Minecraft is hackers’ favorite game title for hiding malware
Security researchers have discovered that Minecraft is the most heavily abused game title by cybercriminals, who use it to lure unsuspecting players into installing malware. Based on stats collected by the security firm between July 2021 and July 2022, Minecraft-related files accounted for roughly 25% of malicious files spreading via game brand abuse, followed by FIFA (11%), Roblox (9.5%), Far Cry (9.4%), and Call of Duty (9%). Other game titles with notable percentages of abuse during this period are Need for Speed, Grand Theft Auto, Valorant, The Sims, and GS:GO.
Researcher demonstrates biometric data theft from smart lock with droplock hack
Biometric smart locks used in internet of things deployments can be hacked through their wireless connectivity capabilities, according to a new paper from a researcher with James Cook University in Singapore. ‘IoT Droplocks: Wireless fingerprint theft using hacked smart locks’ has been accepted for publication in the 2022 IEEE International Conference on Internet of Things (iThings). The paper describes a proof-of-concept device built to connect to the smart lock through Wi-Fi. The attacker then checks for an exposed debug interface to edit the lock’s firmware to collect and upload fingerprint biometric data to the proof-of-concept device. If the interface is not exposed, the firmware can be accessed by running an exploit, according to the research.
How posting personal and business photos can be a security risk
Marketers in every industry enjoy evidencing their reach to their superiors and providing tangible examples of their width and breadth of influence via social networks, media, and other means of engagement. Photos of both customers and employees engaging at hosted social events, trade shows, conferences, and direct one-on-one encounters are often viewed as gold. Couple this with the individual employee’s or customer’s photos working their way onto social network platforms for others to see and admire, and the value of that gold increases, success being quantified by impressions, views and individual engagements.
CISA readying info request, listening tour on cyber incident reporting
The Cybersecurity and Infrastructure Security Agency (CISA) is preparing to formally seek input from the public on how to best create an incident reporting regime for attacks on critical infrastructure. The agency will issue a request for information “in the next couple days” to “help us inform our rule-making process,” CISA Director Jen Easterly said Wednesday during the Billington Cybersecurity Summit in Washington. CISA will also hold 11 listening sessions around the country to gain additional feedback, she said. “I’m very excited for that. As you know, I spent over a decade at the National Security Agency so I’m very good at listening,” Easterly joked.
200,000 North Face accounts hacked in credential stuffing attack
Outdoor apparel brand ‘The North Face’ was targeted in a large-scale credential stuffing attack that has resulted in the hacking of 194,905 accounts on the thenorthface.com website. A credential stuffing attack is when threat actors use email addresses/usernames and password combinations obtained from data breaches to attempt to hack into user accounts on other websites. The success of these attacks relies on the practice of password recycling, where a person uses the same credentials across multiple online platforms.
