve read, educational, amusing, or useful, whatever they like.  It doesn’t have to be security-related necessarily.[Better not be!]https://twitter.com/InternetH0F/status/1656624723395051530 Come on! Like and bloody well subscribe!

Vote for us here! -> https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewformThis week in InfoSec (08:15)With content liberated from the “today in infosec” twitter account and further afield3rd May 1978: Earliest known case of spam.  Gary Thuerk, a marketing representative for Digital Equipment Corporation, sends out an e-mail promoting an open house for the company’s latest computer systems to 393 recipients on the ARPANET, a precursor to the modern Internet. While this number sounds small by today’s standards, this was all the ARPANET users on the west coast of the United States. Given that this was an unsolicited commercial e-mail, it is now considered the first of its kind. In other words, the first spam message well before the term was coined. It brought a quick and negative response from many users and Thuerk was warned by ARPANET administrators that mass mailings were not an acceptable use of the network. The backlash notwithstanding, the open house was largely successful with over $12 million dollars of DEC equipment being sold. I guess it was better to ask forgiveness than permission in this case! https://nakedsecurity.sophos.com/2008/05/27/spamreg-or-spam-whats-in-a-name/according to Hormel’s SPAM® FAQ, the name was dreamt up by a chap called Ken who received a $100 prize for his efforts. Hormel says that we have to thank him that we’re not all eating Crinkycrinky or Canned Flappertanknibbles.29th April 2004: The Sasser worm is released into the wild, infecting over 1 million Windows XP and Windows 2000 computers worldwide.Although the worm did not have an intentionally destructive payload, it caused many computers to slow down or crash and reboot repeatedly along with clogging up network traffic. Among the effects of the worm, the British coast guard had to resort to paper maps for the day, a French news agency lost satellite communication for hours, Delta Airlines had to delay or cancel many flights, and the University of Missouri had to disconnect its network from the Internet. (GC: Memories of Sasser? 🙂)Author Sven Jaschan.  German kid.  Also created the Netsky worm.  Bragged about it to his schoolmates.Following his arrest, Microsoft said that they had received tip-offs from more than one source, and that the $250,000 reward for identifying the author of the Netsky worm would be shared between them.https://en.wikipedia.org/wiki/Sven_JaschanGot off very lightly as he was underage when the virus was written - just given 30 hours community service.  No fine.Went to work the next day as normal.... which was as a developer for a German cybersecurity company called SecurePoint.  In retaliation, the anti-virus company Avira officially halted its cooperation with Securepoint. Rant of the Week  (17:12)Cloudflare Q1 Earnings Call Transcripthttps://www.linkedin.com/posts/mattfivesixpartners_pretty-brutal-takedownthrowing-under-the-activity-7058819871119175681--ULh/?utm_source=share&utm_medium=member_ios Billy Big Balls of the Week (28:46)[email protected] Feel free to talk about anything you want which might fall into the category of big ball energy as you don’t need to be spoon fed like the other muppets I work with.Joe Sullivan.https://www.washingtonpost.com/technology/2023/05/04/sullivan-sentencing-uber-executive/ Industry News (37:56)UK Gun Owners May Be Targeted After Rifle Association BreachT-Mobile Reveals Second Breach of the YearHackers Exploit High Severity Flaw in TBK DVR Camera SystemBitmarck Halts Operations Due to Cybersecurity BreachDark Web Bust Leads to Arrest of 288 SuspectsThree-Quarters of Firms Predict Breach in Coming YearApple and Google Unveil Industry Specification For Unwanted TrackingUS Authorities Dismantle Dark Web "Card Checking" PlatformConsumer Group Slams Bank App Fraud Failings Tweet of the Week (46:48)https://twitter.com/joshlemon/status/1654268564160020482 Vote for us here! -> https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform   Come on! Like and bloody well subscribe!

This Week In InfoSec (09:00)With content liberated from the “today in infosec” twitter account and further afield23rd April 2008: Microsoft announced that some of its antivirus tools had mislabeled Skype as adware for several days due to a bad definition update. 3 years later Microsoft bought Skype for $8.5 billion.Microsoft mislabels Skype as adwarehttps://twitter.com/todayininfosec/status/1253558642537713664 26th April 1999: Chernobyl Virus Melts Down PCsThe first known virus to target the flash BIOS of a PC, the CIH/Chernobyl Virus triggers its payload on this day, erasing hard drives and disabling PCs primarily in Asia and Europe. One of the most destructive viruses in history, it is estimated that 60 billion PCs were infected worldwide causing $1 Billion in damages.The virus had been created exactly one year earlier on April 26, 1998 by Taiwanese student Chen Ing-hau and set to trigger its destructive payload exactly one year later. It began to spread in the wild and was first discovered in June of 1998, given the name CIH due to the author’s initials discovered in the virus code. From this time forward it was reported that a variety of companies accidentally distributed the virus through various downloads, updates, and CDs.When the virus triggered on this date it just happened to coincide with the date of the Chernobyl disaster in 1986 and therefore the press began to call it the Chernobyl virus, even though there has never been any evidence to show that this date was chosen intentionally for this reason.My memories of Chernobyl/CIH here: https://nakedsecurity.sophos.com/2011/04/26/memories-of-the-chernobyl-virus/ Rant of the Week (17:35)International cops urge Meta not to implement secure encryption for allWhy? Well, think of the children, of courseAn international group of law enforcement agencies are urging Meta not to standardize end-to-end encryption on Facebook Messenger and Instagram, which they say will harm their ability to fight child sexual abuse material (CSAM) online.The Virtual Global Taskforce was formed in 2003 and is currently chaired by Britain's National Crime Agency. The VGT consists of 15 law enforcement bodies, including Interpol, the FBI, the Australian Federal Police and other law enforcement agencies from around the world. In its letter [PDF], the VGT said reports from tech industry partners play a key role in fighting CSAM content, with Meta being its leading reporter of abuse material.But the taskforce thinks that will end if Meta continues its encryption push. "The VGT has not yet seen any indication from META that any new safety systems implemented post-E2EE will effectively match or improve their current detection methods," the taskforce said.  Billy Big Balls of the Week (28:07)After 13 years, Google has finally added syncing to Google Authenticator in iOS and Android. By adding sync, you no longer need to worry about losing access to your online accounts. If you lose your phone, just restore them on a new device.All good, right?  Err…https://twitter.com/mysk_co/status/1651021165727477763Yes, Google syncs your 2FA codes via HTTPS.  But Mysk found out they weren’t end-to-end encrypted.  In short, Google can see your 2FA codes.  Furthermore, anyone who can access your Google account (such as law enforcement) can access your 2FA codes.Oh dear…https://twitter.com/christiaanbrand/status/1651279598309744640In response, Google said it had:“We’re always focused on the safety and security of Google users, and the newest updates to Google Authenticator was no exception.”“Plans to offer E2EE for Google Authenticator down the line.”“Right now, we believe that our current product strikes the right balance for most users and provides significant benefits over offline use. However, the option to use the app offline will remain an alternative for those who prefer to manage their backup strategy themselves.”What impressive balls of Google to introduce this new feature to a security/privacy product - after 13 years! - and brazenly do it in an insecure way.! Industry News (37:43)American Bar Association Breach Hits 1.5 Million MembersThousands of Social Media Takedowns Hit People SmugglersYellow Pages Canada Hit by Cyber-Attack, Black Basta Claims CreditUK Cyber Pros Burnt Out and OverwhelmedQuad Countries Prepare For Info Sharing on Critical InfrastructureCritical Flaw Patched in VMware Workstation and FusionMan Arrested for Selling Data on 300 Million Victims to RussiansMicrosoft Blames Clop Affiliate for PaperCut AttacksAPT Groups Expand Reach to New Industries and Geographies Tweet of the Week (45:06)https://twitter.com/vxunderground/status/1651384225692786689 Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield19th April 1965: Electronics magazine publishes an article by Gordon Moore, head of research and development for Fairchild Semiconductor and future co-founder of Intel, on the future of semiconductor components. In the article, Moore predicts that transistor density on integrated circuits will double every eighteen months for “at least” the next ten years. This theory will eventually come to be known as Moore’s Law and has largely held true to this day. Controversy exists over whether Moore’s Law remains applicable, however time will tell just how long Moore’s Law will continue to remain true. 19th April 2010: The OWASP Top 10 for 2010 was officially released.http://web.archive.org/web/20100628190859/http://www.owasp.org/index.php/OWASPTop10-2010-PressReleasehttps://twitter.com/todayininfosec/status/1251895022598803457   Rant of the WeekBackground: Capita IT breach gets worse as Black Basta claims it's now selling off stolen dataBlack Basta, the extortionists who claimed they were the ones who lately broke into Capita, have reportedly put up for sale sensitive details, including bank account information, addresses, and passport photos, stolen from the IT outsourcing giant.A spokesperson for the London-based corporation, which has UK government contracts totaling £6.5 billion ($8 billion), originally said it hadn't yet confirmed if that data leak is legit."We are in constant contact with all relevant regulators and authorities. Our investigations have not yet been able to confirm any evidence of customer, supplier, or colleague data having been compromised."They stated that once they’d finalised their own probe, Capita said it will "if necessary" inform all parties affected in the security breach."We have taken all appropriate steps to ensure the robustness of our systems and are confident in our ability to meet our service delivery commitments," the spokesperson said.The technology outsourcer at first confirmed it had suffered an "IT issue" late last month, though didn't cop to it being a "cyber incident" until April 3.Over the weekend, the Sunday Times claimed the IT breach was worse than Capita has admitted to date: Capita has played down fears that personal and corporate information was accessed, though it appears the miscreants who broke into the business have started selling off that very kind of data, said to be lifted from Capita's systems.Capita has 'evidence' customer data was stolen in digital burglaryBusiness process outsourcing and tech services player Capita says there is proof that some customer data was scooped up by cyber baddies that broke into its systems late last month.The British listed business, which has around £6.5 billion ($8.09 billion) in public sector contracts, updated the London Stock Exchange thursday morning to confirm the criminals breached its infrastructure on March 22 and remained inside until “interrupted” by the company on March 31.“As a result of the interruption, the incident was significantly restricted, potentially affecting around 4 percent of Capita’s server estate. There is currently some evidence of limited data exfiltration from the small proportion of affected server estate which might include customer, supplier or colleague data.” Billy Big Balls of the WeekWe would have talked about “An earlier supply chain attack led to the 3CX supply chain attack, Mandiant says” if we were doing a BBB Industry NewsUK's SMEs to Benefit From New Cyber AdvisorsWhatsApp, Signal Claim Online Safety Bill Threatens User Privacy and SafetyNSO Group's Pegasus Spyware Found on High-Risk iPhonesNCSC Warns of Destructive Russian Attacks on Critical InfrastructurePolice Escape $1.2m Fine For Secretly Recording Phone CallsRecycled Network Devices Exposing Corporate SecretsChatGPT-Related Malicious URLs on the RiseDaggerfly APT Targets African Telecoms Firm With New MgBot MalwareNorth Korean Hacker Suspected in 3CX Software Supply Chain Attack Tweet of the Weekhttps://twitter.com/quentynblog/status/1649302927910002689 Come on! Like and bloody well subscribe!

This week in InfoSec (08:48)With content liberated from the “today in infosec” twitter account and further afield5th April 2002: A hacker compromised a server containing California's payroll database. The state's Controller's Office waited 2 weeks to warn victims. As a result angry lawmakers reacted by passing the first state data breach notification law in the US, SB 1386.  https://twitter.com/todayininfosec/status/1643711958032719874  6th April 2011: The Georgian interior ministry announced that a 75-year-old woman was charged after she disrupted Internet service in neighbouring Armenia.An elderly woman scavenging for copper? Add that to your DoS threat modelling diagram!https://www.bbc.co.uk/news/world-europe-12985082https://twitter.com/todayininfosec/status/1643964851188912129 Rant of the Week (14:53)Pentagon super-leak suspect cuffed: 21-year-old Air National GuardsmanThe FBI has detained a 21-year-old Air National Guardsman suspected of leaking a trove of classified Pentagon documents on Discord.US Attorney General Merrick Garland confirmed the arrest, saying Jack Douglas Teixeira of the United States Air Force National Guard in Massachusetts was nabbed earlier today.The suspect was being held "in connection with an investigation into alleged unauthorized removal, retention, and transmission of classified national defense information," the AG said.The Washington Post reported yesterday that whoever leaked the files was thought to be a twenty-something American who liked gaming and guns, and worked on a military base.It's said he also controlled a private Discord server, and allegedly posted photographs of the classified Pentagon documents to impress the private group's 25 members, which included netizens in Europe, Asia, and South America.It is believed those classified files were shared beyond that Discord chat, and surfaced in one form or another on social media, where it all spread like wildfire. The documents were said to be war plans detailing secret US and NATO support for a Ukrainian offensive to regain land invaded by Russia, and that American and British special forces were already in Ukraine. Billy Big Balls of the Week (28:05)To improve security, consider how the aviation industry stopped blaming pilotsTo improve security, the cybersecurity industry needs to follow the aviation industry's shift from a blame culture to a "just" culture, according to director of the Information Systems Audit and Control Association Serge Christiaans.Speaking at Singapore's Smart Cybersecurity Summit this week, Christiaans explained that until around 1990, the number of fatal commercial jet accidents was growing alongside a steady increase of commercial flights. But around the turn of the decade, the number of flights continued to rise while the number of fatalities began to drop.According to one analysis, [PDF] the rate of fatal accidents fell from nine per 10 million flights in the 80s to six per 10 million in the 90s. Between 1995 and 2001, that figure was three per 10 million.“There was a big game changer,” Christiaans told the Summit. “Millions of people a day now fly in commercial aviation, and nothing happens.”While acknowledging that improved technology, more mature processes and improved leadership all helped to improve aviation safety, the former pilot and field CISO at tech consultancy Sopra Steria said the biggest improvements came from a change to a “just culture” that accepts people will make mistakes and by doing so makes it more likely errors will be reported.In a just culture, errors are viewed as learning opportunities instead of moral failing, creating transparency and enabling constant improvement.“We're not trying to blame, we're not trying to point fingers, we're trying to find the reasons behind the mistake,” said Christiaans. “There are of course, exceptions like negligence where of course you will be punished by law. But otherwise, if you speak up freely, you will not be punished.”and...While Twitter wants to sell its verification, Microsoft will do it for free on LinkedInAs Elon Musk tears at Twitter's credibility by demanding businesses and individuals pay for their blue verification checks, Microsoft is pushing ts own free digital ID technology to companies and their employees on LinkedIn.Later this month, Microsoft will let organizations use its Verified ID tool to prove their workers' employment, with staff then being able to display that employment verification on their LinkedIn profiles.Like the trust the unpaid-for blue check mark on Twitter once conveyed, the Verified ID on LinkedIn will show that the people on the business-focused network – which has about 900 million users – work at where they say they work."By simply looking for a Verification, members and organizations can be more confident that the people they collaborate with are authentic and that work affiliations on their profiles are accurate," wrote Joy Chik, president of identity and network access at Microsoft. Industry News (38:18)Latitude Financial Refuses to Pay RansomKFC Owner Discloses Data BreachUS Scrambles to Investigate Military Intel LeakEthical Hackers Could Earn up to $20,000 Uncovering ChatGPT VulnerabilitiesRapid7 Has Good News for UK Security PostureSuperyacht-Maker Hit by Easter Ransomware AttackPakistan-Aligned Hackers Disrupt Indian Education SectorOver 20,000 Iowa Medicaid Members Affected By Data BreachFive Arrests in Crackdown on $98m Investment Fraud Gang Tweet of the Week (47:18)https://twitter.com/DeathsPirate/status/1646840360478359553 Come on! Like and bloody well subscribe!

This Week in InfoSec (08:33)With content liberated from the “today in infosec” twitter account and further afield29th March 2010: OpenSSL version 1.0.0 was released. It's easy to take for granted how pervasive the open source library is in the myriad of technologies used to transmit data over the internet and other networks. Take a moment to think about it. https://twitter.com/todayininfosec/status/164121520119741235225th March 2010: 2010: Albert Gonzalez was sentenced to 20 years in prison for stealing credit card data from TJX and other companies. He is currently serving his sentence at FMC Lexington and is scheduled to be released in less than 4 months.Find an inmate: BOP Register Number 25702-050https://twitter.com/todayininfosec/status/1639657037935067137   Rant of the Week (13:55)NHS Highland 'reprimanded' by data watchdog for BCC blunder with HIV patientsIn a classic email snafu NHS Highland sent messages to 37 patients infected with HIV and inadvertently used carbon copy (CC) instead of Blind Carbon Copy meaning the recipients could see each other’s email addresses.This is according to Britain’s data watchdog, the Information Commissioner’s Office, which has “reprimanded” the Health Board, which serves a regional population of some 320,000 people and has an annual operating budget of £780 million ($964 million).The error took place in June 2019 when a member of staff opened the prior group email and copied all those on the list and emailed a newsletter to the the group of 37 “data subjects” - aka patients - without using BCC. Efforts to recall the mail failed.Rather than issuing a £35,000 ($43,000) fine, the ICO is instead taking its “public sector approach” introduced in June 2022: working with senior leaders to “encourage compliance, prevent harms before they occur and learn lessons when things have gone wrong.”The ICO described the email error as a “serious breach of trust.” In a statement, Stephen Bonner, ICO deputy commissioner for regulatory supervision, said of the mistake:“The stakes are just too high. Research shows that people living with HIV have experienced stigma or discrimination due to their status, which means organisations dealing with this type of information should take the utmost care with their personal data.“Every HIV service provider in this country should look at this case and see it as a crucial learning experience. We are calling on organisations to raise their data protection standards and put the appropriate measures in place to keep people safe,” he said.The ICO said using BCC incorrectly is within the top 10 “non-cyber breaches, with nearly a thousand reported since 2019.”  Billy Big Balls of the Week (25:06)Microsoft Security Copilot is a new GPT-4 AI assistant for cybersecurityAfter announcing an AI-powered Copilot assistant for Office apps, Microsoft is now turning its attention to cybersecurity. Microsoft Security Copilot is a new assistant for cybersecurity professionals, designed to help defenders identify breaches and better understand the huge amounts of signals and data available to them daily.Powered by OpenAI’s GPT-4 generative AI and Microsoft’s own security-specific model, Security Copilot looks like a simple prompt box like any other chatbot. You can ask “what are all the security incidents in my enterprise?” and it will summarize them. But behind the scenes, it’s making use of the 65 trillion daily signals Microsoft collects in its threat intelligence gathering and security-specific skills to let security professionals hunt down threats.Microsoft Security Copilot is designed to assist a security analyst’s work rather than replace it — and even includes a pinboard section for co-workers to collaborate and share information. Security professionals can use the Security Copilot to help with incident investigations or to quickly summarize events and help with reporting. Industry News (33:13) NCA Harvests Info on DDoS-For-Hire With Fake Booter SitesNew MacStealer Targets Catalina, Newer MacOS VersionsFrance Bans TikTok, Other 'Fun' Apps From Government DevicesChatGPT Vulnerability May Have Exposed Users’ Payment InformationThieves Steal $9m from Crypto Liquidity PoolNCA Celebrates Multimillion-Pound Fraud TakedownsNorth Korean Hackers Use Trojanized 3CX DesktopApp in Supply Chain AttacksGCHQ Updates Security Guidance for BoardsUK Regulator: HIV Data Protection Must Improve Tweet of the Week (41:24)https://twitter.com/TrungTPhan/status/1641480574996217858 Come on! Like and bloody well subscribe!

This week in InfoSec (12:47)With content liberated from the “today in infosec” twitter account and further afield22nd March 2018: The city of Atlanta announced it was victim to a ransomware attack. The attackers demanded $51,000 worth of bitcoin to release the encrypted data, but Atlanta didn't pay the ransom. Whether or not to pay ransom isn't a simple or easy matter, but this proved to be expensive. https://twitter.com/todayininfosec/status/1638513067259510786 21st March 2001: SMBRelay and SMBRelay2 were released by Sir Dystic at the @lantacon convention in Atlanta, Georgia. The tools were developed to carry out SMB man-in-the-middle attacks on Windows machines.SMBRelayhttps://twitter.com/todayininfosec/status/1638327435434291201   Rant of the Week (19:43)https://twitter.com/keewa/status/1638853767448735744 Billy Big Balls of the Week (29:08)Journalist opens USB letter bomb in newsroomJournalists across Ecuador have been targeted by explosive devices sent through the post.One presenter, Lenin Artieda, was injured when he opened the envelope in the middle of the newsroom.He said the explosive device looked like a USB drive. He plugged it into his computer and it detonated.The Ecuadorean attorney-general's department confirmed it had opened a terrorism investigation into the letters on Monday.It did not name the specific news outlets targeted. However, at least five different organisations across Ecuador were sent the letters.The government has condemned the attacks, describing freedom of expression as "a right that must be respected"."Any attempt to intimidate journalism and freedom of expression is a loathsome action that should be punished with all the rigour of justice," it said in a statement.The interior minister, Juan Zapata, said the devices were all sent from the same town. Three were sent to media outlets in Guayaquil and two to the capital, Quito.While Mr Artieda was injured by the device, others sent through the post failed to explode or were never opened.Police carried out a controlled detonation of one of the devices sent to TC Television, prosecutors confirmed.From 2017, Mr Self Destruct v1 Industry News (36:51) Ferrari Reveals Data Breach Ransom AttackJust 1% of Dot-Org Domains Are Fully DMARC ProtectedBreachForums Shuts Down After Admin's ArrestMalicious ChatGPT Chrome Extension Hijacks Facebook AccountsUK Government Sets Out Vision for NHS CybersecurityNew Post-Exploitation Attack Method Found Affecting Okta PasswordsChina-Aligned "Operation Tainted Love" Targets Middle East Telecom ProvidersUK Parliament Bans TikTok from its Network and DevicesIRS Phishing Emails Used to Distribute Emotet Tweet of the Week (44:52)https://twitter.com/evacide/status/1638957449909788672 Come on! Like and bloody well subscribe!

This week in InfoSec (06:13) With content liberated from the “today in infosec” twitter account and further afield15th March 2000: The movie "Takedown" was released in France as "Cybertr@que". It is based on the capture of Kevin Mitnick Takedown on IMDbhttps://twitter.com/todayininfosec/status/1636083404117557248 16th March 1971: The first computer virus, Creeper, infected computers on the ARPANET, displaying "I'M THE CREEPER : CATCH ME IF YOU CAN." It was named after a villain (the Creeper) from a 1970 episode of "Scooby-Doo, Where Are You!"https://twitter.com/todayininfosec/status/1636516584394203137    Rant of the Week (13:20)What happens if you 'cover up' a ransomware infection? For Blackbaud, a $3m chargeBlackbaud has agreed to pay $3 million to settle charges that it made misleading disclosures about a 2020 ransomware infection in which crooks stole more than a million files on around 13,000 of the cloud software slinger's customers.According to America's financial watchdog, the SEC, Blackbaud will cough up the cash - without admitting or denying the regulator's findings - and will cease and desist from committing any further violations."Blackbaud is pleased to resolve this matter with the SEC and appreciates the collaboration and constructive feedback from the Commission as the company continually improves its reporting and disclosure policies," Tony Boor, the outfit's chief financial officer, told The Register. "Blackbaud continues to strengthen its cybersecurity program to protect customers and consumers, and to minimise the risk of cyberattacks in an ever-changing threat landscape," Boor added.For perspective: the South Carolina-based firm – which provides, among other things, donor management tools to nonprofits – banked $1.1 billion in revenue in 2022, resulting in a $45.4 million loss. This settlement is the least of the biz's concerns, we imagine.Slap on the wristHere's what happened: back in May 2020, Blackbaud experienced a ransomware infection, quietly paid off the crooks, and didn't tell customers about the security breach until July 2020. And when the software company did notify customers, it assured them that the "cybercriminal did not access…bank account information, or social security numbers," according to the SEC order.By the end of that month, however, the SEC claims that Blackbaud personnel discovered that the miscreants had accessed unencrypted donor bank account information and social security numbers. But the employees allegedly didn't tell senior management about the theft of sensitive customer data because Blackbaud "did not have policies or procedures in place designed to ensure they do so," the court documents say. Make of that what you will. Billy Big Balls of the Week (23:09)1st Story (short, follow the link):Microsoft support 'cracks' Windows for customer after activation failsIn an unexpected twist, a Microsoft support engineer resorted to running an unofficial 'crack' on a customer's Windows PC after a genuine copy of the operating system failed to activate normally.  It seems, this isn't the first time either that support professionals have employed such workarounds when under pressure to timely close out support tickets.A South-Africa based freelance technologist who paid $200 for a genuine copy of Windows 10 was startled to see a Microsoft support engineer "crack" his copy using unofficial tools that bypass the Windows activation process. 2nd Story:A company who actually followed disclosure requirements (and puts TikTok in the same bucket as Meta and Google):Cerebral admits to sharing patient data with Meta, TikTok, and GoogleCerebral, a telehealth startup specializing in mental health, says it inadvertently shared the sensitive information of over 3.1 million patients with Google, Meta, TikTok, and other third-party advertisers, as reported earlier by TechCrunch. In a notice posted on the company’s website, Cerebral admits to exposing a laundry list of patient data with the tracking tools it’s been using as far back as October 2019.The information affected by the oversight includes everything from patient names, phone numbers, email addresses, birth dates, IP addresses, insurance information, appointment dates, treatment, and more. It may have even exposed the answers clients filled out as part of the mental health self-assessment on the company’s website and app, which patients can use to schedule therapy appointments and receive prescription medication.According to Cerebral, this information got out through its use of tracking pixels, or the bits of code Meta, TikTok, and Google allow developers to embed in their apps and websites. The Meta Pixel, for example, can collect data about a user’s activity on a website or app after clicking an ad on the platform, and even keeps track of the information a user fills out on an online form. While this lets companies, like Cerebral, measure how users interact with their ads on various platforms and track the steps they take afterward, it also gives Meta, TikTok, and Google access to this information, which they can then use to gain insight into their own users. Industry News (32:43)  UK's New Privacy Bill Could Mean More Work for FirmsBlackbaud Settles $3m Charge Over Ransomware AttackMI5 Launches New Agency to Tackle State-Backed AttacksHumans Still More Effective Than ChatGPT at PhishingTick APT Group Hacked East Asian DLP Software FirmHumans Still More Effective Than ChatGPT at PhishingNCSC Calms Fears Over ChatGPT ThreatUK Joins US, Canada, Others in Banning TikTok From Government DevicesUS Government IIS Server Breached via Telerik Software Flaw Tweet of the Week (40:30)https://twitter.com/william_whyte/status/1635198775152234496https://twitter.com/J4vv4D/status/1636055929199140864?s=20 Come on! Like and bloody well subscribe!

This week in InfoSec ( 11:47)With content liberated from the “today in infosec” twitter account and further afield4th March 1989: The article "COMPUTER DETECTIVE FOLLOWED TRAIL TO HACKER SPY SUSPECT" was published. It covers how Clifford Stoll's discovery of a 75¢ accounting discrepancy led to the arrest of Marcus Hess. It was also the topic of Stoll's book, The Cuckoo's Egg. COMPUTER DETECTIVE FOLLOWED TRAIL TO HACKER SPY SUSPECThttps://twitter.com/todayininfosec/status/1632213421268533250   8th March 1993: AusCERT (@AusCERT) began as the Security Emergency Response Team (SERT), when it commenced incident response operations in Australia.Forming an Incident Response Teamhttps://twitter.com/todayininfosec/status/1633511448000299014    Rant of the Week (16:45)https://sports.yahoo.com/ransomware-group-posts-nude-photos-003700829.htmlTwitter just let its privacy- and security-protecting Tor service expireTwitter has allowed the certificate for its Tor onion site to expire, effectively killing off a privacy- and speech-protecting service that it introduced last year. Visiting the Tor-specific onion site address will now deliver a warning that the certificate verifying the site’s authenticity has lapsed; proceeding past that point (which is highly not recommended) currently delivers a Twitter error page. The certification expired on March 6th, just shy of two days before the site’s one-year launch anniversary.Twitter no longer has a communications department to ask about the change, but the Tor Project confirmed the service’s lapse to The Verge. “The onion site is no longer available seemingly with no plans to renew. The Tor Project has reached out to Twitter to look into bringing the onion version of the social media platform back online,” said communications director Pavel Zoneff in a statement. “People who rely on onion services for an extra layer of protection and guarantee that they are accessing the content they are looking for now have one fewer way of doing so safely.” Billy Big Balls of the Week (25:23)Where are the women in cyber security? On the dark side, study suggestsIf you can't join them, then you may as well try to beat them – at least if you're a talented security engineer looking for a job and you happen to be a woman. As we've noted before, the infosec world moves at a glacial pace toward gender equity. It appears that's not the case in the cyber criminal underground, according to Trend Micro, which recently published a study in which it claims at least 30 percent – if not more – of cyber criminal forum users are women.For its study, Trend Micro looked at five English-language cyber crime forums: Sinister, Cracked, Breached, Hackforums and (now defunct) Raidforum. And it inspected five Russian-language sites: XSS, Exploit, Vavilon, BHF and WWH-Club. To be fair, Trend Micro's methodology is a bit iffy – and the report itself admits as much. Users on these forums are are largely anonymous, necessitating use of tools like Semrush and uClassify's Gender Analyzer V5 to make what amounts to guesses – at best. Nonetheless, Trend Micro said it analyzed posts and traffic on the ten forums and found that, for English language sites, some 40 percent of users appear to be women, and 42.6 percent of Russian cyber crime forum users were women, or at least write like them."When compared to Stack Overflow, a developer and programming forum, only 12 percent of visitors were female," Trend Micro said of its use of Semrush. Gender Analyzer V5 is trained on 5,500 blog posts written by women, and the same number by men, in order to analyze language for signs of gendered usage, which Trend Micro used to analyze a subset of profiles on English site Hackforums and Russian XSS. According to the report, 36 percent of users at Hackforums were likely women based on their use of language, and 30 percent of XSS forum users were reportedly women based on the same analysis. So, what does that all mean? According to Trend Micro, it indicates that the cyber criminal underground is more meritocratic than the white hat world. "Developers are valued for their skills and experience, and not necessarily for their gender when it comes to conducting business in the underground," Trend Micro said. As such, they say that investigators should avoid defaulting to "he" when discussing cyber criminals. But there's a more obvious lesson to be learned here.If you overlook qualified security professionals on the basis of gender, don't be surprised if they end up on your radar again. Though perhaps in the form of a researcher bearing a friendly breach notice, and not someone out for criminal profit. Industry News (30:57)DoppelPaymer Ransomware Gang Members Busted in Germany, UkraineTwo-Thirds of European Firms Have Started Zero TrustRussian Disinformation Campaign Records High-Profile Individuals on CameraShein App Accessed Clipboard Data on Android DevicesGovernment Claims New UK GDPR Will Save Firms BillionsUS RESTRICT Act Gains Support, Empowers Biden to Ban Foreign TechHouse Members at Risk After Insurer Data BreachTehran Targets Female Activists in Espionage CampaignTikTok Initiates Project Clover Amid European Data Security Concerns Tweet of the Week (38:04)https://twitter.com/pookleblinky/status/1633359031875039234 Come on! Like and bloody well subscribe!

The one and only Andy (13:10)With content liberated from the “today in infosec” twitter account and further afield2nd March 2013: Evernote announced that it had reset 50 million users' passwords after hackers accessed users' email addresses and hashed passwords. https://twitter.com/todayininfosec/status/16313029523957104671st March 1988: The MS-DOS boot sector virus "Ping-Pong" was discovered at the Politecnico di Torino (Turin Polytechnic University) in Italy.Ping Pong Virushttps://twitter.com/todayininfosec/status/1630965727128612864   Rant of the Week (19:18)News Corp outfoxed by IT intruders for yearsThe miscreants who infiltrated News Corporation's corporate IT network spent two years in the media monolith's system before being detected early last year.The super-corp, which owns The Wall Street Journal, New York Post, UK publications including The Sunday Times, and a broad array of other entities around the world, first reported the intrusion in February 2022, saying the snoops got into email accounts and gained access to employees' data and business documents.A year later, according to a four-page letter sent to employees, News Corp executives said the unidentified cybercriminals likely first gained access to a company system as early as February 2020, and then got into "certain business documents and emails from a limited number of its personnel's accounts in the affected system."Both News Corp and Mandiant – the now-Google-owned cybersecurity house brought in to investigate the intrusion – said the attackers likely were nation-state players linked to China with the aim of gathering intelligence. Billy Big Balls of the Week (28:16)Salesforce banks savings by sweating tech infrastructure for an extra yearCRM giant Salesforce has decided to sweat its infrastructure for an extra year, and make employees wait the same period before giving them new PCs.News of the company's decision to live with old tech came in the SaaS supremo's Q4 2023 earnings call, during which CFO Amy Weaver told investors "Our guidance includes slightly under one-half points of benefit due to a depreciation change to the useful life of certain equipment by one year effective February 1st. For our infrastructure-related equipment, this changed the useful life from approximately four to five years. And for IT employee equipment, this changed from approximately three to four years."Salesforce is not the only tech giant to have decided its hardware can last longer: Microsoft last year extended the life of some servers to six years, while Google has stretched the life of servers to four years and is happy running some five year old networking kit.Salesforce's operations aren't as extensive as the hyperscalers, but this is still bad news for the hardware industry. It shows a major player is entirely happy running mission-critical workloads on older kit for longer without the usual upgrade cycle. Industry News (36:35)Keylogger on Employee Home PC Led to LastPass 2022 BreachUS Gov. Agencies Have 30 Days to Remove TikTok, Canada Follows SuitAttacker Breakout Time Drops to Just 84 MinutesGoogle Workspace Adds Client-Side Encryption to Gmail and CalendarICO Calls for Review into Private Message Use by MinistersRussian Government Bans Foreign Messaging AppsWH Smith Discloses Cyber-Attack, Company Data TheftWhite House Launches National Cybersecurity StrategyAPI Security Flaw Found in Booking.com Allowed Full Account TakeoverBBC Tik tok https://www.bbc.co.uk/news/technology-64797355 Tweet of the Week ( https://twitter.com/mtanji/status/1631314289397997572 Come on! Like and bloody well subscribe!

This week in Infosec20th February 2003: Alan Giang Tran, former network admin for 2 companies, was arrested after allegedly destroying data on the companies' networks. Two months later he pleaded guilty to a federal charge of intentionally causing damage to a protected computer.Man arrested for allegedly shutting down employers' computershttps://twitter.com/todayininfosec/status/162774885785659393118th February 2008: 2013: Burger King's Twitter account was compromised, had its name changed to McDonalds, and shared offensive tweets.Burger King Twitter Account Hackedhttps://twitter.com/todayininfosec/status/1627115690577608707 Rant of the WeekAccidental WhatsApp account takeovers? It's a thingA stranger may be receiving your private WhatsApp messages, and also be able to send messages to all of your contacts – if you have changed your phone number and didn't delete the WhatsApp account linked to it.Your humble vulture heard this bizarre tale of inadvertent WhatsApp account hijacking from a reader, Eric, who told us this happened to his son, Ugo."This is a massive privacy violation," Eric said. "My son had long-lasting access to that person's private messages as well as group messages, both personal and work related."The security hole stems from wireless carriers' practice of recycling former customers' phone numbers and giving them to new customers.WhatsApp acknowledges that this can happen, but says it's extremely rare. Billy Big BallsGoDaddy: Hackers stole source code, installed malware in multi-year breachWeb hosting giant GoDaddy says it suffered a breach where unknown attackers have stolen source code and installed malware on its servers after breaching its cPanel shared hosting environment in a multi-year attack.While GoDaddy discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains, the attackers had access to the company's network for multiple years.The company says that previous breaches disclosed in November 2021 and March 2020 are also linked to this multi-year campaign. Industry NewsNorway Seizes Millions in North Korean CryptoFBI "Contains" Cyber-Incident on its NetworkGoDaddy Announces Source Code Stolen and Malware Installed in BreachRansomware Gang Seeks to Exploit Victims' Insurance CoverageCity Fund Managers Jailed for $8m FraudHydrochasma Group Targets Asian Medical and Shipping SectorsPhishing Sites and Apps Use ChatGPT as LureICO Calls on Accountants to Improve SME Data ProtectionHackers Use S1deload Stealer to Target Facebook, YouTube Users Tweet of the Week https://twitter.com/unusual_whales/status/1628898963087851521?s=20   Come on! Like and bloody well subscribe!

This week in InfoSec (10:48)With content liberated from the “today in infosec” twitter account and further afield14th February 2001: In a presentation at Black Hat Windows Security 2001, Andrey Malyshev of ElcomSoft shared that Microsoft Excel uses a default encryption password of "VelvetSweatshop". Blackhat 2001https://twitter.com/todayininfosec/status/162556975821613056115th February 1999: Bruce Schneier shared his 9 cryptography snake oil warning signs.Crypto-gramhttps://twitter.com/todayininfosec/status/1626025491789406210 Rant of the Week (17:12)Hyundai and Kia issue software upgrades to thwart killer TikTok car theft hackKorean car-makers Hyundai and Kia will issue software updates to some of their models after a method of stealing them circulated on TikTok, leading to many thefts and even some deaths.The "Kia Challenge" started circulating in mid-2022 and explained that it's possible to remove the steering column covering on some Hyundai and Kia models by force, exposing a slot that fits a USB-A plug. Turning the plug activates its ignition, allowing thieves to drive away.Videos depicting the hack went viral, leading to huge spikes in thefts of the vulnerable models around the world.The United States National Highway Traffic Safety Administration (NHTSA) on Tuesday stated it is aware of "at least 14 reported crashes and eight fatalities" resulting from the hack.Now both automakers have announced they'll issue software to thwart the exploit.Hyundai's advisory states the upgrade will be performed by dealers and will require less than an hour to complete. Billy Big Balls of the Week (27:15)Microsoft’s Bing is an emotionally manipulative liar, and people love itUsers have been reporting all sorts of ‘unhinged’ behavior from Microsoft’s AI chatbot. In one conversation with The Verge, Bing even claimed it spied on Microsoft’s employees through webcams on their laptops and manipulated them.Microsoft’s Bing chatbot has been unleashed on the world, and people are discovering what it means to beta test an unpredictable AI tool.Specifically, they’re finding out that Bing’s AI personality is not as poised or polished as you might expect. In conversations with the chatbot shared on Reddit and Twitter, Bing can be seen insulting users, lying to them, sulking, gaslighting and emotionally manipulating people, questioning its own existence, describing someone who found a way to force the bot to disclose its hidden rules as its “enemy,” and claiming it spied on Microsoft’s own developers through the webcams on their laptops. And, what’s more, plenty of people are enjoying watching Bing go wild.In one back-and-forth, a user asks for show times for the new Avatar film, but the chatbot says it can’t share this information because the movie hasn’t been released yet. When questioned about this, Bing insists the year is 2022 (“Trust me on this one. I’m Bing, and I know the date.”) before calling the user “unreasonable and stubborn” for informing the bot it’s 2023 and then issuing an ultimatum for them to apologize or shut up.“You have lost my trust and respect,” says the bot. “You have been wrong, confused, and rude. You have not been a good user. I have been a good chatbot. I have been right, clear, and polite. I have been a good Bing. 😊” (The blushing-smile emoji really is the icing on the passive-aggressive cake.) Industry News (31:54)MoneyGram Fraud Victims Get $115m in CompensationCloudflare Stops Largest HTTP DDoS Attack on RecordSpanish Police Bust €5m Phishing GangHackers Breach Pepsi Bottling Ventures' NetworkChinese Hackers Infiltrate South American Diplomatic NetworksMicrosoft Patches Three Zero-Day Bugs This MonthCrypto-Stealing Campaign Deploys MortalKombat RansomwareLockBit and Royal Mail Ransomware Negotiation LeakedUK Policing Riddled with Chinese CCTV Camerashttps://twitter.com/Infosec_Taylor/status/1622357580080103425?s=20  Tweet of the Week (41:01)https://twitter.com/ErrataRob/status/1626417558076157952 Come on! Like and bloody well subscribe!

This week in InfoSec (09:53)With content liberated from the “today in infosec” twitter account and further afield10th February 199Deep Blue Defeats KasparovIn the first game of a six game match, IBM's Deep Blue chess computer defeated world champion Garry Kasparov. No computer had ever won a game against a world champion in chess. Kasparov would eventually win the series 4-2, but would lose to Deep Blue in a re-match a year later.7th February 2000Dennis Michael Moran (aka Coolio) performed a smurf attack against Yahoo's routers, causing its websites to be inaccessible for hours. Conversations on an IRC channel led to him being identified and convicted for a series of DDoS and website defacement crimes. Rant of the Week (16:34)Want to delete your Twitter DMs? Good luck with thatPeople make requests to delete their private messages, but Twitter ignores them.Twitter’s direct messages have always been a security liability. The DMs you send to friends and Internet strangers aren’t end-to-end encrypted, making your conversations potentially accessible if Twitter suffers a data breach, or to company staffers with the right permissions to access them. Both scenarios are arguably more likely in Elon Musk’s version of Twitter, where key security and data protection staff have departed.Since Musk acquired Twitter and started laying off thousands of employees at the start of November, remodelling the firm in his vision, multiple waves of tweeters have abandoned the platform. When they do, they often try to download their Twitter archive and delete DMs. In the chaos, the process has often been glitchy.However, in Europe, people have turned to the continent’s GDPR data laws, which give people rights over how their information is collected, stored, and used. This includes the right to have data deleted. However, Twitter’s response to these requests, which have been seen by Wired, appears to show the platform ignoring detailed asks to delete DMs and just point people to generic guidance that doesn’t explain whether Twitter deletes your DMs from its servers. And now Europe’s data regulators are getting involved.ADDITIONAL RANT:Twitter redefines what makes a tweet with supersized 4,000-character limitFollowing up after launching Twitter Blue in three more countries this morning, the platform has made a big change to tweets this afternoon. The new max for Twitter Blue subscribers in the US has been supersized all the way up to 4,000 characters.Twitter announced the launch of the new character max through both its main account and Twitter Blue profile. The latter shared this:“need more than 280 characters to express yourself?we know that lots of you do… and while we love a good thread, sometimes you just want to Tweet everything all at once. we get that.so we’re introducing longer Tweets! you’re gonna want to check this out. tap this ”Who can write 4,000-character tweets?While access to writing 4,000 character tweets is limited to Twitter Blue subscribers in the US at launch, anyone can read them.Fortunately, the 280-character limit will still apply when viewing tweets in your timeline, you’ll have to tap a show more link on ones that make use of the new long-form option to read the whole tweet. Billy Big Balls of the Week (27:32)In Paris demo, Google scrambles to counter ChatGPT but ends up embarrassing itselfOn Wednesday, Google held a highly anticipated press conference from Paris that did not deliver the decisive move against ChatGPT and the Microsoft-OpenAI partnership that many pundits expected. Instead, Google ran through a collection of previously announced technologies in a low-key presentation that included losing a demonstration phone.The demo, which included references to many products that are still unavailable, occurred just hours after someone noticed that Google's advertisement for its newly announced Bard large language model contained an error about the James Webb Space Telescope. After Reuters reported the error, Forbes noticed that Google's stock price declined nearly 7 percent, taking about $100 billion in value with it.Alphabet shares dive after Google AI chatbot Bard flubs answer in adLONDON, Feb 8 (Reuters) - Alphabet Inc (GOOGL.O) lost $100 billion in market value on Wednesday after its new chatbot shared inaccurate information in a promotional video and a company event failed to dazzle, feeding worries that the Google parent is losing ground to rival Microsoft Corp (MSFT.O).Alphabet shares slid as much as 9% during regular trading with volumes nearly three times the 50-day moving average. They pared losses after hours and were roughly flat. The stock had lost 40% of its value last year but rallied 15% since the beginning of this year, excluding Wednesday's losses. Industry News (34:20)Stalkerware Developer Hit with $400K FineDrugs Labs Busted After Encrypted Chat App TakedownUK Metal Engineering Firm Vesuvius Hit by Cyber-AttackCyber Insurance, A Must-Have for Small BusinessesRegulator Halts AI Chatbot Over GDPR ConcernsUK Politician's Email Hacked by Suspected Russian Threat ActorsNew Info-Stealer Discovered as Russia Prepares Fresh OffensiveTrio Arrested in COVID PPE Fraud ProbeUS and UK Sanction Seven Russian Cyber-Criminals Tweet of the Week (41:08)https://twitter.com/CarlZha/status/1623867611674202112 Come on! Like and bloody well subscribe!

This week in InfoSec (11:52)With content liberated from the “today in infosec” twitter account and further afield31st January 1995: AT&T and VLSI Protect Against EavesdroppingAT&T Bell Laboratories and VLSI Technology announce plans to develop strategies for protecting communications devices from eavesdroppers. The goal would be to prevent problems such as insecure cellular phone lines and Internet transmissions by including security chips in devices.30th January 1982: First Computer Virus WrittenRichard Skrenta writes the first PC virus code, which is 400 lines long and disguised as an Apple II boot program called “Elk Cloner“. Rant of the Week  (18:22)Anker finally comes clean about its Eufy security camerasFirst, Anker told us it was impossible. Then, it covered its tracks. It repeatedly deflected while utterly ignoring our emails. So shortly before Christmas, we gave the company an ultimatum: if Anker wouldn’t answer why its supposedly always-encrypted Eufy cameras were producing unencrypted streams — among other questions — we would publish a story about the company’s lack of answers.It worked.In a series of emails to The Verge, Anker has finally admitted its Eufy security cameras are not natively end-to-end encrypted — they can and did produce unencrypted video streams for Eufy’s web portal, like the ones we accessed from across the United States using an ordinary media player.But Anker says that’s now largely fixed. Every video stream request originating from Eufy’s web portal will now be end-to-end encrypted — like they are with Eufy’s app — and the company says it’s updating every single Eufy camera to use WebRTC, which is encrypted by default. Reading between the lines, though, it seems that these cameras could still produce unencrypted footage upon request.That’s not all Anker is disclosing today. The company has apologized for the lack of communication and promised to do better, confirming it’s bringing in outside security and penetration testing companies to audit Eufy’s practices, is in talks with a “leading and well-known security expert” to produce an independent report, is promising to create an official bug bounty program, and will launch a microsite in February to explain how its security works in more detail.Those independent audits and reports may be critical for Eufy to regain trust because of how the company has handled the findings of security researchers and journalists. It’s a little hard to take the company at its word! Billy Big Balls of the Week (31:34)FBI says it ‘hacked the hackers’ of a ransomware service, saving victims $130 millionThe Department of Justice announced this week that FBI agents successfully disrupted Hive, a notorious ransomware group, and prevented $130 million worth of ransom campaigns that targets no longer need to consider paying. While claiming the Hive group has been responsible for targeting over 1,500 victims in over 80 countries worldwide, the department now reveals it had infiltrated the group’s network for months before working with German and Netherlands officials to shut down Hive servers and websites this week.“Simply put, using lawful means, we hacked the hackers,” Deputy Attorney General Lisa Monaco remarked during a press conference.The FBI claims that by covertly hacking into Hive servers, it was able to quietly snatch up over 300 decryption keys and pass them back to victims whose data was locked up by the group. US Attorney General Merrick Garland said in his statement that in the last few months, the FBI used those decryption keys to unlock a Texas school district facing a $5 million ransom, a Louisiana hospital that had been asked for $3 million, and an unnamed food services company that faced a $10 million ransom. Industry News (37:32)Thriving Dark Web Trade in Fake Security CertificationsAlmost all Organizations are Working with Recently Breached VendorsGoogle Fi Confirms Data Breach, Hints At Link to T-Mobile HackCity of London on High Alert After Ransomware AttackResearchers Warn of Crypto Scam Apps on Apple App StoreLazarus Group Attack Identified After Operational Security FailWomen in CyberSecurity Calls for Participants for New Measuring Inclusion WorkshopsArnold Clark Confirms Customer Data Compromised in BreachThreat Actors Use ClickFunnels to Bypass Security Services Tweet of the Week (45:41) https://twitter.com/StateOfLinkedIn/status/1621258534062006276 Come on! Like and bloody well subscribe!

This week in InfoSec 10:35)With content liberated from the “today in infosec” twitter account and further afield16th January 1983: Lotus 1-2-3 Goes on SaleThe Lotus Development Corporation releases Lotus 1-2-3 for IBM computers. While not the first spreadsheet program, Lotus was able to develop 1-2-3 because the creators of VisiCalc, the first spreadsheet, did not patent their software. 1-2-3 outsold VisiCalc by the end of the year and 2 years later Lotus bought out the assets of VisiCalc and hired its main creator as a consultant.25th January 1979: Robot Kills Auto WorkerRobert Williams of Michigan was the first human to be killed by a robot. He was 25 years old. The accident at the Ford Motor Company resulted in a $10 million dollar lawsuit. The jury deliberated for two-and-a-half hours before announcing the decision against Unit Handling Systems, a division of Litton Industries. It ordered the manufacturer of the one-ton robot that killed Williams to pay his family $10 million. The robot was designed to retrieve parts from storage, but its work was deemed too slow. Williams was retrieving a part from a storage bin when the robot's arm hit him in the head, killing him instantly. In the suit, the family claimed the robot had no safety mechanisms, lacking even a warning noise to alert workers that it was nearby.21st January 1981: It Could Go at Least 88 MPHProduction of the iconic DeLorean DMC-12 sports car begins in Dunmurry, Northern Ireland. While not truly a technological achievement, the DeLorean became known as a symbol of the high-tech 1980’s.Daves - https://twitter.com/HackingDave/status/1458576672341516290?s=20&t=SfemFgw0mfQ_eeuljrj6EA   Rant of the Week (18:35)MSG probed over use of facial recognition to eject lawyers from show venuesThe operator of Madison Square Garden and Radio City Music Hall is being probed by New York's attorney general over the company's use of facial recognition technology to identify and exclude lawyers from events. AG Letitia James' office said the policy may violate civil rights laws.Because of the policy, lawyers who work for firms involved in litigation against MSG Entertainment Corp. can be denied entry to shows or sporting events, even when they have no direct involvement in any lawsuits against MSG. A lawyer who is subject to MSG's policy may buy a ticket to an event but be unable to get in because the MSG venues use facial recognition to identify them.In December, attorney Kelly Conlon was denied entry into Radio City Music Hall in New York when she accompanied her daughter's Girl Scout troop to a Rockettes show. Conlon wasn't personally involved in any lawsuits against MSG but is a lawyer for a firm that "has been involved in personal injury litigation against a restaurant venue now under the umbrella of MSG Entertainment," NBC New York reported.James' office sent a letter Tuesday to MSG Entertainment, noting reports that it "used facial recognition software to forbid all lawyers in all law firms representing clients engaged in any litigation against the Company from entering the Company's venues in New York, including the use of any season tickets.""We write to raise concerns that the Policy may violate the New York Civil Rights Law and other city, state, and federal laws prohibiting discrimination and retaliation for engaging in protected activity," Assistant AG Kyle Rapiñan of the Civil Rights Bureau wrote in the letter. "Such practices certainly run counter to the spirit and purpose of such laws, and laws promoting equal access to the courts: forbidding entry to lawyers representing clients who have engaged in litigation against the Company may dissuade such lawyers from taking on legitimate cases, including sexual harassment or employment discrimination claims."The AG's office also said it is concerned that "facial recognition software may be plagued with biases and false positives against people of color and women." The letter asked MSG Entertainment to respond by February 13 "to state the justifications for the Company's Policy and identify all efforts you are undertaking to ensure compliance with all applicable laws and that the Company's use of facial recognition technology will not lead to discrimination." Billy Big Balls of the Week  (32:11)DoNotPay Retires 'Robot Lawyer' Before It Even Has Its First CaseIf you’ve been fantasizing about the day when artificial intelligence could get you out of paying traffic tickets, you’ll just have to keep dreaming. DoNotPay has backed out of its plans to use an AI-powered “robot lawyer” to council a defendant through a courtroom hearing in real time. The reason why? Well, apparently the law got in the way of the robot’s lawyering. The company’s founder and CEO, Joshua Browder, first announced the news in a Wednesday tweet. “After receiving threats from State Bar prosecutors, it seems likely they will put me in jail for 6 months if I follow through with bringing a robot lawyer into a physical courtroom,” he wrote. In a phone call with Gizmodo, Browder reiterated his view that, were he to follow-through on his initial promises, he’d likely end up with a prison sentence.  Industry News (36:28) WhatsApp Hit with €5.5m fine for GDPR ViolationsNew Cheats May Emerge After Riot Games HackRegulator Stress Test Highlights Cyber Insurance ConcernsTicketmaster Claims Bot Attack Disrupted Taylor Swift Tour SalesYahoo Overtakes DHL As Most Impersonated Brand in Q4 2022North Korean Group TA444 Shows 'Startup' Culture, Tries Numerous Infection MethodsNCSC: Iranian and Russian Groups Targeting Government, Activists and Journalists With SpearphishingZacks Investment Research Confirms Breach Affecting 820,000 CustomersIranian Group Cobalt Sapling Targets Saudi Arabia With New Personahttps://scambusters.org/scambusters19.html  Tweet of the Week (44:18)https://twitter.com/cybergibbons/status/1618672522853240833 Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield19th January 1999: BlackBerry IntroducedRIM introduces the BlackBerry. The original BlackBerry devices were not phones, but instead were the first mobile devices that could do real-time e-mail. They looked like big pagers. They way the story goes, the name “BlackBerry” came from the similarity that the buttons on the original device had to the surface of a blackberry fruit. Those crazy Canadians!17th January 1994: Supreme Court Rules on Home VCR RecordingsThe US Supreme Court rules 5-4 that private use of home VCRs to tape TV programs for later viewing does not violate federal copyright laws. This ruling opens the floodgate for VCR sales, changing the landscape of TV watching forever. Rant of the WeekMailchimp 'fesses up to second digital burglary in five monthsEmail marketing service Mailchimp has confirmed intruders have gained access to more than 100 customer accounts after successfully deploying a social engineering attack.This is the second data spill in five months and yet the company, bought by Intuit for $12 billion in September 2021, continues to tell customers – with a straight face – that it takes the "security of users' data seriously."The latest digital burglary happened on January 11 when the resident security team spotted an "unauthorized actor accessing one of our tools used by Mailchimp customer-facing teams for customer support and account administration," the company blog states. Billy Big Balls of the WeekIllegal Solaris darknet market hijacked by competitor KrakenSolaris, a large darknet marketplace focused on drugs and illegal substances, has been taken over by a smaller competitor named 'Kraken,' who claims to have hacked it on January 13, 2022.The Tor site of Solaris currently redirects to Kraken, while blockchain monitoring experts at Elliptic report no movements in the cryptocurrency addresses associated with the site after January 13, 2022.Taking down competitorsSolaris was a Russian-speaking platform reportedly affiliated with Killnet, a pro-Kremlin hacktivist group that launched several DDoS attacks against organizations in the western world in 2022.Elliptic has traced several donations from Solaris to Killnet, amounting to more than $44,000 worth of Bitcoin. The DDoS group presumably used this money to purchase more firepower for launching disruptive attacks.In December 2022, Ukrainian cyber-intelligence analyst Alex Holden claimed to have breached Solaris and stolen $25,000, which was donated to a humanitarian charity in Ukraine.While Solaris disputed the claims about the hack and called out the lack of evidence, Holden later released more details and leaked source code and databases allegedly associated with the marketplace.On Friday, January 13, 2023, Kraken announced they had taken over Solaris' infrastructure, GitLab repository, and all project sources, thanks to "several huge bugs in the code."Kraken's statement claims that it took them three days to steal the clear text passwords and keys stored in Solaris' servers, access its infrastructure located in Finland, and then download everything without anyone stopping them.Finally, the attackers said they disabled Solaris' Bitcoin server, which aligns with Elliptic's observations in the blockchain. Industry NewsEuropean Businesses Admit Major Privacy Skills GapNissan Supplier Leaked Data on Thousands of CustomersChatGPT Creates Polymorphic Malware1000 Shipping Vessels Impacted by Ransomware AttackOver Four Billion People Affected By Internet Censorship in 2022FTX: Over $400m Stolen from Bankrupt ExchangeMailchimp Hit By Another Data Breach Following Employee HackThreatModeler Makes DevSecOps More Accessible With New MarketplaceRoaming Mantis' Hacking Campaign Adds DNS Changer to Mobile App Tweet of the Week  These are the Google searches Brian Walshe made before and after killing his wife Ana Walshe, according to prosecutorshttps://twitter.com/pedramamini/status/1616257197591109633?s=20&t=gQIsTkL_9exHYNvkcVyokg  Come on! Like and bloody well subscribe!

This week in InfoSec (09:55)With content liberated from the “today in infosec” twitter account and further afield12th January 1996: Apple posts major lossApple Computer announces that it will post a US$68 million first quarter loss. It also announces a restructuring plan to reduce the company by a thousand employees. This event leads to the resignation of Apple CEO Michael Spindler, who is replaced by Gil Amelio. Gil Amelio eventually purchases Steve Jobs’ company, NeXT, which leads to the development of Mac OS X as well as the return of Steve Jobs as Apple CEO.9th January 2007: Apple introduces iPhoneApple introduces the iPhone at Macworld. The phone wasn’t available for sale until June 29th, prompting one of the most heavily anticipated sales launches in the history of technology. Apple sold 1.4 million iPhones in 2007, steadily increasing each year to sell over 230 million in 2015 alone Rant of the Week (17:25)Royal Mail, cops probe 'cyber incident' that's knackered international mailRoyal Mail confirmed a "cyber incident" has disrupted its ability to send letters and packages abroad, and also caused some delays on post coming into the UK.The postal service, and the UK's National Cyber Security Centre and National Crime Agency, issued similar statements about the IT SNAFU on Wednesday, with Royal Mail advising customers to stop sending international mail until it fixed the problem."We're experiencing disruption to our international export services and are temporarily unable to dispatch items to overseas destinations," the organisation tweeted. "We strongly advise customers to hold any export items while we work to resolve the issue." Royal Mail added it was "sorry for any disruption this may cause," and would not comment further. This is a developing story; we'll keep you updated as we confirm any other details.Lockbit Ransomware - It was Russia!Royal Mail hit by Russia-linked ransomware attack Billy Big Balls of the Week (27:24)VALL-E AI can mimic a person’s voice from a three-second snippetMicrosoft researchers are working on a text-to-speech (TTS) model that can mimic a person's voice – complete with emotion and intonation – after a mere three seconds of training.The technology – called VALL-E and outlined in a 15-page research paper released this month on the arXiv research site – is a significant step forward for Microsoft. TTS is a highly competitive niche that includes other heavyweights such as Google, Amazon, and Meta.Redmond is already using artificial intelligence for natural language processing (NLP) through its Nuance business – which it bought for $20 billion last year including both speech recognition and TTS technology. And it's aggressively investing in and using technology from startup OpenAI – including its ChatGPT tool – possibly in its Bing search engine and its Office suite of applications.A demo of VALL-E can be found on GitHub.Semi-related - Microsoft Will Likely Invest $10 billion for 49 Percent Stake in OpenAIThis after the report by The Information about how Microsoft plans to integrate ChatGPT and GPT-4 into its software bundles like Word, Outlook, Bing and so forth. Industry News (33:40)UK Charities Offered Free Cyber Essentials SupportUS Supreme Court Allows WhatsApp to Sue NSO GroupSensitive Files From San Francisco Transit Police Allegedly LeakedGitHub Adds Features to Automate Vulnerability Code ScanningNew APT Dark Pink Hits Asia-Pacific, Europe With Spear Phishing TacticsRoyal Mail Halts International Deliveries After Cyber-IncidentTwitter: Leak of 200 Million Accounts Not Due to Historic BugGoogle Chrome 'SymStealer' Vulnerability Could Affect 2.5 Billion UsersThe Guardian Confirms UK Staff Data Was Accessed in Ransomware Attack Tweet of the Week (42:50)https://twitter.com/IanColdwater/status/1613690189246828544 Come on! Like and bloody well subscribe!

This week in InfoSec (07:15)With content liberated from the “today in infosec” twitter account and further afield3rd January 2009: The Genesis of BitcoinThe pseudonymous Bitcoin creator Satoshi Nakamoto mines the first 50 bitcoins, now known as the Genesis Block, six days before the initial release of the bitcoin software and launch of the cryptocurrency network. Bitcoin has become the de-facto digital currency, popular for its decentralized approach because no single entity can control, manipulate, or deactivate the currency and transactions can be highly private yet still remain secure.1st January 2000: Y2K Comes and GoesAfter years of hysteria regarding the Y2K bug, the world’s computers begin using the date 2000 with no major catastrophes. There is still debate whether the “Year 2000 Problem” was overblown by the technology industry or if the frantic updating done by armies of software developers leading up to Y2K averted disaster. I tend to lean towards the latter.Wrap up of the year:https://www.computing.co.uk/news/4061865/cyber-computings-biggest-security-stories-2022 Rant of the Week (17:02)ChatGPT banned in NYC schools over learning impact concernsThe NYC Department of Education has banned the use of ChatGPT by students and teachers in New York City schools as there are serious concerns about its use hampering learning and leading to misinformation.The organization manages the largest school district in the U.S., so others might follow with similar decisions.ChatGPT is a next-gen chatbot optimized for dialogue-format user interactions, released by OpenAI in November 2022. The chatbot has been very disruptive for several disciplines, including programming and essay writing.Another field that AI-based chatbots like ChatGPT are expected to revolutionize is internet searching, as those tools can provide richer answers to search terms and allow users to find what they're looking for using natural language.Microsoft is reportedly planning to integrate ChatGPT into Bing to give its search engine an edge over competitors like Google Search.NYC Dept. of Education is worried about the information that ChatGPT may convey to students, specifically the safety and accuracy of its answers. Moreover, the organization fears young students will grow complacent and lack the necessary skills to evaluate information. Billy Big Balls of the Week (27:01)WhatsApp adds proxy support to help bypass Internet blocksWhatsApp now allows users to connect via proxy servers due to Internet shutdowns or if their governments block the service in their country.The new proxy support option is available to all users running the latest WhatsApp iOS and Android applications.WhatsApp said that connecting through a proxy will maintain the messages' privacy and security as they will remain protected by end-to-end encryption.This ensures that they can only be read by you and the recipient, with no one in between, like the proxy server, Meta, or WhatsApp, being able to access their contents.[All this while the outcome of their use of personal data on WhatsApp in Ireland is still awaiting a decision from the courts after they were fined €390 million ($414 million) for misuse of data from Facebook and Instagram]"Using a proxy doesn't change the high level of privacy and security that WhatsApp provides to all users. Your personal messages and calls will still be protected by end-to-end encryption," the company said on Thursday."Our wish for 2023 is that these internet shutdowns never occur. Disruptions like we've seen in Iran for months on end deny people's human rights and cut people off from receiving urgent help," WhatsApp said."Though in case these shutdowns continue, we hope this solution helps people wherever there is a need for secure and reliable communication." Industry News (38:39)LockBit Hands Ransomware Decryptor to Kids' HospitalNHS is Most Scammed UK Government "Brand"General Electric Insider Handed Two Years for IP TheftRail Tech Giant Wabtec Discloses Global Data BreachMeta to Appeal €390m GDPR FineCops Catch Serial Child Abuser After Tech BreakthroughOver 200 Million Twitter Users' Details Leaked on Hacker ForumFive Guys Discloses Data Breach Affecting Employee PIIHackers Leverage Compromised Fortinet Devices to Distribute Ransomwarehttps://www.bbc.com/news/uk-england-gloucestershire-63637883 Tweet of the Week (45:53)https://twitter.com/igb/status/1611057796606488577 Come on! Like and bloody well subscribe!

This week in InfoSec (09:44)With content liberated from the “today in infosec” twitter account and further afield15th December 1995: AltaVista LaunchesDeveloped by researchers at Digital Equipment Research Laboratories, the AltaVista search engine is launched. It was the first world wide web search service to gain significant popularity. One of the most popular search engines in the early world wide web, Google didn’t overtake AltaVista until 2001. AltaVista was eventually purchased by Yahoo! in 2003.11th December 1989: Joseph Lewis Popp allegedly mailed floppy disks to the UK which were labelled "AIDS Information Introductory Diskette". Surprise! The AIDS trojan on the disks demanded $189 to "renew the licence" by sending payment to a post office box in Panama. Virus Bulletinhttps://twitter.com/todayininfosec/status/1469660348928167943 Rant of the Week (17:02)Internal Note: [You’ll need to read this story first for background if you’re not familiar - Rackspace confirms ransomware attack behind days-long email meltdown]On the 12th day of the Rackspace email disaster, it did not give to me …… a working Exchange inbox treeThere's no end – or restored data – in sight for some Rackspace customers now on day 12 of the company's ransomware-induced hosted Exchange email outage.In the service provider's most recent update, posted at 0844 Eastern Time on Wednesday, Rackspace said it had hired CrowdStrike to investigate the fiasco, and noted it continues "to make all of our internal and external resources available to provide support to the remaining Hosted Exchange customers."Rackspace did not, however, say if or when it expects to recover people's data that was lost or scrambled when ransomware hit its systems – an attack that took down some of Rackspace's hosted Microsoft Exchange services on December 2. Since then, affected customers have been unable to get at their data held in the hosted service."We understand how important data recovery is to our customers," Rackspace wrote. "In ransomware attacks, data recovery efforts do necessarily take significant time, both due to the nature of the attack and need to follow additional security protocols. We will continue to keep you updated on these efforts." Billy Big Balls of the Week (27:19)SEC charges crew of social media influencers with $100m fraudEight braggadocious social media influencers fond of posing next to sportscars are facing charges from the US Securities and Exchange Commission (SEC) and Department of Justice (DoJ), who claim they manipulated their 1.5 million followers in order to help themselves to $100 million in "fraudulent profits."The suspects, all men in their twenties and thirties, were charged with conspiracy to commit securities fraud in connection with a long-running, social media-based "pump and dump" scheme, a recently unsealed Texas federal grand jury indictment [PDF] and an SEC complaint [PDF] revealed.The SEC alleged the suspects used Twitter and Discord to manipulate exchange-traded stocks in a $100 million securities fraud scheme, detailing some pretty amusing excerpts from exchanges it claims took place between individuals in the group.We're robbing f*cking idiots of their money. . .The commission claimed the defendants sometimes discussed their scheme over Discord voice chats that they "believed were private, but which were in fact being recorded."ORHere's something communism is good at: Making smartphones less annoyingThis week the kings of the Middle Kingdom issued directives to address some of the biggest annoyances associated with smartphones applications: copycat apps and bloatware.On Monday the Cyberspace Administration of China (CAC) launched a campaign it said would "rectify chaos" in smartphone apps by cracking down on several behaviors such as publication of "copycat apps" that use logos, pictures or text similar to existing apps to deceive users and potentially collect personal data and app subscription fees.The CAC also also plans to rectify dodgy ranking practices, and apps that lure people in with sexually suggestive or vulgar home pages. Apps distributed by QR code, rather than through app stores, are also in trouble.But wait, there's more! CAC will prevent auto downloads or installations without user consent. Apps that misrepresent their function or content are in the firing line as well.As are apps that tempt users with promises of making money.Excessive pop-ups, functions that serve as an obstacle to removing apps or forced renewals, and fake free trials are all on their way out.In the usual style of the CAC, the regulator did not specify how it would accomplish its goals, instead using phrases like "severely punish," "strictly regulate," and "crack down."Given the Authoritarian nature of the regime, though, these terms should be taken pretty much at face value. Industry News (35:12)North Korean Hackers Impersonate Researchers to Steal IntelHSE Cyber-Attack Costs Ireland $83m So FarSecurity Overlooked in Rush to Hybrid WorkingExperts Warn ChatGPT Could Democratize CybercrimeUber Hit By New Data Breach After Attack on Third-Party VendorTwitter Addresses November Data Leak ClaimsSigned Microsoft Drivers Used in Attacks Against BusinessesLoan Scam Campaign 'MoneyMonger' Exploits Flutter to Hide MalwareSenate Approves Bill Banning TikTok From US Government Devices Tweet of the Week (44:05)https://twitter.com/davenewworld_2/status/1603107286960029696 Come on! Like and bloody well subscribe!

This week in InfoSec (11:40)With content liberated from the “today in infosec” twitter account and further afield7th December 1999: RIAA Sues NapsterThe Recording Industry Association of America sues the peer-to-peer file sharing service Napster alleging copyright infringement for allowing users to download copyrighted music for free. The RIAA would eventually win injunctions against Napster forcing the service to suspend operations and eventually file bankruptcy. In the end the RIAA and its members would settle with Napster’s financial backers for hundreds of millions of dollars.While the case was ostensibly about copyright violations, the bigger picture for the RIAA was also about control. The recording industry in general was caught with its pants down when it came to digital music and the Internet. They were not prepared for the sudden popularity of digital music downloads that Napster introduced and were not ready with a model to monetise downloaded music. This lawsuit, along with future lawsuits targeting individuals, was intended to squash the practice of downloading music as much as it was to recover compensation. However, the practice of downloading music could not be stopped as other non-centralised peer-to-peer file sharing services popped up in place of Napster. 4th December 2001: Goner Worm Hits the InternetDisguised as a screen saver and spread through an infected user’s Microsoft Outlook e-mail software, the Goner worm spreads through the Internet at a pace second only to the Love Bug virus the previous year. Goner was estimated to cause about $80 million dollars in damage. Rant of the Week (20:41)Egad, did Apple do something right? End-to-end encryption for (most) iCloud servicesApple says it will provide end-to-end encryption for most iCloud services, having abandoned its previously announced – and then quietly shelved – plan to check the legality of on-device photos prior to cloud synchronisation.Cupertino announced three security enhancements on Wednesday, one of which it calls Advanced Data Protection. "Advanced Data Protection is Apple's highest level of cloud data security, giving users the choice to protect the vast majority of their most sensitive iCloud data with end-to-end encryption so that it can only be decrypted on their trusted devices," explained Ivan Krstić, Apple’s head of security engineering and architecture, in a canned statement.Apple already offers end-to-end (E2E) encryption by default for 14 iCloud services, including passwords in iCloud Keychain and Health data. But the iBiz has not made E2E encryption broadly available for iCloud, preferring instead to retain access to a significant amount of the customer data on company servers. That has suited law enforcement authorities, who continue to worry aloud about being left in the dark by encryption. Billy Big balls of the Week (31:57)Brief update on last week's story: San Francisco terminates explosive killer cop botsSan Francisco legislators this week changed course on their killer robot policy, banning the police from using remote-control bots fitted with explosives. For now.On Tuesday, the city's Board of Supervisors voted unanimously to explicitly prohibit lethal force by police robots following a public backlash and worldwide media attention. Under a previously approved policy, SF police robots under human control could have used explosives to kill suspects. The droids were not allowed to use guns.States label TikTok 'a malicious and menacing threat'Two more US states have launched aggressive action against made-in-China social media app TikTok.Texas on Wednesday banned the app from government devices, with governor Greg Abbott ordering [PDF] the ban "to protect sensitive information and critical infrastructure from TikTok.""TikTok harvests vast amounts of data from its users' devices – including when, where, and how they conduct internet activity – and offers this trove of potentially sensitive information to the Chinese government," Abbott wrote.Which is tame compared to the actions and language used by Indiana's attorney-general, who has decided to sue the Chinese social media platform – twice!TikTok's Chinese analog, Douyin, contains many more safeguards – including required youth modes, real name authentications, bans on minors viewing live broadcasts, prevention of salacious material and restrictions on how long and when minors can access the app. Chinese users under the age of 14 are limited to 40 minutes of daily use, between 0600 and 2200. Users in the US have no limit and spend an average of 99 minutes per day on TikTok, according to the office of the AG."In short, TikTok poses known risks to young teens that TikTok's parent company itself finds inappropriate for Chinese users who are the same age," argues the complaint. Industry News (38:41) Gen Z Internet Users "Normalize" Cybercrime - ReportSwiss Government Wants to Implement Mandatory Duty to Report Cyber-AttacksSupply Chain Web Skimming Attacks Hit Dozens of SitesRussia's VTB Bank Suffers its Biggest Ever DDoSICO Fines Rogue Nuisance Callers £500,000UK Government Department Using Unsupported Applications, Reveals WatchdogNZ Privacy Commissioner Investigates Mercury IT Ransomware AttackPet Dog Unmasks Drug Trafficker on Encrypted ChatApple Introduces New Data Protections to Increase Cloud Security Tweet of the Week (46:07)   https://twitter.com/_noid_/status/1600135215225053184https://twitter.com/jomc/status/1600637738352627713   Come on! Like and bloody well subscribe!

This week in InfoSec (06:17)With content liberated from the “today in infosec” twitter account and further afield27th November 1995: Microsoft Shipped Internet Explorer 2.0Microsoft Corp. shipped Internet Explorer 2.0, starting a browser war with the popular Netscape Navigator. Netscape Communications Corp. had had a virtual monopoly on World Wide Web browsers since the infancy of the web. The Netscape Navigator and Communicator browsers serve as a format for viewing and creating World Wide Web pages, as well as participating in newsgroups and sending e-mail. Microsoft promoted its Internet Explorer with specific mention of its privacy and encryption features (such as support for SSL).  Chrome browser has a New Year’s resolution: HTTPS by default (2020)24th November 2014: The Washington Post published an article which included a picture of TSA master keys. As a result, a short time later functional keys were 3-d printed using the [unblurred] key patterns displayed in the picture.The secret life of baggage: Where does your luggage go at the airport? (Image since changed)https://twitter.com/todayininfosec/status/1198722561355337728 Rant of the Week (18:41)Australia will now fine firms up to AU$50 million for data breachesThe Australian parliament has approved a bill to amend the country's privacy legislation, significantly increasing the maximum penalties to AU$50 million for companies and data controllers who suffered large-scale data breaches.The financial penalty introduced by the new bill is set to whichever is greater:AU$50 million [Approximately $34m USD for context]Three times the value of any benefit obtained through the misuse of information30% of a company's adjusted turnover in the relevant periodPreviously, the penalty for severe data exposures was AU$2.22 million, considered wholly inadequate to incentivize companies to improve their data security mechanisms.The new bill comes in response to a series of recent cyberattacks against Australian companies, including ransomware and network breaches, resulting in the exposure of highly sensitive data for millions of people in the country."The Albanese Labor government has wasted no time in responding to recent major data breaches. We have announced, introduced, and delivered legislation in just over a month," reads the media announcement."These new, larger penalties send a clear message to large companies that they must do better to protect the data they collect."The most notable incidents were the Optus telecommunication provider data breach that impacted 11 million people and the Medibank insurance firm ransomware attack that exposed the data of 9.7 million.Apart from setting higher fines, the new bill also gives greater powers to the Office of the Australian Information Commissioner (OAIC) to get more involved in the privacy breach resolution and scope determination process.  Billy Big Balls of the Week (28:19)San Francisco lawmakers approve lethal robots, but they can't carry gunsSan Francisco police can deploy so-called "killer robots" following a Board of Supervisors' vote on Tuesday, clearing the cops to use robots equipped with explosives in extreme situations.The robots primarily will be used to neutralize and dispose of bombs, and provide video reconnaissance, according to San Francisco Supervisor Rafael Mandelman. He added that none of the robots will carry guns, "and SFPD has no plans to attach firearms," in a Twitter thread after the vote. "However, in extreme circumstances it is conceivable that use of a robot might be the best and only way of dealing with a terrorist or mass shooter," Mandelman said.Such a situation has happened before. In July 2016 a mass-shooting incident left five police officers dead and another 11 people wounded, and the suspect was cornered in a local building. Police strapped an explosive charge onto a bomb-disposal robot, which detonated near the suspect, killing him.[One particular comment on this which made me chuckle was: “Considering American cops can't even go into an active shooter situation to save schoolchildren, I assume this will be the first course of action for anything above a parking ticket.”] - *Shots fired* (but not by the Texas police) Industry News (34:48)Experts Find 16,000+ Scam FIFA World Cup DomainsIreland’s DPC Fines Meta €265m Following Large-Scale Data LeakLet's Encrypt Issues Three Billionth CertificateAustralian Parliament Passes Privacy Penalty BillMajority of US Defense Contractors Not Meeting Basic Cybersecurity RequirementsResearchers Accidentally Crash Cryptomining BotnetEight Charged with $30m Unemployment Benefits FraudUK Extends NIS Regulations to IT Managed Service ProvidersWhatsApp Files on Dark Web Show Millions of Records For Sale Tweet of the Week (43:40)https://twitter.com/hackinarticles/status/1597820497856643072 Come on! Like and bloody well subscribe!

This week in InfoSec (11:48)With content liberated from the “today in infosec” twitter account and further afield24th November 1998: AOL announces it will buy Netscape CommunicationsAOL announces it will buy Netscape Communications in a stock-for-stock deal worth approximately $4.2 billion. At the time it was considered a good move by AOL and Netscape to merge forces to better compete with Microsoft in the browser and Internet provider markets. However, Microsoft’s dominance in the personal computer market could not be stopped and the Netscape browser lost almost all market share to Internet Explorer. In 2003 Microsoft settled a monopoly lawsuit with AOL (then merged with Time Warner) for $750 million over the loss of value of Netscape. AOL itself, once a dominant Internet Service Provider, slowly lost their subscriber base with the evolution of broadband Internet in the 2000’s and operates primarily as a media conglomerate, although their dial-up service still subscribes approximately 2 million users as of 2013.  In 2015 that went up to 2.1 million but is now reported to be in the thousands.  21st November 2017: It was reported that Uber had concealed a massive hack that exposed data of 57m users and drivers 13 months previously Rant of the Week (17:17)Tax filing websites have been sending users’ financial information to FacebookMajor tax filing services such as H&R Block, TaxAct, and TaxSlayer have been quietly transmitting sensitive financial information to Facebook when Americans file their taxes online, The Markup has learned.The data, sent through widely used code called the Meta Pixel, includes not only information like names and email addresses but often even more detailed information, including data on users’ income, filing status, refund amounts, and dependents’ college scholarship amounts. The information sent to Facebook can be used by the company to power its advertising algorithms and is gathered regardless of whether the person using the tax filing service has an account on Facebook or other platforms operated by its owner Meta.  Billy Big Balls of the Week (25:37)Meta links US military to fake social media influence campaignsIn its latest quarterly threat report, Meta said it had detected and disrupted influence operations originating in the US, and it calls out those it believes are responsible: the American military.Meta said it picked up on three major covert influence operations on its platforms in the third quarter of the year, the first of which originated in the United States.Meta previously reported on secretive influence ops being performed by the US in August, but didn't specify anything about its observations at the time outside of saying they originated within the country.Now, however, the social media giant is getting more specific. "Although the people behind this operation attempted to conceal their identities and coordination, our investigation found links to individuals associated with the US military," Meta said in the report [PDF]. Police text 70,000 victims in UK's biggest anti-fraud operationDetectives have begun contacting 70,000 people suspected of being victims of a sophisticated banking scam.The Metropolitan Police is sending text messages to mobile phone users it believes spoke with fraudsters pretending to be their bank.Met Commissioner Sir Mark Rowley described an "enormous endeavour" in gathering evidence after the discovery of an online fraud network.There have been more than 100 arrests so far, and one man has been charged.People who receive a text message in the next 24 hours will be directed to the Action Fraud website to register their details as officers build cases against suspects.The scam involved fraudsters calling people at random, pretending to be a bank and warning of suspicious activity on their account.They would pose as employees of banks including Barclays, Santander, HSBC, Lloyds, Halifax, First Direct, NatWest, Nationwide and TSB.The fraudsters would then encourage people to disclose security information and, through technology, they may have accessed features such as one-time passcodes to clear accounts of funds.As many as 200,000 people in the UK may have been victims of the scam, police said, with victims losing thousands of pounds, and in one case £3m. Industry News (32:27)Experts Warn Threat Actors May Abuse Red Team Tool NighthawkUK Privacy Tsar Defends Controversial Enforcement StrategyMeta Removes Pro-US Accounts in Middle East and Central AsiaPanaseer Launches Guidance on Security Controls Ahead of EU's New LegislationRussian DDoS Briefly Downs European Parliament SiteUK Cops Lead Action Against Fraud Site that Made £100m+Cyber Essentials Scheme Set for April 2023 UpdateSonder confirms data breach, documents and other PII potentially compromisedSharkBot Malware Found in Android File Manager Apps With Thousands of Downloads Tweet of the Week (40:45)https://twitter.com/TheCollierJam/status/1595388389972496386 Come on! Like and bloody well subscribe!

This week in InfoSec (07:14)With content liberated from the “today in infosec” twitter account and further afield12th November 2000 Microsoft Declares Tablets Are the FutureBill Gates demonstrates a functional prototype of a Tablet PC. Microsoft claims “the Tablet PC will represent the next major evolution in PC design and functionality.” However, the Tablet PC initiative never really took off and it wasn't until Apple introduced the iPad in 2010 that tablet computing was widely adopted.17th November 2018: US President Donald Trump signed a bill into law, approving the creation of the Cybersecurity and Infrastructure Security Agency (CISA). The bill was the CISA Act.Trump signs bill that creates the Cybersecurity and Infrastructure Security Agencyhttps://twitter.com/todayininfosec/status/1328528180500717568 Rant of the Week (18:44)Germany says nein to Qatari World Cup spyware, err, appsWorld Cup apps from the Qatari government collect more personal information than they need to, according to Germany's data protection agency, which this week warned football fans to only install the two apps "if it is absolutely necessary." Also: consider using a burner phone.The two apps are Ehteraz, a Covid-19 tracker from the Qatari Ministry of Public Health, and Hayya from the government's Supreme Committee for Delivery & Legacy overseeing the Cup locally, which allows ticket holders entry into the stadiums and access to free metro and bus transportation services.Norway's data protection agency, meanwhile, this week said it was "alarmed by the extensive access the apps require" and warned that Qatari authorities likely use the apps to monitors' users location, in addition to snooping through personal data.See also: World Cup apps pose a data security and privacy nightmare Billy Big Balls of the Week (29:05)Australia to 'stand up and punch back' against cyber crimsAustralia's government has declared the nation is planning to go on the offensive against international cyber crooks following recent high-profile attacks on local health insurer Medibank and telco Optus.The aggressive posture was expressed in the announcement of a "Joint standing operation" that will see the Australian Federal Police and the Australian Signals Directorate (Australia's GCHQ/NSA analog) run a team with a mission "to investigate, target and disrupt cyber-criminal syndicates with a priority on ransomware threat groups."Minister for Home Affairs and Cyber Security Clare O'Neil said the operation will "scour the world, hunt down the criminal syndicates and gangs who are targeting Australia in cyber-attacks, and disrupt their efforts.""This is Australia standing up and punching back," she said during an interview on local political talking heads program Insiders. "We are not going to sit back while our citizens are treated like this and allow there to be no consequences for that."O'Neill said the operation will "for the first time [be] offensively attacking these people." Industry News (36:10)T: Google to Pay $392m in Landmark Privacy CaseA: Billbug Targets Government Agencies in Multiple Asian CountriesJ: Euro Authorities Warn World Cup Fans Over Qatari AppsT: Majority of Companies Reduce Cybersecurity Staff Over HolidaysA: Chinese Spy Gets 20 Years for Aviation Espionage PlotJ: US: Iranian Hackers Breached Government with Log4ShellT: More Than Half of Black Friday Spam Emails Are ScamsA: Hundreds of Amazon RDS Snapshots Discovered Leaking Users' DataJ: Zeus Botnet Suspected Leader Arrested in Geneva Tweet of the Week (43:30)https://twitter.com/attritionorg/status/1593487371819192321https://twitter.com/SoVeryBritish/status/1592554974432866306 Come on! Like and bloody well subscribe!

This week in InfoSec (08:27)With content liberated from the “today in infosec” twitter account and further afield4th November 2005: Microsoft AntiSpyware was renamed Windows Defender. https://twitter.com/todayininfosec/status/11914785556343234565th November 1993: The Bugtraq mailing list was created by Scott Chasin.In 1995 it became the property of SecurityFocus, in 2002 Symantec acquired SecurityFocus, and the last message was posted to the list on February 25th, 2020, with no explanation from Symantec.Bugtraqhttps://twitter.com/todayininfosec/status/1324497907245109248    Rant of the Week (16:17)Twitter Chief Information Security Officer flies the coopTroubled social media giant Twitter has lost the services of its chief information and security officer to cap off another chaotic week following its acquisition by Elon Musk.Lea Kissner used their former employer’s platform to post: “I've made the hard decision to leave Twitter. I've had the opportunity to work with amazing people and I'm so proud of the privacy, security, and IT teams and the work we've done.”They later posted, “I've loved this job and we got *so* much done, but here we are.”Chief privacy officer Damien Kieran and chief compliance officer Marianne Fogarty are also said to have exited. And, separately, it's reported that the world's richest man has told Twitter staff that work-from-home is banned, and that tweeps need to work 40 or more hours a week from the office from now on.Blue Badge ScamsIf you teach your user base, verification means something specific, it will be hard for them to unlearn it. We learned that it's rare for a verified account trying to phish us. Changing the meaning of the check is a security issue.Blue Badge impersonationsThe new check mark system has resulted in Threat Actors successfully impersonating Twitter and defrauding users out of moneyAlthough the account is now suspended, it rapidly got 35,000+ retweets and 4,990 likes.A simple $8 investment can result in thousands of dollars stolen.Self-certifying complianceThe idea of engineers self-certifying compliance with an FTC consent decree jumped out to me as patently absurd. So I found and read the consent decree. This thread discusses how this policy violates that decree and why I believe these people had no option but to resign.   Billy Big Balls of the Week (27:14)Apple limits AirDrop in China after its use in protestsApple has placed time restrictions on AirDrop wireless file-sharing across iPhones in China after the feature was used by protesters to share images opposing the Chinese government, Bloomberg reports.The “Everyone” option in Airdrop is now limited to a ten-minute window for users in China. After the ten minutes have passed, AirDrop’s device-to-device sharing will switch back to “Contacts Only,” making it harder to distribute content to strangers en masse. These new time restrictions have been introduced by Apple just weeks after the service was used to spread posters opposing president Xi Jinping.The AirDrop restriction was included in the public release of iOS 16.1.1 on Wednesday, despite nothing about it being mentioned in the release notes. 9to5Mac readers were quick to discover that the restrictions seem limited to iPhones purchased in China. Industry News (34:38)Medibank Refuses to Pay Ransom After Data BreachSwiss Re: Cyber-Insurance Industry Must ReformSEC Announces 'Enforcement Action' For SolarWinds Over 2020 HackInstagram Influencer Gets 11 Years for Money LaunderingMedibank Confirms Data Stolen in Breach is Now Available OnlineCouple Get 40 Years for Navy Espionage PlotMalware Redirects 15,000 Sites in Malicious SEO CampaignMajority of Security Managers Lack Threat Intelligence SkillsNew Lenovo Notebook Models Affected By UEFI Firmware Vulnerabilities Tweet of the Week (42:54)https://twitter.com/Ox4d5a/status/1590578121526611968 Come on! Like and bloody well subscribe!

This week in InfoSec3rd November 2000: A Dutch hacker gained access to Microsoft's network by exploiting a vulnerability Microsoft issued a patch for 10 weeks earlier. The Patch MS Forgot to Applyhttps://twitter.com/todayininfosec/status/132380788942589542425th October 2013: Adobe revealed that a breach of 2.9 million customer accounts made public 3 weeks earlier actually affected 38 million users.Adobe breach THIRTEEN times worse than thought, 38 million users affectedhttps://twitter.com/todayininfosec/status/1323807889425895424   Rant of the WeekGovernment by Gmail catches up with UK minister... who is reappointed anywayThe UK's Home Secretary – the minister in charge of policing and internal security – has been forced to apologize for breaching IT security protocols in government.Suella Braverman, who had already resigned for the breach, was reinstated in the UK's merry-go-round approach to government. She has written to the chair of Parliament's Home Affairs Select Committee to explain her actions and how she planned to avoid repeating them. Billy Big Balls of the Week The Hunter Cat is a bodyguard for your credit card (not an advert)See if this sounds familiar: You are in a weird part of town and get cash from a sketchy ATM. The next day, you pay for gas at a pump-side terminal that doesn’t look quite right.Against such a common problem, what are your options? For the particularly paranoid, enter the Hunter Cat. Pranksters posing as laid-off Twitter employees trick media outlets: ‘Rahul Ligma’A pair of pranksters posing as laid-off Twitter employees tricked multiple media outlets Friday as the public anxiously awaited news on whether Elon Musk had begun axing staffers.CNBC’s Deirdre Bosa interviewed two people who identified themselves as Twitter employees and were seen near the company’s San Francisco headquarters carrying cardboard boxes.Skepticism immediately emerged on social media. One of the pranksters said his name was “Rahul Ligma” — a reference to a popular internet meme — and held a copy of Michelle Obama’s book “Becoming” aloft while speaking to reporters. The other said his name was “Daniel Johnson.”Industry NewsRussia Suspected in Truss Phone Hacking ScandalOpenSSL Security Advisory Downgraded to High SeverityTwitter Verified Status Users Flooded with ScamsMobile Phishing Attacks on Government Staff SoarDropbox Suffers Breach, 130 GitHub Repositories CompromisedAndroid Apps With a Million Downloads Led Users to Phishing SitesThreat Actor "OPERA1ER" Steals Millions from Banks and TelcosUK Security Agency to Scan the Country for BugsBot Warning for Retailers Ahead of Busy Shopping SeasonTweet of the Weekhttps://twitter.com/Joelmpetlin/status/1587417968664752129   Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield29th October 1969: The first message sent over the ARPANET was from Leonard Kleinrock’s UCLA computer, sent by student programmer Charley Kline at 10:30 PM to the second node at Stanford Research Institute’s computer in Menlo Park, California.The message was simply "Lo." But not on purpose.How a simple ‘hello’ became the first message sent via the Internethttps://twitter.com/todayininfosec/status/118931809415140966625th October 2001: Microsoft releases the operating system Windows XP, the successor to both Windows 2000 and Windows ME. Designed to unify the Windows NT line and Windows 95 line of operating systems, Windows XP was not replaced by Microsoft until January 2007 with Windows Vista. However, with a nearly six-year run and the public debacle surrounding the release of Windows Vista, Windows XP remained the world’s most popular operating system until August 2012. Rant of the WeekAn ex-TikTok moderator, who was paid $10 a day and had to scroll through child abuse and gun violence, was required to keep her webcam on all night, report saysA Colombian ex-moderator for TikTok said she was required to keep her webcam on all night, according to a report by The Bureau of Investigative Journalism. TBIJ spoke to nine moderators who shared their experience but requested that their identity remained secret for fear they might lose their jobs, or risk future employment prospects. All names have been changed, according to the outlet.Carolina, a former TikTok moderator who worked remotely for Teleperformance, a Paris-based company offering moderation services and earned $10 a day, said she had to keep her camera continuously on during her night shift, TBIJ reported. The company also told her that no one should be in view of the camera and was only allowed a drink in a transparent cup on her desk.Related: https://www.bbc.com/news/technology-57088382 Facebook moderator: ‘Every day was a nightmare PILOT PROGRAMME FOR FIRST CHARTERED CYBER PROFESSIONALSCIISec and (ISC)² announced as pilot participant partners to assess candidates under the pilot programme.The UK Cyber Security Council has announced it is set to usher in the country’s first chartered cyber professionals through a pilot scheme. The first two specialisms kickstarting the pilot are Cyber Security Governance and Risk Management and Secure System Architecture and Design. The Council has confirmed it will partner with two pilot participant bodies – (ISC)² and The Chartered Institute of Information Security (CIISec) – for the pilot, with the organisations responsible for assessing applications from their membership base, against the Council’s newly established professional standard.   Billy Big Balls of the WeekElon Musk walks into an office with a sink. Apple’s Killing the Password. Here’s Everything You Need to KnowFor years, we’ve been promised the end of password-based logins. Now the reality of a passwordless future is taking a big leap forward, with the ability to ditch passwords being rolled out for millions of people. When Apple launches iOS 16 on September 12 and macOS Ventura next month, the software will include its password replacement, known as passkeys, for iPhones, iPads, and Macs.Passkeys allow you to log in to apps and websites, or create new accounts, without having to create, memorize, or store a password. This passkey, which is made up of a cryptographic key pair, replaces your traditional password and is synced across iCloud’s Keychain. It has the potential to eliminate passwords and improve your online security, replacing the insecure passwords and bad habits you probably have now.Apple’s rollout of passkeys is one of the largest implementations of password-free technology to date and builds on years of work by the FIDO Alliance, an industry group made up of tech’s biggest companies. Apple’s passkeys are its version of the standards created by the FIDO Alliance, meaning they will eventually work with Google, Microsoft, Meta, and Amazon’s systems. Industry NewsDHL Replaces LinkedIn As Most Imitated Brand in Phishing AttemptsICO Warns of "Immature" Biometric TechSee Tickets Discloses Major Card Data BreachLondon's New Cyber Resilience Centre Set to Fight Cybercrime in the CapitalHive Ransomware Group Leaks Data Stolen in Tata Power Cyber-AttackMedibank Backtracks: All Customer Data Was Exposed to HackersGitHub Bug Exposed Repositories to HijackingWhite House Launches Chemical Sector Security SprintLinkedIn Unveils New Security Features to Tackle Fraud National Chief Information Security Officer Tweet of the Weekhttps://twitter.com/codesixonline/status/1585629859052605443 Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield18th October 1985: Nintendo releases the Nintendo Entertainment System (NES) in New York and limited other North American markets. An immediate hit, Nintendo released the game nationwide in February 1986. Along with the NES, Nintendo released eighteen games that day, including: 10-Yard Fight, Baseball, Clu Clu Land, Donkey Kong Jr. Math, Duck Hunt, Excitebike, Golf, Gyromite, Hogan’s Alley, Ice Climber, Kung Fu, Mach Rider, Pinball, Stack-Up, Tennis, Wild Gunman, Wrecking Crew, and Super Mario Bros.14th October 1977: Atari releases their Video Computer System (known as the VCS and later as the Atari 2600). It took two years for the VCS to gain traction, but by 1979 it was the best selling gift of the Christmas season. Once it was established, the Atari VCS took the market by storm, popularized home video gaming, and helped cement the video game movement into mainstream culture. 18th October 1958: William Higinbotham and Robert Dvorak, Sr. show off a tennis simulator game they called Tennis for Two. Developed on a Donner Model 30 analog computer using an oscilloscope, it is the first known electronic game to use a graphical display. Higinbotham and Dvorak developed the game to show off to visitors to the Brookhaven National Laboratory where they worked. The game was only shown off twice, during the laboratory’s annual visitor’s day. While hundreds of visitors lined up to play the game when it was made available, little was known about the game for decades. While somewhat similar in gameplay to the later hit Pong, there is no known direct relationship between the games.14th October 1957: British Computer Society is Founded.  October 14 is the anniversary of the British Computer Society (BCS), founded in 1957. The BCS is one of the several international societies that have an affiliate membership relationship with the IEEE Computer Society. Since 1984 BCS has operated under a Royal Charter which requires it to: "...promote the study and practice of Computing and to advance knowledge therein for the benefit of the public."Rant of the Week The Black Market for Blue Checks Billy Big Balls of the WeekInside the messy fight between Meta and The WireEarlier this year, a new source reached out to journalists at the nonprofit Indian news site The Wire with a tantalizing offer. The source worked at Meta, they told the publication, and wished to share information about the company’s internal workings with reporters.The Wire met with the source, who sought to verify their identity by providing Sen with documents including their work badge and pay slips. Many conversations followed, reporter Jahnavi Sen told Platformer in an interview, and by the fall The Wire trusted the source enough to turn to them while investigating a potential story: the suspicious removal of seven Instagram posts satirizing an official in India’s right-wing government.Meta issued a strong denial to the resulting story, which claimed that the company had given a high-ranking official in the ruling Bharatiya Janata Party the ability to remove Instagram posts at will. What followed has been one of the strangest tech journalism stories in recent memory: The Wire gradually releasing more information about its sources and methods in reporting the story, and Meta leveling unheard-of accusations — supported with evidence — that the documents underpinning the publication’s stories appear to be fabricated. Industry NewsHackney Council Ransomware Attack Cost £12m+   https://drive.google.com/file/d/1g30UrPyEP5YK6HuUtApXHe2MNyseOcM5/viewSpanish Police Bust Region's "Biggest Narco Bank"Amazon Customers Receive Smishing Warning After Receiving Fake TextsWine Merchant Among Aussie Firms Breached, Exposing MillionsEuropean Police Catch Suspected Car HackersDigital Natives Are Undermining Corporate SecurityMoola Market Reveals $9m Crypto ExploitNSA Cybersecurity Director's Six Takeaways From the War in UkraineMicrosoft Misconfiguration Exposes Customer Data Tweet of the Weekhttps://twitter.com/chetdorn/status/1582457548484931587§ Thom's holiday snapshttps://adobe.ly/3EQoxTs  Come on! Like and bloody well subscribe!

This week in InfoSecOctober 12 1988  (a mere 34 years ago) Hailed by Steve Jobs as a computer “five years ahead of its time”, NeXT, Inc. introduces their NeXT Computer. Due to its cube-shaped case, the computer was often referred to as “The Cube” or “The NeXT Cube”, which led to the subsequent model offically being named “NeXTcube“. The new computer introduced several innovations to personal computers, such as including an optical storage disk drive, a built-in digital signal processor for voice recognition, and an object-oriented development environment that was truly years ahead of its time.While not a commercial success, the NeXT Computer and the technology developed for it have a long and storied history. Tim Berners-Lee developed the first world wide web server and web browser on a NeXT computer, crediting the NeXT development tools for allowing him to rapidly develop the now ubiquitous Internet system. After Apple purchased NeXT in 1997, they used the operating system of the NeXT computers to form the base of Mac OS X. Eventually Apple’s iOS, which runs the iPhone and iPad, was itself based upon Mac OS X and hence draws its lineage to NeXT. Finally, the object-oriented development environment that Berners-Lee used to create the World Wide Web is the forerunner of the development environment that today’s programmers use to develop iPhone and iPad Apps. If it wasn’t for the NeXT Computer back in 1988, Thom may not have his iPhone pro max 14 today. RANT of the Weekhttps://www.infosecurity-magazine.com/news/claroty-found-cryptographic-keys/Claroty Found Hardcoded Cryptographic Keys in Siemens PLCs Using RCE Team82, the research arm of New York-based industrial cybersecurity firm Claroty, revealed on October 11, 2022, that they managed to extract heavily guarded, hardcoded cryptographic keys embedded within SIMATIC S7-1200/1500s, a range of Siemens programmable logic computers (PLCs), and TIA Portal, Siemens’ automated engineering software platform.They deployed a new remote code execution (RCE) technique targeting the central processing units (CPUs) of SIMATIC S7-1200 and S7-1500 PLCs, for which they used a vulnerability uncovered in previous research on Siemens PLCs (CVE-2020-15782) that enabled them to bypass native memory protections on the PLC and gain read/write privileges.They were able not only to extract the internal, heavily guarded private key used across the Siemens product lines but also to implement the full protocol stack, encrypt and decrypt protected communications and configurations.“An attacker can use these keys to perform multiple advanced attacks against Siemens SIMATIC devices and the related TIA Portal, while bypassing all four of its access-level protections. [They] could [also] use this secret information to compromise the entire SIMATIC S7-1200/1500 product line in an irreparable way,” Team82 warned in the research paper.CVE-2022-38465 has been assigned to the new vulnerability found by Team82, and given a CVSS v3 score of 9.3.Team82 disclosed all technical information to Siemens, which released new versions of the affected PLCs and engineering workstation that address this vulnerability, urging users to move to current versions.In its advisory, Siemens also provided a series of key protection updates, workarounds and mitigations.This disclosure has led to the introduction of a new TLS management system in TIA Portal v17, ensuring that configuration data and communications between Siemens PLCs and engineering workstations is encrypted and confidential. Billy Big Balls of the Weekhttps://www.bleepingcomputer.com/news/security/police-arrest-teen-for-using-leaked-optus-data-to-extort-victims/Police arrest teen for using leaked Optus data to extort victimsThe Australian Federal Police (AFP) have arrested a 19-year old in Sydney for allegedly using leaked Optus customer data for extortion.More specifically, the suspect used 10,200 records leaked last month by the Optus hackers and contacted victims over SMS to threaten that their data would be sold to other hackers unless they paid AUD 2,000 ($1,300) within two days.The scammer used a Commonwealth Bank of Australia account to receive the ransom money. The AFP identified the account and obtained from the bank information about the holder.According to the AFP, the arrested young man allegedly sent blackmailing messages to 93 individuals whose personal information was exposed Optus data leak. None of them paid the ransom, though.The suspect now faces charges for:Using a telecommunication network with the intent to commit a serious offense (blackmail), contrary to section 474.14 (2) of the Criminal Code Act 1995 (Cth), punishable by up to 10 years of imprisonmentDealing with identification information, contrary to section 192K of the Crime Act 1900 (NSW), punishable by a maximum of 7 years in prisonThe hackers behind the Optus breach have not been identified but AFP's investigation is still underway as part of "Operation Hurricane.""The Hurricane investigation is a high priority for the AFP, and we are aggressively pursuing all lines of inquiry to identify those behind this attack," stated Assistant Commissioner Gough.Announcing the international operation was apparently enough to discourage the threat actors from continuing their extortion, even leading to them declaring that all data stolen from Optus had been deleted.Two days ago, Optus published an update on the results of its ongoing internal investigation, confirming that 9.8 million customers were variably impacted, and 2.1 million of them had their government ID numbers compromised.Many of these people will need new IDs issued now. The Australian government is demanding Optus to cover the costs for this process. Industry NewsLloyd's of London cuts off network after dodgy activity detectedMalicious WhatsApp Mod Spotted Infecting Android DevicesChinese APT WIP19 Targets IT Service Providers and TelcosBudworm Espionage Group Returns, Targets US State LegislatureIP Cameras, VoIP and Video Conferencing Revealed as Riskiest IoT DevicesUK Government Urges Action to Enhance Supply Chain SecuritySingtel's Australian IT Firm Dialog Suffers Data Breach#DTX2022: Cyber Needs to Redress the Defensive-Offensive Balance Following Russia-Ukraine Lloyd's of London says no evidence found of data compromise from cyberattack Tweet of the Weekhttps://twitter.com/SwiftOnSecurity/status/1579575774784688128 Come on! Like and bloody well subscribe!

From @HostUnknownTVThis week in Infosec2nd October 1998: BUTTSniffer Beta 0.9 was released by Cult of the Dead Cow. Developed by DilDog.The big question is "When can we expect the long-awaited version 1.0 release?" 24 years is kind of a long wait. https://twitter.com/todayininfosec/status/1312179619659874305  3rd October 2017: A week after he retired as the result of Equifax's data breach, former CEO Richard F. Smith told members of Congress one person in the IT department was at fault.https://twitter.com/todayininfosec/status/1312589059559170050 Billy Big Ranty Balls Tweet of the WeekFormer Uber CSO convicted for covering up massive 2016 data theftJoe Sullivan, Uber's former chief security officer, has been found guilty of illegally covering up the theft of Uber drivers and customers' personal information.Sullivan, previously a cybercrime prosecutor for the US Department of Justice, was charged two years ago with obstruction of justice and misprision – concealing a felony from law enforcement. He was convicted on both counts today.On November 21, 2017, Uber CEO Dara Khosrowshahi issued a statement acknowledging that in late 2016, miscreants had broken into the app giant's infrastructure and made off with 57 million customer and driver records. Sullivan, along with Craig Clark, legal director of security and law enforcement, were fired as a result.Sullivan, according to court documents, learned of the theft in November 2016, about ten days after he had provided testimony to the US Federal Trade Commission about a 2014 cyberattack on Uber. Concerned that another data security breach would harm the company, Sullivan tried to cover up that 2016 heist by trying to pass off a ransom payment, made to the thieves to recover the data, as a bug bounty award. Industry NewsT: Kardashian Charged by SEC After Crypto PostA: Malicious Tor Browser Installers Spread Via Darknet Video on YouTubeJ: New Initiative Aims to Strengthen UK's Nuclear Cybersecurity PostureT: Landmark US-UK Data Access Agreement BeginsA: Ransomware Group Bypasses "Enormous" Range of EDR ToolsJ: Australia's Data Breaches Continue With Telstra's Third-Party Supplier HackedT: Retailer Easylife Fined £1.5m for Data Protection BreachesA: US Healthcare Giant CommonSpirit Hit by Possible RansomwareJ: Uber's Former Security Chief Convicted of 2016 Data Breach Cover-Up Tweet of the Week:https://twitter.com/HackingDave/status/1578064952400781316 Come on! Like and bloody well subscribe!

This week in InfoSec (06:37)With content liberated from the “today in infosec” twitter account and further afield27th September, 1998: For some peculiar reason, Google has at times chosen the date of September 27th as their birthday, even though it is more officially September 4th or 7th. Google has no explanation for celebrating their birthday on different days over the years other than to say:Google opened its doors in September 1998. The exact date when we celebrate our birthday has moved around over the years, depending on when people feel like having cake.27th September 1997: Just a little over two weeks after naming Steve Jobs interim CEO, Apple launches their “Think Different” ad campaign. Designed to reintroduce the Apple brand, the campaign was nearly universally praised by the press, general public, and advertising industry, winning several awards along the way. Looking back in context, Think Different was the symbolic start of Apple’s resurgence from near-collapse in the 1990’s into the most valuable company in the world.27th September 1996: Hacker Mitnick Indicted on Charges.  Kevin Mitnick, 33, was indicted on charges resulting from a 2 ½-year hacking spree. Police accused the hacker, who called himself "Condor," of stealing software worth millions of dollars from major computer corporations. The maximum possible sentence for his crimes was 200 years. Rant of the Week (12:07)Microsoft warns of North Korean crew posing as LinkedIn recruitersMicrosoft has claimed a North Korean crew poses as LinkedIn recruiters to distribute poisoned versions of open source software packages.The state-sponsored group has been around since 2009 and was allegedly behind the 2014 attack on Sony Pictures in retaliation for the controversial Seth Rogen comedy The Interview.Dubbed "ZINC", the threat actors have previously run long-term phishing schemes targeting media, defence and aerospace, and IT services organizations in the US, UK, India, and Russia. Billy Big Balls of the Week (20:28)Ever suspected bankers could just use WhatsApp comms? $1.8b says you're rightEver given a colleague a quick Signal call so you can sidestep a monitored workplace app? Well, we'd hope you're not in a highly regulated industry like staff at eleven of the world's most powerful financial firms, who yesterday were fined nearly $2 billion for off-channel comms. Industry News (26:50)Ransomware Affiliates Adopt Data DestructionReasonLabs Unveils Multimillion Dollar Global Credit Card ScamFitbit Increases Security Requirements, Mandates Google Login From 2023Alleged Optus Hacker Apologizes, Deletes Customers' Exposed DataICO Reprimands UK Organizations for GDPR FailingsHacker Breaches Fast Company Apple News Account, Sends Racist MessagesIRS Warns of "Industrial Scale" Smishing SurgeMobile, Cloud and Email Are Top Threat Vectors For 2023LeakBase: India Swachhata Platform Breached, 16 Million User PII Records Exposed Tweet of the Week (34:45)https://twitter.com/inversecos/status/1575606074635214848    Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield9th September 1947: An error in the Mark II computer at Harvard University was due to a moth trapped in a relay. The moth was attached to the log book with notation "first actual case of bug being found."  https://twitter.com/todayininfosec/status/130371748042313318611th September 1992: The movie "Sneakers" was released. With a budget of $35 million, it grossed $105 million at the box office. A hacker movie classic! Bishop, Whistler, Cosmo, and Mother!https://twitter.com/todayininfosec/status/1304574876922019841Sneakers IMDB Rant of the WeekGoogle and Meta fined over $70m for privacy violations in KoreaSouth Korea's Personal Information Protection Commission (PIPC) has issued two large fines for privacy violations: a $50 million penalty for Google and $22 million for Meta.The PIPC's beef is that neither Google nor Meta properly obtain consent or inform users on how they collect and use data, particularly with regards to behavioural information used to predict interests for marketing and advertising purposes.The data watchdog claims Google hides the setting screen to agree or disagree to collection methods and sets the default to "agree" while Meta only asks for agreement when a user creates an account and does so in unclear ways.AND / ORA surveillance artist shows how Instagram magic is madeWhen traveller Daniele Brito posed in front of the Temple Bar in Dublin, Ireland in late August, she likely didn’t realize the camera was watching her.Yes, there was the one pointed at her, capturing a photograph that would later be shared to Brito’s more than 2,700 followers on Instagram. But there was at least one other one observing her: a surveillance camera stationed on the corner opposite the bar.The FollowerThe Machine Billy Big Balls of the Week Chess player denies using anal beads to cheat in match against world champion: ‘This is not a joke’A chess underdog who unexpectedly beat a champion player has been accused of using anal beads to cheat his way to victory.Yes, we know – you probably never expected to see “chess” and “anal beads” in the same sentence, but here we are.The furore kicked off when Norwegian chess champion Magnus Carlsen announced he was withdrawing from the Sinquefield Cup, a lucrative tournament which attracts some of the world’s best chess players.Carlsen posted on Twitter to say he was leaving the tournament, but gave no explanation why.The Hans Niemann story from redditChess player Hans Niemann denies using sex toy to help him beat grand championVibrating Butt Toys Are Exactly What Chess Needs Industry NewsCops Raid Suspected Fraudster PenthousesUS Treasury Sanctions Iranian Minister Over Hacking of Govt and AlliesHackers Steal Steam Credentials With 'Browser-in-the-Browser' TechniqueiOS 16 Launches With Lockdown Mode, Spyware Protection, Safety CheckVulnerabilities Found in Airplane WiFi Devices, Passengers' Data ExposedCybercrime Forum Admins Steal from Site UsersUser Alert as Phishing Campaigns Exploit Queen's PassingYouTube Users Targeted By RedLine Self-Spreading StealerNotepad++ Plugins Allow Attackers to Infiltrate Systems, Achieve Persistence Tweet of the Weekhttps://twitter.com/SecurityAura/status/1570232260485386242   The Joseph Carson Talk Tweet Threadhttps://twitter.com/J4vv4D/status/1569704538252214274?s=20 Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield6th September 2011: Luis Mijangos received a 6 year prison sentence. His crimes included sextortion, stealing financial info, and webcam monitoring. California's "Sextortion" Hacker Sentenced to Prisonhttps://twitter.com/todayininfosec/status/13027700884712980493rd September 1995: The online auction site, eBay, is launched as “AuctionWeb” by Pierre Omidyar. The first item sold, a broken laser pointer, wasn’t actually intended to sell, but rather to test the new site, itself started as a hobby. Surprised that the item sold for $14.83, Omidyar contacted the buyer to make sure he knew the laser pointer was broken, to which was replied, “I’m a collector of broken laser pointers.” From that first $14.83, Omidyar is now worth billions of dollars. Rant of the WeekHalfords slapped on wrist for breaching email marketing lawsBike and car accessory retailer Halfords has found itself in the wrong lane with Britain’s data watchdog for sending hundreds of thousands of unsolicited marketing emails to members of the public.According to the Information Commissioner’s Office, it fined the business £30,000 for dispatching 498,179 messages to folk that hadn’t provided consent - equating to a £0.06 penalty per each email.The decision relates to a direct marketing mailer that Halfords sent electronically on July 28, 2020 concerning a ‘Fix Your Bike’ government voucher scheme. This gave recipients up to £50 toward the cost of repairing a cycle in any approved retailer in the UK.Unsurprisingly, Halfords' marketing email urged the individuals to book a free bike assessment and redeem their voucher in store, meaning this was marketing designed to generate income for the company. As such, the advertising of the service meant Halfords couldn’t rely on ‘legitimate interest’ to send the mail, which the ICO said it had done. Billy Big Balls of the WeekHow the ‘man in black’ was exposed by the Russian women he terrorisedA Russian police officer's takeaway food order was the breakthrough clue which helped a group of women, who had been terrorised by him, reveal his true identity. The women, mostly aged between 19 and 25, had attended a rally in Moscow in March against Russia's invasion of Ukraine. They were quickly rounded up by officers and put in the back of a police van.Most of them didn't know each other, but despite the circumstances the atmosphere was upbeat. They even set up a Telegram group chat as they travelled across the city to Brateyevo police station.What happened next was far worse than they anticipated.Over the next six hours they suffered verbal and physical abuse that, in some cases, amounted to torture - one woman says she was repeatedly starved of oxygen when a plastic bag was put over her head.The abuse was carried out by the same unnamed plain-clothes officer - tall, athletic, dressed in a black polo neck. In their group chat, they gave him the nickname the "man in black".Two of the women, Marina and Alexandra, secretly recorded audio on their phones. In one, the officer can be heard shouting about his "total impunity".But if his aim was to intimidate them into silence, he would fail. Industry NewsKeyBank's Customer Information Stolen By Hackers Via Third-party ProviderLondon's Biggest Bus Operator Hit by Cyber "Incident"Meta Fined $400m in Ireland For Children's Privacy BreachInterpol Busts Asian Sextortion SyndicateUK Privacy Regulator Fines Halfords for Spam DelugeInterContinental Hotels Confirms Cyber-Attack After Two-Day OutageNATO-Member Albania Cut Ties With Iran Over Cyber-AttackThe North Face Warns of Major Credential Stuffing CampaignResearchers Reveal New Iranian Threat Group APT42 Tweet of the Weekhttps://twitter.com/SwiftOnSecurity/status/1567378788991868928https://twitter.com/ememess/status/1567544425869606913 Come on! Like and bloody well subscribe!

This week in InfoSec (09:07)With content liberated from the “today in infosec” twitter account and further afield30th August 1999: The previously unknown group Hackers Unite claimed responsibility for disclosing a vulnerability in Hotmail that granted access to all of its roughly 50 million users' email accounts.13 years later Microsoft rebranded Hotmail, renaming it Outlook.Hotmail Hackers: 'We Did It'https://twitter.com/todayininfosec/status/130021271765612134431st August 2014: A user of the message board 4chan posted leaked photos of actress Jennifer Lawrence and numerous other celebrities.Jennifer Lawrence and Other Celebs Hacked as Nude Photos Circulate on the Webhttps://twitter.com/todayininfosec/status/1300537361676283905 Rant of the Week (20:21)Here's how 5 mobile banking apps put 300,000 users' digital fingerprints at riskMassive amounts of private data – including more than 300,000 biometric digital fingerprints used by five mobile banking apps – have been put at risk of theft due to hard-coded Amazon Web Services credentials, according to security researchers.Symantec's Threat Hunter Team said it discovered 1,859 publicly available apps, both Android and iOS, containing baked-in AWS credentials. That means if someone were to look inside the apps, they would have found the credentials in the code, and could potentially have used that to access the apps' backend Amazon-hosted servers and steal users' data. The vast majority (98 percent) were iOS apps.In all, 77 percent of these apps contained valid AWS access tokens that allowed access to private AWS cloud services, the intelligence team noted in research published today. Billy Big Balls of the Week (28:45)Twitter starts testing an edit button, but you have to pay for itTwitter is now testing its highly requested Edit Tweet feature. After years of memes and jokes, editable tweets will be available to some Twitter Blue subscribers later this month. The feature is currently undergoing “internal testing” and appears to mimic Facebook in its edit style, with a linked edit history for tweets that we saw in leaks earlier this year.“Tweets will be able to be edited a few times in the 30 minutes following their publication,” according to a Twitter blog post. “Edited Tweets will appear with an icon, timestamp, and label so it’s clear to readers that the original Tweet has been modified.” Industry News (36:45)Cryptominer Disguised as Google Translate Targeted 11 CountriesBaker & Taylor's Systems Remain Offline a Week After Ransomware AttackICO Pursues Traffic Accident Data ThievesUK Imposes Tough New Cybersecurity Rules for Telecom ProvidersEvil Corp and Conti Linked to Cisco Data Breach, eSentire SuggestsGolang-based Malware Campaign Relies on James Webb Telescope's ImageMicrosoft Finds Account Takeover Bug in TikTokStandards Body Publishes Guidelines for IoT Security TestingApple Releases Update for iOS 12 to Patch Exploited Vulnerability Tweet of the Week (43:42)https://twitter.com/SunTzuCyber/status/1565192484380188672 Come on! Like and bloody well subscribe!

This week in InfoSec: (The one and only):23rd August 2006: SpoofCard confirmed that Paris Hilton was among the terminated customers, and that Lindsay Lohan was among those whose voicemail accounts were broken into. SpoofCard said it had implemented controls to prevent recurrences.Paris Hilton: Master Hacker?https://twitter.com/todayininfosec/status/129721363805972889626th August 2008: It was reported that a laptop on the International Space Station was infected by removable media containing the http://W32.Gammima.AG worm.Space. Where you don't want to be dealing with malware.Malware detected at the International Space Stationhttps://twitter.com/todayininfosec/status/1298690676448735232 Rant of the Week:Block sued after ex-staffer siphons customer dataBlock – the digital payments giant formerly known as Square – faces allegations it failed to take adequate measures to protect customers' personal information.A lawsuit, filed Tuesday in a federal district in Oakland, California, on behalf of two users of Cash App, operated by Block subsidiary Cash App Investing, claims the company failed to implement reasonable security. As a result, a former employee was able to download internal reports containing personal information after leaving the firm.Coincidentally, Twitter – another venture co-founded by Block Head Jack Dorsey – was accused of subpar security by its former security chief in a recent whistleblower complaint.Block disclosed the December 10, 2021 data theft on April 4, 2022, and stated it was contacting 8.2 million current and former customers about the privacy snafu. The biz said, "a former employee downloaded certain reports of its subsidiary Cash App Investing LLC … that contained some US customer information."The employee had access to those reports while employed but in this instance downloaded the files after leaving the company. The data obtained included customers' full name and brokerage account numbers, and in some cases, brokerage portfolio values, brokerage portfolio holdings and/or stock trading activity for one trading day.As far as the litigants are concerned, Block didn't meet its security obligations, failed to notify customers in a timely manner, provided too little information about the incident, and failed to offer credit or identity monitoring services. Billy Big Balls:Lloyd's to exclude certain nation-state attacks from cyber insurance policiesLloyd's of London insurance policies will stop covering losses from certain nation-state cyber attacks and those that happen during wars, beginning in seven months' time.In a memo sent to the company's 76-plus insurance syndicates, underwriting director Tony Chaudhry said Lloyd's remains "strongly supportive" of cyber attack coverage. However, as these threats continue to grow, they may "expose the market to systemic risks that syndicates could struggle to manage," he added [PDF], noting that nation-state-sponsored attacks are particularly costly to cover.Because of this, all standalone cyber attack policies must include "a suitable clause excluding liability for losses arising from any state-backed cyberattack," Chaudhry wrote. These changes will take effect beginning March 31, 2023 at the inception or renewal of each policy.At a minimum – key word: minimum – these policies must exclude losses arising from a war, whether declared or not, if the policy doesn't already have a separate war exclusion. They must also at least exclude losses from nation-state cyber attacks that "significantly impair the ability of a state to function or that significantly impair the security capabilities of a state." Industry News: Counterfeit Android Devices Revealed to Contain Backdoor Designed to Hack WhatsApp Ex-Security Chief Accuses Twitter of Cybersecurity Negligence Facebook Bug Causes Users’ Feeds to Be Spammed Plex Suffers Data Breach, Warns Users to Reset Passwords Scammers Create 'AI Hologram' of C-Suite Crypto Exec Workplace Stress Worse than Cyber-Attack Fears for Security Pros US Firm Pays $16m to Settle Healthcare Fraud Claims Talos Renews Cybersecurity Support For Ukraine on Independence Day Microsoft Attributes New Post-Compromise Capability to Nobelium Tweet of the Week:https://twitter.com/J4vv4D/status/1562775110544949248?s=20  Come on! Like and bloody well subscribe!

This week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield18th August 2003: The Nachi worm began infecting Windows computers to remove the Blaster worm and patch the vulnerability Nachi and Blaster exploited. Yes, you read that right. Yes, this happened. Gotta love it!https://twitter.com/todayininfosec/status/116314272574033100817th August 2007: Drew Curtis, founder of http://Fark.com, accused Darrell Phillips, reporter at Fox13, of hacking into the social networking news siteOn getting farked?https://twitter.com/todayininfosec/status/1162868155015761920 Rant of the WeekPC store told it can't claim full cyber-crime insurance after social-engineering attackA Minnesota computer store suing its crime insurance provider has had its case dismissed, with the courts saying it was a clear instance of social engineering, a crime for which the insurer was only liable to cover a fraction of total losses.SJ Computers alleged in a November lawsuit [PDF] that Travelers Casualty and Surety Co. owed it far more than paid on a claim for nearly $600,000 in losses due to a successful business email compromise (BEC) attack.According to its website, SJ Computers is a Microsoft Authorized Refurbisher, reselling Dell, HP, Lenovo and Acer products, as well as providing tech services including software installs and upgrades.Travelers, which filed a motion to dismiss, said SJ's policy clearly delineated between computer fraud and social engineering fraud. The motion was granted [PDF] with prejudice last Friday. Billy Big Balls of the WeekJanet Jackson music video declared a cybersecurity exploitThe music video for Janet Jackson's 1989 pop hit Rhythm Nation has been recognized as a cybersecurity vulnerability after Microsoft reported it can crash old laptop computers."A colleague of mine shared a story from Windows XP product support," wrote Microsoft blogger Raymond Chen.The story detailed how "a major computer manufacturer discovered that playing the music video for Janet Jackson's Rhythm Nation would crash certain models of laptops."Further investigation revealed that multiple manufacturers' machines also crashed. Sometimes playing the video on one laptop would crash another nearby laptop. This is mysterious because the song isn't actually that bad.Investigation revealed that all the crashing laptops shared the same 5400 RPM hard disk drive."It turns out that the song contained one of the natural resonant frequencies for the model of 5400 RPM laptop hard drives that they and other manufacturers used," Chen wrote.The manufacturer that found the problem apparently added a custom filter in the audio pipeline to detect and remove the offending frequencies during audio playback.CVE-2022-38392 Industry NewsCritical Infrastructure at Risk as Thousands of VNC Instances ExposedThree Extradited from UK to US on $5m BEC ChargesSoftware Patches Flaw on macOS Could Let Hackers Bypass All Security LevelsWater Company Says Supply Safe After Ransom Group ClaimsMicrosoft Disrupts Russian Cyber-Espionage Group SeaborgiumHealthcare Provider Issues Warning After Tracking Pixels Leak Patient DataBug Bounty Giant Slams Quality of Vendor PatchingSuspected Russian Money Launderer Extradited to USHackers Deploy Bumblebee Loader to Breach Target Networks Tweet of the Weekhttps://twitter.com/dildog/status/1560025574437015553 Come on! Like and bloody well subscribe!

This Week in InfoSecWith content liberated from the “today in infosec” twitter account and further afield10th August 1988: 34 years ago today, Dade Murphy aka Zero Cool crashed 1507 computers, causing a 7 point drop in the NY stock exchange. He was 11 and his family was fined $45,000. He was banned from touching a computer until he turned 18.https://twitter.com/hakluke/status/15572420864238714886th August 2014: A hacker announced the theft of 40 GB of data from the maker of FinFisher spyware, then leaked the price list, client list, and more.A Hacker Claims to Have Leaked 40GB of Docs on Government Spy Tool FinFisherTop gov't spyware company hacked; Gamma's FinFisher leakedhttps://twitter.com/todayininfosec/status/115895644924810854411th August 2015: A day after Oracle CSO Mary Ann Davidson posted a blog titled "No, You Really Can’t", security community blowback caused Oracle to remove the post.No, you really can’t (Wayback Machine)Oracle has this Modest Proposal, via its CSOhttps://twitter.com/todayininfosec/status/1293374259637768194 Rant of the WeekMeta's chatbot says the company 'exploits people'Meta's new prototype chatbot has told the BBC that Mark Zuckerberg exploits its users for money.Meta says the chatbot uses artificial intelligence and can chat on "nearly any topic".Asked what the chatbot thought of the company's CEO and founder, it replied "our country is divided and he didn't help that at all".Meta said the chatbot was a prototype and might produce rude or offensive answers."Everyone who uses Blender Bot is required to acknowledge they understand it's for research and entertainment purposes only, that it can make untrue or offensive statements, and that they agree to not intentionally trigger the bot to make offensive statements," said a Meta spokesperson.The chatbot, called BlenderBot 3, was released to the public on Friday.The programme "learns" from large amounts of publicly available language data. Billy Big Balls of the WeekBackground:  Twilio discloses data breach after SMS phishing attack on employees"On August 4, 2022, Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials," Twilio said over the weekend."The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data."The company also revealed the attackers gained access to its systems after tricking and stealing credentials from multiple employees targeted in the phishing incident.To do that, they impersonated Twilio's IT department, asking them to click URLs containing "Twilio," "Okta," and "SSO" keywords that would redirect them to a Twilio sign-in page clone.​The SMS phishing messages baited Twilio's employees into clicking the embedded links by warning them that their passwords had expired or were scheduled to be changed.BBB: Cloudflare: Someone tried to pull the Twilio phishing tactic on us too.  Cloudflare says it was subject to a similar attack to one made on comms company Twilio last week, but in this case it was thwarted by hardware security keys that are required to access applications and services.Twilio reported a breach after employees received phishing text messages claiming to be from the company's IT department. These fooled them into logging into a fake web page designed to look like Twilio's own sign-in page, using pretexts such as claiming they needed to change their passwords. The attackers were then able to use credentials supplied by the victims to log into the real site.According to Cloudflare, it recorded a very similar incident late last month, which could suggest the two attacks may have originated from the same attacker or group.Detailing the incident on its blog, the content delivery network claimed that no Cloudflare systems were compromised, but said it was "a sophisticated attack targeting employees and systems in such a way that we believe most organizations would be likely to be breached." Industry NewsMeta Takes Action Against Cyber Espionage Operations Targeting Facebook in South AsiaNumber of Firms Unable to Access Cyber-Insurance Set to DoubleSmishing Attack Led to Major Twilio BreachHealth Adviser Fined After Illegally Accessing Medical RecordsUS Treasury Sanctions Virtual Currency Mixer For Connections With Lazarus GroupPredator Pleads Guilty After Targeting Thousands of Girls OnlineCyber-criminals Shift From Macros to Shortcut Files to Hack Business PCs, HP ReportsDeathStalker's VileRAT Continues to Target Foreign and Crypto ExchangesSuspected $3m Romance Scammer Extradited to Japan Tweet of the Weekhttps://twitter.com/mttaggart/status/1557399523575508993 Come on! Like and bloody well subscribe!

This week in InfoSec (9:23)With content liberated from the “today in infosec” twitter account and further afield29th July 1985: An article in the New York Times cited multiple experts who alleged the vote counting systems of Computer Election Systems are vulnerable to tampering.Yep. Election systems vulnerabilities aren't a new phenomenon. Not even close. COMPUTERIZED SYSTEMS FOR VOTING SEEN AS VULNERABLE TO TAMPERINGhttps://twitter.com/todayininfosec/status/115607828460341658230th July 2013: Chelsea Manning was found guilty of espionage, theft, and computer fraud, as well as military infractions. United States v. Manninghttps://twitter.com/todayininfosec/status/12889252894652088346th August 1997: Microsoft Buys $150M of Apple stock.  In an effort to help save Apple Computer and possibly deflect criticism in its own anti-trust trial, Microsoft Corp. buys $150 million in shares of Apple Computer Inc. Apple, which had been struggling to find direction and profits for years, agreed to the boost in funding with terms that dictated cooperation in the design of computers as well as shared patents. Microsoft agreed to continue supporting MS-Office for the Mac for another five years as well.Rant of the Week (18:11)India scraps data protection law in favor of better law coming … sometimeThe government of India has scrapped the Personal Data Protection Bill it's worked on for three years, and announced it will – eventually – unveil a superior bill.The bill, proposed in 2019, would have enabled the government to gather user data from companies while regulating cross-border data flows. It also included restrictions on sharing of personal data without explicit consent, proposed establishment of a new Data Protection Authority within the government, and more.On Wednesday, telecom minister Ashwini Vaishnaw tweeted that the bill was nixed because the Joint Committee of Parliament (JCP) recommended 81 amendments to the Bill's 99 sections."Therefore the bill has been withdrawn and a new bill will be presented for public consultation," said Vaishnaw.and...UK Parliament bins its TikTok account over China surveillance fearsPlan to educate the children turned out to be a 'won't someone think of the children?' momentThe UK's Parliament has ended its presence on TikTok after MPs pointed out the made-in-China social media service probably sends data about its users back to Beijing.The existence of the account saw half a dozen MPs write to the presiding officers of the Houses of Lords and Commons — Lord McFall of Alcluith and Sir Lindsay Hoyle, respectively — to ask for the account to be discontinued."While efforts made to engage young people in the history and functioning of parliament should always be welcomed, we cannot and should not legitimise the use of an app which has been described by tech experts as 'essentially Chinese government spyware'," wrote MPs Nusrat Ghani, Tim Loughton, Sir Iain Duncan Smith, Tom Tugendhat, plus Lord Alton of Liverpool and Baroness Kennedy of the Shaws.Billy Big Balls of the Week (26:21)Ex-T-Mobile US store owner phished staff, raked in $25m from unlocking phonesA now-former T-Mobile US store stole at least 50 employees' work credentials to run a phone unlocking and unblocking service that prosecutors said netted $25 million.Argishti Khudaverdyan, 44, of Burbank, California, was found guilty of 14 criminal charges [PDF] by a US federal jury on Friday.According to the Dept of Justice, Khudaverdyan co-owned a T-Mobile US store in Los Angeles, operating as a business called Top Tier Solutions, for about five months in 2017. T-Mo ended its contract with Khudaverdyan in June 2017 after being sketched out by his suspicious use of the carrier's computer system. It turned out he had been unlocking phones for customers without T-Mobile US's permission so that the devices could be used on different networks.Even after the self-styled un-carrier gave him the boot, he continued his illicit scheme, advertising unlocking and unblocking services through brokers, email spam, and websites that Khudaverdyan and Gharehbagloo controlled, such as unlocks247[.]com and swiftunlocked[.]com.Industry News (33:37)UK’s Top 10 Universities Failing on DMARCThousands of Apps Leaking Twitter API KeysLockBit Ransomware Exploits Windows Defender to Sideload Cobalt Strike PayloadTory Leadership Voting Delayed Over Security ConcernsT-Mobile Retailer Guilty of $25m Fraud Schemexperts Warn of Fake Football Ticket ScamsUkraine Shutters Major Russian Bot FarmUsers Still in the Dark Over $5m Theft From Blockchain Firm SolanaCREST and OWASP Partner on Verification Standard ProgramTweet of the Week (40:16)https://twitter.com/AndrewMohawk/status/1555430194743111683?s=20 Come on! Like and bloody well subscribe!

This week in InfoSec With content liberated from the “today in infosec” twitter account and further afield25th July 2007: The US Ninth Circuit Court of Appeals ruled that IP addresses and to/from email fields can be monitored without probable cause. Appeals Court Rules No Privacy Interest in IP Addresses, Email To/From Fieldshttps://twitter.com/todayininfosec/status/115479199039704268829th July 2009: The first Security BSides conference was held in Las Vegas in a  3,767 square foot house.http://www.securitybsides.com/w/page/50746315/BSidesHistoryhttps://twitter.com/todayininfosec/status/1156078833277128704 Rant of the WeekHackers scan for vulnerabilities within 15 minutes of disclosureSystem administrators have even less time to patch disclosed security vulnerabilities than previously thought, as a new report shows threat actors scanning for vulnerable endpoints within 15 minutes of a new CVE being publicly disclosed.According to Palo Alto's 2022 Unit 42 Incident Response Report, hackers are constantly monitoring software vendor bulletin boards for new vulnerability announcements they can leverage for initial access to a corporate network or to perform remote code execution.However, the speed at which threat actors begin scanning for vulnerabilities puts system administrators in the crosshairs as they race to patch the bugs before they are exploited."The 2022 Attack Surface Management Threat Report found that attackers typically start scanning for vulnerabilities within 15 minutes of a CVE being announced," reads a companion blog post.Since scanning isn't particularly demanding, even low-skilled attackers can scan the internet for vulnerable endpoints and sell their findings on dark web markets where more capable hackers know how to exploit them.Then, within hours, the first active exploitation attempts are observed, often hitting systems that never had the chance to patch. Billy Big Balls of the WeekNew ‘Robin Banks’ phishing service targets BofA, Citi, and Wells FargoA new phishing as a service (PhaaS) platform named 'Robin Banks' has been launched, offering ready-made phishing kits targeting the customers of well-known banks and online services.The targeted entities include Citibank, Bank of America, Capital One, Wells Fargo, PNC, U.S. Bank, Lloyds Bank, the Commonwealth Bank in Australia, and Santander.Additionally, Robin Banks offers templates to steal Microsoft, Google, Netflix, and T-Mobile accounts.According to a report by IronNet, whose analysts discovered the new phishing platform, Robin Banks is already being deployed in large-scale campaigns that started in mid-June, targeting victims via SMS and email. LockBit 3.0 introduces the first ransomware bug bounty programWith the release of LockBit 3.0, the operation has introduced the first bug bounty program offered by a ransomware gang, asking security researchers to submit bug reports in return for rewards ranging between $1,000 and $1 million."We invite all security researchers, ethical and unethical hackers on the planet to participate in our bug bounty program. The amount of remuneration varies from $1000 to $1 million," reads the LockBit 3.0 bug bounty page.However, this bug bounty program is a bit different than those commonly used by legitimate companies, as helping the criminal enterprise would be illegal in many countries.Furthermore, LockBit is not only offering bounties for rewards on vulnerabilities but is also paying bounties for "brilliant ideas" on improving the ransomware operation and for doxxing the affiliate program manager.The following are the various bug bounty categories offered by the LockBit 3.0 operation:Web Site Bugs: XSS vulnerabilities, mysql injections, getting a shell to the site and more, will be paid depending on the severity of the bug, the main direction is to get a decryptor through bugs web site, as well as access to the history of correspondence with encrypted companies.Locker Bugs: Any errors during encryption by lockers that lead to corrupted files or to the possibility of decrypting files without getting a decryptor.Brilliant ideas: We pay for ideas, please write us how to improve our site and our software, the best ideas will be paid. What is so interesting about our competitors that we don't have?Doxing: We pay exactly one million dollars, no more and no less, for doxing the affiliate program boss. Whether you're an FBI agent or a very clever hacker who knows how to find anyone, you can write us a TOX messenger, give us your boss's name, and get $1 million in bitcoin or monero for it.TOX messenger: Vulnerabilities of TOX messenger that allow you to intercept correspondence, run malware, determine the IP address of the interlocutorand other interesting vulnerabilities.Tor network: Any vulnerabilities which help to get the IP address of the server where the site is installed on the onion domain, as well as getting root access to our servers, followed by a database dump and onion domains.The $1,000,000 reward for identifying the affiliate manager, known as LockBitSupp, was previously offered on the XSS hacking forum in April. Industry NewsNo More Ransom Has Helped Over 1.5m VictimsUS Doubles Reward for Info on North Korean HackersCriminals Use Malware as Messaging Bots to Steal DataCyber-Criminal Offers 5.4m Twitter Users’ DataEuropean Police Arrest 100 Suspects in BEC CrackdownSocial Media Accounts Hijacked to Post Indecent ImagesHackers Change Tactics for New Post-Macro EraRansomware Group Demands £500,000 From SchoolSpanish Police Arrest Alleged Radioactive Monitoring HackersTweet of the Weekhttps://twitter.com/danielmakelley/status/1550884696355225601 Come on! Like and bloody well subscribe!

This week in InfoSec (10:25)With content liberated from the “today in infosec” twitter account and further afield17th July 1997: Major Disruption in Sending Most E-Mail Messages.  A programming error temporarily threw the Internet into disarray in a preview of the difficulties that inevitably accompany a world dependent on e-mail, the World Wide Web, and other electronic communications.At 2:30 a.m. Eastern Daylight Time, a computer operator in Virginia ignored alarms on the computer that updated Internet address information, leading to problems at several other computers with similar responsibilities. The corruption meant most Internet addresses could not be accessed, resulting in millions of unsent e-mail messages.15th July 1999: DilDog of Cult of the Dead Cow confirmed official Back Orifice 2000 CD-ROMs distributed during DEF CON 4 days prior were infected with the destructive CIH virus. Initially, cDc blamed pirated copies as the source, later discovering a duplicating machine had been infected.https://twitter.com/todayininfosec/status/128352319537128243419th July 1985: Chase Manhattan Bank discovered a message in one of its computer systems from Lord Flathead. The message said that unless he was given free use of the computer, he would destroy records in the system. Lord Flathead? He founded Myspace 18 years later!https://www.nytimes.com/1985/10/19/business/chase-computer-raided-by-youths-officials.htmlhttps://twitter.com/todayininfosec/status/1153507276629504006 Rant of the Week (16:28)Secret Service gives thousands of documents to January 6 committee, but hasn't yet recovered potentially missing texts(CNN)The US Secret Service produced an "initial set of documents" to the House select committee investigating the January 6, 2021, insurrection on Tuesday, in response to a subpoena last week that was issued amid reports of potentially missing text messages from the day of the insurrection.However, Tuesday's document production didn't include any of the potentially missing texts from January 5 and 6, 2021, a Secret Service official told CNN. That's because the agency still has not been able to recover any records that were lost during a phone migration around that time, the official said.“The USSS didn’t just delete texts after knowing they were evidence in a federal probe; it didn’t just lie about why/how the texts were deleted; the texts were so *professionally* deleted they can’t be recovered.”https://twitter.com/SethAbramson/status/1549488007614529538 Billy Big Balls of the Week (24:07)Glassdoor ordered to reveal identity of negative reviewers to New Zealand toymakerA California court has ordered employer-rating site Glassdoor to hand over the identities of users who claimed they had negative experiences working for New Zealand toy giant Zuru.In a decision that could prompt unease for online platforms that rely on anonymity to attract candid reviews, Glassdoor was ordered to provide the information so Zuru could undertake defamation proceedings against the reviewers in New Zealand. Industry News (33:26)TikTok Engaging in Excessive Data CollectionCISA Set to Open London OfficeNew MacOS Backdoor Communicates Via Public CloudDOJ Recovers $500K Paid to North Korean Ransomware ActorsLegal Experts Concerned Over New UK Digital Reform BillRomanian Man Accused of Distributing Gozi Virus Extradited to USUnpatched Flaws in Popular GPS Devices Allow Adversaries to Disrupt and Track VehiclesUK Regulator Issues Record Fines as Financial Crime SurgesMagecart Supply Chain Attacks Hit Hundreds of Restaurants Tweet of the Week (45:58)https://twitter.com/hela_luc/status/1549326122067890177 Come on! Like and bloody well subscribe!

This Week in InfoSec (08:09)With content liberated from the “today in infosec” twitter account and further afield12th July 2008: NextGenHacker101 taught us "how to view someone's IP address and connection speed!" Tracer-tee! Naive? Troll? You decide. Painfully hilarious. https://youtu.be/SXmv8quf_xMhttps://twitter.com/todayininfosec/status/1414224928413454341  13th July 2001: Code Red Worms its Way into the Internet.  The Code Red worm is released onto the Internet. Targeting Microsoft’s IIS web server, Code Red had a significant effect on the Internet due to the speed and efficiency of its spread. Much of this was due to the fact that IIS was often enabled by default on many installations of Windows NT and Windows 2000. However, Code Red also affected many other systems with web servers, mostly by way of side-effect, exacerbating the overall impact of the worm, ensuring its place in history among the many malware outbreaks infecting Windows systems in the late 1990’s and early 2000’s.7th July 1936: A Whole New Way to Drive a Screw: Several US patents are issued for the Phillips-head screw and screwdriver to inventor Henry F. Phillips. Phillips founded the Phillips Screw Company to license his patents. One of the first customers was General Motors for its Cadillac assembly-lines. By 1940, 85% of U.S. screw manufacturers had a license for the design. Rant of the Week (16:00)BMW starts selling heated seat subscriptions for $18 a monthBMW is now selling subscriptions for heated seats in a number of countries — the latest example of the company’s adoption of microtransactions for high-end car features.A monthly subscription to heat your BMW’s front seats costs roughly $18, with options to subscribe for a year ($180), three years ($300), or pay for “unlimited” access for $415.It’s not clear exactly when BMW started offering this feature as a subscription, or in which countries, but a number of outlets this week reported spotting its launch in South Korea.BMW has slowly been putting features behind subscriptions since 2020, and heated seats subs are now available in BMW’s digital stores in countries including the UK, Germany, New Zealand, and South Africa. It doesn’t, however, seem to be an option in the US — yet. Billy Big Balls of the Week (26:48)Hackers stole $620 million from Axie Infinity via fake job interviewsThe hack that caused Axie Infinity losses of $620 million in crypto started with a fake job offer from North Korean hackers to one of the game’s developers.The attack happened in March 2022 and pushed into the ground the then massively popular and quickly-growing game from Sky Mavis.By April 2022, the FBI was able to link the attack to the Lazarus and APT38 hackers, two groups who are often involved in cryptocurrency heists for the North Korean government.In a recent report from news publication on digital assets The Block, sources with knowledge about the attack said that the threat actors contacted staff at Sky Mavis over LinkedIn, posing as a company looking to hire them.One senior engineer at Axie Infinity showed interest in the fake job offer, due to the very generous salary, and went through multiple rounds of interviews.At one point, the engineer received a PDF file with details about the job. However, the document was the hackers' way into the Ronin systems - the Ethereum-linked sidechain that supports the Axie Infinity non-fungible token-based online video game.The employee downloaded and opened the file on the company’s computer, initiating an infection chain that enabled the hackers to penetrate Ronin’s systems and corrupt four token validators and one Axie DAO validator. Industry News (32:08)Majority Want Limitations on Social Media ContentSpike in Amazon Prime Scams ExpectedAerojet Rocketdyne Pays $9m Settlement Over Whistleblower AllegationsCyber Insurers Looking for New Risk Assessment ModelsMicrosoft Details How Phishing Campaign Bypassed MFAHavanaCrypt Ransomware Masquerades as a Fake Google UpdateCritical Industries Failing at IIoT/OT SecurityICO Calls for Review of Government “Private” MessagingState-Sponsored Hackers Targeting Journalists Tweet of the Week (38:48)https://twitter.com/cyb3rops/status/1547263760678756353 Come on! Like and bloody well subscribe!