Cisco Duo warns third-party data breach exposed SMS MFA logs
Cisco Duo’s security team warns that hackers stole some customers’ VoIP and SMS logs for multi-factor authentication (MFA) messages in a cyberattack on their telephony provider. Cisco Duo is a multi-factor authentication and Single Sign-On service used by corporations to provide secure access to internal networks and corporate applications. Duo’s homepage reports that it serves 100,000 customers and handles over a billion authentications monthly, with over 10,000,000 downloads on Google Play.
Chipmaker Nexperia confirms breach after ransomware gang leaks data
Dutch chipmaker Nexperia confirmed late last week that hackers breached its network in March 2024 after a ransomware gang leaked samples of allegedly stolen data. Nexperia is a subsidiary of Chinese company Wingtech Technology that operates semiconductor fabrication plants in Germany and the UK, producing 100 billion units, including transistors, diodes, MOSFETs, and logic devices. The Nijmegen-based company employs 15,000 specialists and has an annual revenue of over $2.1 billion. In a press statement on Friday, the company disclosed a data breach that forced it to shut down IT systems and launch an investigation to determine the scope of impact.
Microsoft will limit Exchange Online bulk emails to fight spam
Microsoft has announced plans to fight spam by imposing a daily Exchange Online bulk email limit of 2,000 external recipients starting January 2025. Exchange Online doesn’t support sending bulk or high volumes of emails from a single account, and until now, Microsoft has not placed any restrictions on bulk emails. However, with its plans for new External Recipient Rate (ERR) limits, the company wants to prevent customers from abusing Exchange Online resources and restricting unfair usage.
Crickets from Chirp Systems in Smart Lock Key Leak
The U.S. government is warning that “smart locks” securing entry to an estimated 50,000 dwellings nationwide contain hard-coded credentials that can be used to remotely open any of the locks. The lock’s maker Chirp Systems remains unresponsive, even though it was first notified about the critical weakness in March 2021. Meanwhile, Chirp’s parent company, RealPage, Inc., is being sued by multiple U.S. states for allegedly colluding with landlords to illegally raise rents.
Cloned Voice Tech Is Coming for Bank Accounts
At many financial institutions, your voice is your password. Tiny variations in pitch, tone and timbre make human voices unique – apparently making them an ideal method for authenticating customers phoning for service. Major banks across the globe have embraced voice print recognition. It’s an ideal security measure, as long as computers can’t be trained to easily synthesize those pitch, tone and timbre characteristics in real time. They can. Generative artificial intelligence bellwether OpenAI in late March announced a preview of what it dubbed Voice Engine, technology that with a 15-second audio sample can generate natural-sounding speech “that closely resembles the original speaker.”
Russia and Ukraine Top Inaugural World Cybercrime Index
Russia, Ukraine and China harbor the greatest cybercriminal threat, according to the first World Cybercrime Index (WCI). This world-first cybercrime ranking is the result of work by an international team of academic researchers who surveyed 92 leading cybercrime experts and analyzed the results following a scientific methodology. The research project for the World Cybercrime Index took four years to complete. The scientific paper backing the Index, titled Mapping the Global Geography of Cybercrime with the World Cybercrime Index, was in the PLOS ONE journal published on April 10, 2024.
