Equifax Fined $13.5 Million Over 2017 Data Breach
The British watchdog Financial Conduct Authority (FCA) on Friday announced that it has fined Equifax Ltd, the UK arm of credit reporting firm Equifax Inc, more than £11 million (approximately $13.5 million) over the massive 2017 data breach. Roughly 147 million people were impacted by the incident, including 13.8 million UK consumers, after hackers gained access to Equifax servers in the US. In 2020, the US government indicted four members of China’s People’s Liberation Army (PLA) with hacking the credit reporting agency.
Australian regulators fine X for dodging questions about CSAM response
Australia has fined X (formerly Twitter) for failing to answer all its questions about child exploitation. The country’s government levied a penalty of AUD 610,500 (around $387,000) for the Elon Musk-owned company’s non-compliance with a national law requiring social platforms to disclose how they’re combating online child sexual abuse material (CSAM). “Companies can make empty statements like ‘Child exploitation is our top priority,’ so what we’re saying is show us,” Julie Inman Grant, Australia’s eSafety Commissioner, told The New York Times in an interview.
Actively exploited Cisco 0-day with maximum 10 severity gives full network control
Cisco is urging customers to protect their devices following the discovery of a critical, actively exploited zero-day vulnerability that’s giving threat actors full administrative control of networks. “Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity,” members of Cisco’s Talos security team wrote Monday. “This is a critical vulnerability, and we strongly recommend affected entities immediately implement the steps outlined in Cisco’s PSIRT advisory.”
Flipper Zero can be used to crash iPhones running iOS 17, but there’s a way to foil the attack
The Flipper Zero can do a lot, but I wasn’t expecting it to be able to be able to lock up an iPhone using nothing more than Bluetooth. But it turns out it can do just that. Now, you can’t do this with a stock Flipper Zero. If you want to test this out, you’ll need to have a Flipper Zero and then load an early developer build of Xtreme third-party firmware onto it. From there it’s a matter of firing up an app called Apple BLE Spam and choosing an attack called Lockup Crash.
Rising AI-Fueled Phishing Drives Demand for Password Alternatives
Online phishing scams are becoming more frequent and more sophisticated, according to the Online Authentication Barometer, published by the FIDO Alliance on October 16, 2023. When asked about phishing attacks, over half (54%) of respondents to the FIDO Alliance survey said they have seen an increase in suspicious messages and scams. Meanwhile, 52% believe phishing techniques have become more sophisticated, likely due to threat actors leveraging AI to create phishing schemes and deploy phishing campaigns.
SpyNote: Beware of This Android Trojan that Records Audio and Phone Calls
The Android banking trojan known as SpyNote has been dissected to reveal its diverse information-gathering features. Typically spread via SMS phishing campaigns, attack chains involving the spyware trick potential victims into installing the app by clicking on the embedded link, according to F-Secure. Besides requesting invasive permissions to access call logs, camera, SMS messages, and external storage, SpyNote is known for hiding its presence from the Android home screen and the Recents screen in a bid to make it difficult to avoid detection.
