AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

Blog Post

InfoSec News Nuggets 06/26/2023

NCSC Updates Cybersecurity Guidance for the Legal Sector

The UK’s National Cyber Security Centre (NCSC) has released updated guidance to help law firms mitigate the latest cyber-threats. Worth an estimated £44bn ($56bn), the sector employs over 320,000 people and consists of roughly 33,000 businesses, according to the report. However, the size of these organizations and the amount of resources they dedicate to cybersecurity can vary significantly. PwC claimed last year that the top 100 law firms spent an average of 0.46% of fee income on cybersecurity in 2022.

 

DuckDuckGo browser for Windows available for everyone as public beta

DuckDuckGo has released its privacy-centric browser for Windows to the general public. It is a beta version available for download with no restrictions. DuckDuckGo’s web browser promises to protect users from third-party tracking, targeted advertising, search query logging, and profiling. To achieve this, it comes with various data protection and security enhancements active by default.

 

US Military Personnel Warned of Malicious Smartwatches

Service members across the US military have reported receiving smartwatches unsolicited in the mail. These smartwatches have Wi-Fi auto-connect capabilities and can connect to cell phones unprompted, gaining access to user data. According to the US Criminal Investigation Division (CID), the smartwatches may also contain malware granting the sender access to saved data, including banking information, contacts and account information such as usernames and passwords. Additionally, the presence of malware could enable unauthorized access to voice and camera functions, potentially compromising conversations and accounts linked to the smartwatches.

 

Why Legacy System Users Prioritize Uptime Over Security

Dirk Hodgson, the director of cybersecurity for NTT Australia, tells a story. He once worked with a company that did scientific measurements. The highly specialized firm used highly specialized equipment, and one large piece of equipment cost them $2 million when purchased years ago. The hardware did not cause any issues, and the manufacturer routinely replaced parts and performed maintenance, as per their contract. The security problem was the operating system, which was Windows XP. The company went to the manufacturer and asked if it could upgrade the OS to a current and supported OS. Not a problem, replied the manufacturer. The company merely has to buy a new multimillion-dollar system, and that will come with a current OS. As for updating the OS on the current machine? The manufacturer declined.

 

University of Manchester confirms data theft in recent cyberattack

The University of Manchester finally confirmed that attackers behind a cyberattack disclosed in early June had stolen data belonging to alums and current students. The university first disclosed the attack on June 9, warning that data was likely stolen but said the incident was unrelated to the MOVEit Transfer data theft attacks. On Tuesday, BleepingComputer first reported that the hackers behind the attack were emailing students claiming to have stolen 7 TB of confidential data belonging to students and staff. “We would like to inform all students, lecturers, administration, and staff that we have successfully hacked manchester.ac.uk network on June 6 2023,” the threat actors said in the email. “We have stolen 7TB of data, including confidential personal information from students and staff, research data, medical data, police reports, drug test results, databases, HR documents, finance documents, and more. and more.”

 

Why is it so rare to hear about Western cyber-attacks?

A cyber-attack that took over iPhones at a Russian technology company is being blamed on US government hackers. Could the attack, and the response from the Russian government, be rewriting the narrative of who the good guys and bad guys are in cyber-space? Camaro Dragon, Fancy Bear, Static Kitten and Stardust Chollima – these aren’t the latest Marvel film superheroes but the names given to some of the most feared hacking groups in the world. For years, these elite cyber teams have been tracked from hack to hack, stealing secrets and causing disruption allegedly under orders from their governments.

 

Companies Call for Changes to UK’s Cyber Essentials Scheme

The UK government has responded to several concerns about its Cyber Essentials scheme, noting that just 35,000 organizations have been certified across the country. Operated by the Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC), and delivered through the IASME Consortium, Cyber Essentials was launched nine years ago in a bid to improve baseline security among UK organizations. However, while certifications have grown from fewer than 500 per month in January 2017 to just under 3500 in the month of January 2023, the number of organizations following the scheme is a tiny percentage of the estimated 5.5 million private sector businesses in the UK.

Related Posts