InfoSec News Nuggets 04/06/2021

Technology could make fighting COVID less restrictive but privacy will take a hit Now that the world has completed a full circuit around the Sun with COVID as a passenger, it is possible to see which jurisdictions responded well, and which are still struggling to come to grips with the virus. Two of the nations held up as exemplars of how to fight COVID were Taiwan and New Zealand, but the approaches were very different: One has…
Read More

InfoSec News Nuggets 04/05/2021

Virginia lawmakers unanimously approve bill that bans facial recognition technology In February, Virginia lawmakers from both parties unanimously approved a bill that would restrict the use of facial recognition technology. Right now, law enforcement agencies across the state can use this technology without the knowledge of local or state leaders. Your images could be in these systems without you even knowing it. Under the bill, any law enforcement agency using facial recognition technology must stop, and they…
Read More

InfoSec News Nuggets 04/02/2021

Update on campaign targeting security researchers In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers. On March 17th, the same actors behind those attacks set up a new website with associated social media profiles for a fake company called “SecuriElite.” The new website claims the company is an offensive security company located in Turkey that offers pentests, software security assessments and…
Read More

InfoSec News Nuggets 04/01/2021

Research shows Google collects 20x more data from Android than Apple collects from iOS Tech companies have been talking more about privacy in recent years, and Apple proudly says that it protects user data more than anyone else. This week, new research by Douglas Leith from Trinity College showed that Google collects up to 20 times more data from Android users compared to the data Apple collects from iOS users.  As reported by Ars Technica, the…
Read More

InfoSec News Nuggets 03/31/2021

Intel Sued Under Wiretapping Laws for Tracking User Activity on its Website Intel is being sued under a Florida state wiretapping law for using software on its website to capture keystrokes and mouse movements of people that visit it. The case is one of many that private citizens have brought against companies to dispute their use of session-replay technology. A class-action suit (PDF) in the Circuit Court of the Fifth Judicial Circuit In and For Lake County,…
Read More

InfoSec News Nuggets 03/30/2021

Ransomware gang leaks data from US military contractor the PDI Group A major supplier of military equipment to the US Air Force and militaries across the globe appears to have fallen victim to a ransomware attack. The victim is the PDI Group, an Ohio-based company that manufactures a wide range of ground support equipment for military needs, such as dollies, trollies, and platforms for transporting weapons, engines, and airplane parts during servicing operations. On Tuesday, the…
Read More

InfoSec News Nuggets 03/29/2021

Credit Card Hacking Forum Gets Hacked, Exposing 300,000 Hackers’ Accounts Carding Mafia, a forum for stealing and trading credit cards has been hacked, exposing almost 300,000 user accounts, according to data breach notification service Have I Been Pwned. The data breach allegedly exposed the email addresses, IP addresses, usernames, and hashed passwords of 297,744 users. Have I Been Pwned announced the data breach on Tuesday, saying the breach happened last week. On the Carding Mafia forum and its public…
Read More

InfoSec News Nuggets 03/26/2021

Identity Fraud Losses Soared to $56 Billion in 2020, Javelin Researchers Find Fraud losses climbed to $56 billion in 2020 and identity fraud scams accounted for a staggering $43 billion of that cost, according to a new report. The reduction in transaction activity in 2020, combined with financial institutions’ more robust antifraud measures, made it harder for criminals to succeed in their ‘traditional’ fraud activities, according to Javelin Strategy & Research, which provides insights for financial…
Read More

InfoSec News Nuggets 03/25/2021

Amazon Delivery Drivers Forced to Sign ‘Biometric Consent’ Form or Lose Job Amazon delivery drivers nationwide have to sign a "biometric consent" form this week that grants the tech behemoth permission to use AI-powered cameras to access drivers' location, movement, and biometric data. If the company’s delivery drivers, who number around 75,000 in the United States, refuse to sign these forms, they lose their jobs. The form requires drivers to agree to facial recognition and other…
Read More

InfoSec News Nuggets 03/24/2021

TikTok no worse than Facebook for privacy, says Citizen Lab TikTok is likely no more of a threat to users than Facebook, according to an analysis by academic research group Citizen Lab that analyzed the video-sharing social networking service’s app to probe for security, privacy and censorship issues. The report was published online on March 22 by the University of Toronto Lab, which focuses on civil digital threats and high-level policy engagement. The authors considered both…
Read More

InfoSec News Nuggets 03/23/2021

Popular remote lesson monitoring program could be exploited to attack student PCs Researchers have uncovered a slew of critical vulnerabilities in remote monitoring software -- an incident made worse as it could impact student safety and privacy.  On Monday, McAfee disclosed the existence of multiple security holes in Netop Vision Pro, popular monitoring software adopted by schools for teachers to control remote learning sessions. The software is marketed for teachers to keep control of lessons. Features include…
Read More

InfoSec News Nuggets 03/22/2021

~4,300 publicly reachable servers are posing a new DDoS hazard to the Internet Criminals are upping the potency of distributed denial-of-service attacks with a technique that abuses a widely used Internet protocol that drastically increases the amount of junk traffic directed at targeted servers. DDoSes are attacks that flood a website or server with more data than it can handle. The result is a denial of service to people trying to connect to the service.…
Read More

InfoSec News Nuggets 03/19/2021

FBI: Cybercrime losses exceeded $4.2 billion in 2020 According to the 2020 Internet Crime Report [PDF], the FBI said it received 791,790 internet and cybercrime complaints in 2020, more than 69% than the 467,361 reports it received in 2019. Total losses were also up. The FBI said victims reported more than $4.2 billion in lost funds last year, 20% up from the $3.5 billion reported in 2019. Both figures —complaints and total losses— represent the…
Read More

InfoSec News Nuggets 03/18/2021

Apple Maps now displays COVID-19 vaccination locations Apple today updated Apple Maps with COVID-19 vaccination locations from VaccineFinder, a free, online service developed by Boston Children’s Hospital that provides the latest vaccine availability for those eligible at providers and pharmacies throughout the US. Users can find nearby COVID-19 vaccination locations from the Search bar in Apple Maps by selecting COVID-19 Vaccines in the Find Nearby menu or by asking Siri, “Where can I get a COVID…
Read More

InfoSec News Nuggets 03/17/2021

Half of Americans Experienced Identity Theft During COVID-19 Pandemic, New Study Shows A new report uncovers a striking pervasiveness of identity theft perpetrated against U.S. consumers where half of respondents surveyed experienced such an occurrence during the pandemic. Developed by Aite Group and underwritten by GIACT, the study found that 47% of U.S. consumers experienced identity theft between 2019 and 2020. And over the past two years, 37% of Americans experienced application fraud (i.e., the unauthorized use…
Read More

InfoSec News Nuggets 03/16/2021

Google Can Be Sued for Tracking Users in Private Browsing Mode, Judge Says A U.S. district judge in California has stated that Google can be sued for collecting data on users even when they use “private browsing mode” on their selected browsers. The lawsuit in question is a class action brought forward by three Google users—Chasom Brown, Maria Nguyen, and William Byatt—who used private browsing mode in Chrome and in Safari, Apple’s web browser, in recent years. It claims that Google…
Read More

InfoSec News Nuggets 03/15/2021

Former Facebook insiders explain why the company is making such a big fuss over Apple’s upcoming privacy change For the past few weeks, Facebook has been running an ad campaign in defense of personalized advertisements, arguing that targeted ads are key to the success of small businesses. The catalyst for the campaign has been an ongoing battle between the social media company and Apple. The battle focuses on a unique device identifier on every iPhone and iPad called the IDFA.…
Read More

InfoSec News Nuggets 03/12/2021

Comcast scrambled to fix mistake that cut some users’ upload speeds by 20% Some Comcast customers received an unwelcome surprise yesterday morning when their upload speeds were suddenly lowered from 20Mbps to 16Mbps. Comcast was raising download speeds on its "Extreme Pro" tier from 600Mbps to 800Mbps—good news, to be sure—but the plan's relatively paltry 20Mbps upload speeds received a simultaneous 20 percent cut. Customers affected by the change complained to Comcast, and two of…
Read More

InfoSec News Nuggets 03/11/2021

OVHcloud data centers engulfed in flames On March 10, OVHcloud founder and chairman Octave Klaba started a Twitter thread updating customers on the situation, which has claimed at least one data center. OVHcloud is a global cloud, dedicated server, and managed bare metal services provider catering to over 1.5 million customers.  The company manages 27 data centers in countries including the US, UK, France, and Australia.  As data centers manage vast quantities of data for customers, providers have to be…
Read More

InfoSec News Nuggets 03/10/2021

Stalkers won’t be able to track victims via hidden AirTags It won’t be possible for someone to hide an AirTag on you and track your location without permission. iPhones will notify their users if one of Apple’s item tracker tags is moving along with them. AirTags haven’t been formally announced, but the latest iOS 14.5 beta adds an “Items” tab to the built-in Find My application so users can search for these tags. A setting in the…
Read More

InfoSec News Nuggets 03/09/2021

Robocalls keep spamming Americans, in part because of their cyber tools After a surprising lull at the onset of the COVID-19 pandemic, phone scammers are back, and showing signs of overlapping more and more with text messages and cyber elements. Scammers are combining phone calls with tricks to circumvent two-factor authentication, using information they obtain online to make more targeted calls and, in some cases, mimicking the attack methods of hackers, government and industry officials…
Read More

InfoSec News Nuggets 03/08/2021

What is the dark web and what does it mean for cyber security? The dark web, or darknet, is the part of the internet that is difficult to access without the proper tools and authorizations. An average, everyday web surfer using a commonly-available web browser like Chrome or Explorer isn't likely to be taking a virtual walk on the dark side, but security leaders still must make an effort to understand the threats the darknet…
Read More

InfoSec News Nuggets 03/05/2021

Real estate group in Las Vegas launches fully autonomous security robot A new spin to security. The Westland Real Estate Group has launched a fully autonomous security robot at its Liberty Village Apartments in northeast Last Vegas. The security robot is the first in the world to be used in a multi-family residence in an effort to improve the safety and security of residents. The security robot monitors the property through video and thermal-imaging cameras.…
Read More

InfoSec News Nuggets 03/04/2021

An AI Was Taught to Play the World's Hardest Video Game and Still Couldn't Set a New Record What’s the hardest video game you’ve ever played? If it wasn’t QWOP then let me tell you right know that you don’t know how truly difficult a game can be. The deceptively simple running game is so challenging to master that even an AI trained using machine learning still only mustered a top 10 score instead of shattering the record. Wesley Liao was…
Read More

InfoSec News Nuggets 03/03/2021

World's leading dairy group Lactalis hit by cyberattack Lactalis, the world's leading dairy group, has disclosed a cyberattack after unknown threat actors have breached some of the company's systems. Lactalis (short for Lactalis Group) has 85,000 employees in 51 countries, and it exports dairy products to over 100 countries around the world. The dairy group controls multiple leading international brands, including Président, Galbani, Lactel, Santal, and Parmalat.  In a press release published on Friday, Lactalis says that only a limited number…
Read More

InfoSec News Nuggets 03/02/2021

The Rise of Vendor-Owned News Sites Underscores the Appetite for Cybersecurity Information One of the most prolific cybersecurity journalists, Catalin Cimpanu of ZDNet, left the popular CBS-owned tech publication on Friday. Today he joins The Record, a publication backed by the cybersecurity firm Recorded Future. (Catalin’s jump to Recorded Future is occurring the day after the firm issued a report on its startling discovery that a Chinese state-sponsored hacking group dubbed Red Echo introduced malware into Indian power…
Read More

InfoSec News Nuggets 03/01/2021

78% of top security leaders say their organizations are unprepared for a cyberattack Seventy-eight percent of senior IT and security leaders believe their organizations lack sufficient protection against cyberattacks, according to research conducted by IDG Research Services on behalf of Insight. The high level of concern expressed by these leaders resulted in 91% of organizations increasing their cybersecurity budgets in 2021 — a figure that nearly matches the 96% that boosted IT security spending in…
Read More

InfoSec News Nuggets 02/26/2021

The NYPD Sent a Creepy Robotic Dog Into a Bronx Apartment Building The largest police department in the country deployed its new K-9 companion into a Bronx apartment building while responding to a home invasion early Tuesday morning. But this particular K-9 wasn’t as cute, cuddly or even furry like its mammalian colleagues. Instead, this good boy features four metal and rubber legs, a face only perhaps only a Cylon could love, and all the grace…
Read More

InfoSec News Nuggets 02/25/2021

Firefox 86 Introduces Total Cookie Protection Cookies, those well-known morsels of data that web browsers store on a website’s behalf, are a useful technology, but also a serious privacy vulnerability. That’s because the prevailing behavior of web browsers allows cookies to be shared between websites, thereby enabling those who would spy on you to “tag” your browser and track you as you browse. This type of cookie-based tracking has long been the most prevalent method…
Read More

InfoSec News Nuggets 02/24/2021

Cybersecurity and online gaming: Don’t be a victim The proliferation of technology and internet connectivity has made it possible for people to seek out most things online, and gaming and gambling are not exceptions. In addition to online video games, social media, music, and video streaming, there are also online casinos and gambling for real money. Well, for gambling in the USA there are state laws to mind, but in some states online gambling is…
Read More

InfoSec News Nuggets 02/23/2021

Clubhouse Chats Are Breached, Raising Concerns Over Security A week after popular audio chatroom app Clubhouse said it was taking steps to ensure user data couldn’t be stolen by malicious hackers or spies, at least one attacker has proven the platform’s live audio can be siphoned. An unidentified user was able to stream Clubhouse audio feeds this weekend from “multiple rooms” into their own third-party website, said Reema Bahnasy, a spokeswoman for Clubhouse. While the…
Read More

InfoSec News Nuggets 02/22/2021

Clubhouse under scrutiny for sending data to Chinese servers Clubhouse was launched about a year ago and was initially only used by Silicon Valley’s rich and famous. It is different from other social media in that it focuses on the spoken word. Clubhouse members can enter virtual rooms to listen in or participate in live conversations. The conversations can only be joined when they are live and the people having the conversation determine who is…
Read More

InfoSec News Nuggets 02/19/2021

Apple will only approve COVID-19 vaccination apps verified by health authorities It may not be enough just to get vaccinated against COVID-19 -- you may also need proof that you've completed the vaccination course to be able to travel, to go to school or to enter establishments in the immediate future. That's why apps providing proof of vaccination you can easily take with you have started popping up, and why Apple has conjured up a rule to…
Read More

InfoSec News Nuggets 02/18/2021

Jones Day is latest major law firm affected by vendor data breach Jones Day confirmed Tuesday that a file transfer platform it used was recently compromised, and that the firm is investigating the breach and talking with affected clients. Hackers that go by the name Clop claim to have stolen files belonging to Jones Day and posted screenshots on the dark web, according to by DataBreaches.net, which posted redacted images of firm correspondence over the…
Read More

InfoSec News Nuggets 02/17/2021

Copycats emerge after researcher exploits design flaw to breach Microsoft, Apple, Tesla Pseudonymous authors published more than 150 copycat packages just three days after Sonatype published research around a software supply chain flaw, attempting to exploit the vulnerabilities in the brief window before a patch. Ethical hacker and security researcher Alex Birsan posted a blog on Feb. 9 that detailed how he used dependency, or namespace confusion, “to push his malicious proof-of-concept (PoC) code to internal…
Read More

InfoSec News Nuggets 02/16/2021

AT&T scrambles to install fiber for 90-year-old after his viral WSJ ad When 90-year-old Aaron Epstein bought a Wall Street Journal print ad to complain about his slow AT&T Internet service, the impact was immediate. Reporters like me called him and wrote articles, talk of his plight went viral on the Internet, his ad made an appearance on Stephen Colbert's Late Show, TV networks interviewed him for nightly news broadcasts, and AT&T executives sprang into action…
Read More

InfoSec News Nuggets 02/12/2021

Tax Scammers Are Getting Sneakier. Here's How to Spot the Latest Cons The 2021 tax season starts on Friday, Feb. 12, which means it’s time to get your paperwork in order. It’s also time to be on the lookout for scam artists targeting those of us feeling a little overwhelmed as the April 15 deadline gets closer. Tax-related scams are nothing new, according to Howard Silverstone, a member of the American Institute of CPA’s Fraud…
Read More

InfoSec News Nuggets 02/11/2021

Accused murderer wins right to check source code of DNA testing kit used by police A New Jersey appeals court has ruled that a man accused of murder is entitled to review proprietary genetic testing software to challenge evidence presented against him. Attorneys defending Corey Pickett, on trial for a fatal Jersey City shooting that occurred in 2017, have been trying to examine the source code of a software program called TrueAllele to assess its reliability. The…
Read More

InfoSec News Nuggets 02/10/2021

Microsoft to alert enterprise security teams when nation-state attackers target their employees Microsoft will introduce this month a new security alert that will notify enterprise security teams when an employee is being targeted by suspected nation-state attackers. The notification will appear in the dashboard of Microsoft Defender for Office 365, a cloud-based email filtering service that protects enterprise Office 365 users against advanced and targeted threats (e.g., BEC, credential phishing, etc.), so that security teams…
Read More

InfoSec News Nuggets 02/09/2021

Bill would allow tech companies to create local governments If you’ve got enough money, acres upon acres of undeveloped land and an “innovative technology,” you soon could form a new local government in Nevada. When Gov. Steve Sisolak last month announced his plan to launch Innovation Zones in Nevada to jump-start the state’s economy by attracting new tech companies, the details of how those zones would operate proved scarce. According to a draft of the…
Read More

InfoSec News Nuggets 02/08/2021

How will 'chipageddon' affect you? For the most part they go unseen but computer chips are at the heart of all the digital products that surround us - and when supplies run short, it can halt manufacturing. There was a hint of the problem last year when gamers struggled to buy new graphics cards, Apple had to stagger the release of its iPhones, and the latest Xbox and PlayStation consoles came nowhere close to meeting demand. Then,…
Read More

InfoSec News Nuggets 02/05/2021

Scammers posing as FBI agents threaten targets with jail time The U.S. Federal Bureau of Investigation (FBI) is warning of scammers actively posing as FBI representatives and threatening targets with fines and jail time unless they don't hand out personal and/or financial information. As the FBI warns, the agency has received multiple reports of such scam attempts where the fraudsters are targeting North Florida residents attempting to steal their personal info. Additionally, "multiple versions of…
Read More

InfoSec News Nuggets 02/04/2021

SCIENTISTS HAVE TAUGHT SPINACH TO SEND EMAILS AND IT COULD WARN US ABOUT CLIMATE CHANGE Through nanotechnology, engineers at MIT in the US have transformed spinach into sensors capable of detecting explosive materials. These plants are then able to wirelessly relay this information back to the scientists. When the spinach roots detect the presence of nitroaromatics in groundwater, a compound often found in explosives like landmines, the carbon nanotubes within the plant leaves emit a signal. This…
Read More

InfoSec News Nuggets 02/03/2021

Facebook strikes back against Apple privacy change, prompts users to accept tracking to get ‘better ads experience’ With a forthcoming update to iOS 14, each app that wants to use these identifiers will ask users to opt in to tracking when the app is first launched. If users opt out, it will make these ads a lot less effective. Facebook has warned investors that these looming changes could hurt its advertising business as soon as this quarter.…
Read More

InfoSec News Nuggets 02/02/2021

Check if your photos were used to develop facial recognition systems with this free tool If you’ve uploaded any photos to the web in recent years, there’s a good chance they’ve been used to build facial recognition systems. Developers routinely train facial recognition algorithms on images from websites — without the knowledge of the people who posted them. A new online tool called Exposing.AI can help you find out if your photos are among the snaps they’re…
Read More

InfoSec News Nuggets 02/01/2021

New Spotify Patent Involves Monitoring Users’ Speech to Recommend Music Spotify has been granted a patent with technology that aims to use recordings of users’ speech and background noise to determine what kind of music to curate and recommend to them, Music Business Worldwide reports. The company filed for the patent in 2018; it was approved on January 12, 2021. The patent outlines potential uses of technology that involves the extraction of “intonation, stress, rhythm, and the likes of units…
Read More

InfoSec News Nuggets 01/29/2021

Arrest, Seizures Tied to Netwalker Ransomware U.S. and Bulgarian authorities this week seized the darkweb site used by the NetWalker ransomware cybercrime group to publish data stolen from its victims. In connection with the seizure, a Canadian national suspected of extorting more than $27 million through the spreading of NetWalker was charged in a Florida court. NetWalker is a ransomware-as-a-service crimeware product in which affiliates rent access to the continuously updated malware code in exchange for a…
Read More

InfoSec News Nuggets 01/28/2021

23M Gamer Records Exposed in VIPGames Leak VIPGames.com, a free platform with a total of 56 available classic board and card games like Hearts, Crazy Eights, Euchre, Dominoes, Backgammon and others, has exposed the personal data of tens of thousands of users. In all, more than 23 million records for more than 66,000 users were left exposed thanks to a cloud misconfiguration, according to a new report from WizCase. Aside from its desktop users, VIPGames…
Read More

InfoSec News Nuggets 01/27/2021

North Korean hackers are targeting security researchers with malware, 0-days A North Korean government-backed hacking group targets security researchers who focus on vulnerability and exploit development via social networks, disclosed Google tonight. According to a report released tonight by Google's Threat Analysis Group, a North Korean government-backed hacking group uses social networks to target security researchers and infect their computers with a custom backdoor malware. The threat actors create fake Twitter profiles and blogs to…
Read More

InfoSec News Nuggets 01/26/2021

Apple launches ‘Time to Walk’ for Fitness+ with Dolly Parton, Draymond Green, others Apple today launched a new component of Fitness+ designed to get people out of their homes and away from their TVs. Called Time to Walk, it’s the first outdoor component of Fitness+ and opens the service up to a new world of workouts. Apple seemingly goes out of its way to not call them podcasts, but Time to Walk is a very much in the vein.…
Read More