Cl0p’s MOVEit attack tally surpasses 2,000 victim organizations
The number of victim organizations hit by Cl0p via vulnerable MOVEit installations has surpassed 2,000, and the number of affected individuals is now over 60 million. The victim organizations are overwhelmingly based in the US. “The most heavily impacted sectors are finance and professional services and education, which account for 13.8 percent and 51.1 percent of incidents respectively,” Emsisoft researchers have shared on Monday. IT market research company KonBriefing Research shows similar numbers, and links to data breach notification alerts by many of the companies.
Google assigns new maximum rated CVE to libwebp bug exploited in attacks
Google has assigned a new CVE ID (CVE-2023-5129) to a libwebp security vulnerability exploited as a zero-day in attacks and patched two weeks ago. The company initially disclosed the flaw as a Chrome weakness, tracked as CVE-2023-4863, rather than assigning it to the open-source libwebp library used to encode and decode images in WebP format. This zero-day bug was jointly reported by Apple Security Engineering and Architecture (SEAR) and the Citizen Lab at The University of Toronto’s Munk School on Wednesday, September 6, and fixed by Google less than a week later.
FCC announces plans to reinstate net neutrality
Net neutrality is back on the menu, citizens. After a long, long battle ending in eventual defeat during Trump’s presidency, the FCC is set to reinstate rules that broadband providers must treat all traffic equally, giving no sweetheart deals to business partners or their own services. The effort to revive this popular rule was announced in a speech at the National Press Club by FCC Chairwoman Jessica Rosenworcel, who was one of the original rule’s champions over a decade ago. Rosenworcel said that broadband is “not a luxury, it’s a necessity,” adding: “It is essential infrastructure for modern life. No-one without it has a fair shot at 21st century success. We need broadband to reach 100% of us, and it needs to be fast, open and fair.”
GPUs from all major suppliers are vulnerable to new pixel-stealing attack
GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper published Tuesday. The cross-origin attack allows a malicious website from one domain—say, example.com—to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains.
Regulator Warns Breaches Can Cost Lives
The UK’s privacy regulator has warned organizations handling the personally identifiable information (PII) of domestic abuse victims that data breaches could put lives at risk. The latest missive from the Information Commissioner’s Office (ICO) follows reprimands issued by the watchdog to seven organizations in the past 14 months after sensitive PII was breached. The ICO said the organizations in question included a law firm, a housing association, an NHS trust, a government department, local councils and a police service.
DHS to host Latin American cyber summit as region faces an onslaught of digital attacks
The U.S.Homeland Security Department this week will convene the first-of-its-kind cybersecurity summit with leaders from Latin America, which has increasingly become a hotbed for criminal digital activity and influence efforts by China. The two-day “Western Hemisphere Cyber Conference,” which will be attended by nearly two dozen nations and kicks off Wednesday, was inspired by a visit Homeland Security Secretary Alejandro Mayorkas made to Ecuador late last year where he saw firsthand that the country is “at a very formative stage in developing its cybersecurity protocols.”
