08 Aug 2024
By Mary

InfoSec News Nuggets 8/8/2024

This Attack Pushes Windows Update to the Dark Side If a powerful program reached into your Windows operating system and made fundamental changes to its functionality, including changes to security, you might consider it a dangerous attack on system integrity. But when that powerful program is Windows Update, well, it’s just fine. Every month, sometimes more often, Windows Update does its thing. Alon Leviev, Security Researcher at SafeBreach, scrutinized the process for ways malware coders might misuse…
Read More
15 Dec 2023
By Mary

InfoSec News Nuggets 12/15/2023

How worried should we be about the “AutoSpill” credential leak in Android password managers?  By now, you’ve probably heard about a vulnerability named AutoSpill, which can leak credentials from any of the seven leading password managers for Android. The threat it poses is real, but it’s also more limited and easier to contain than much of the coverage to date has recognized. This FAQ dives into the many nuances that make AutoSpill hard for most people (yours truly included)…
Read More
04 Apr 2023
By Mary

InfoSec News Nuggets 04/04/2023

IRS System Doesn’t Meet All Cloud Security Requirements, Watchdog Says  The IRS’s Enterprise Case Management System did not always meet established cloud security requirements, the Treasury Department’s Inspector General found. In a new report, the IG found the IRS did not meet every agency guideline for cloud operations, despite running the ECM system—a hybrid cloud system aimed at modernizing and consolidating the IRS’s legacy case management system—under the agency’s cloud authorization. The system “processes and stores sensitive…
Read More
30 Jan 2023
By Mary

InfoSec News Nuggets 01/30/2023

New 'Pig Butchering' Scam in West Africa Impersonates US Financial Advisors  A malicious campaign impersonating American financial advisors has been spotted targeting several hundred individuals in West Africa. Recently discovered by cybersecurity experts at DomainTools, the 'pig butchering' operation uses a complex network of social engineering techniques to defraud victims. Describing the activity in an advisory shared with Infosecurity, DomainTools said most attacks from the unnamed threat actor used professional network services such as LinkedIn to identify, research and contact potential…
Read More
25 Nov 2022
By Mary

InfoSec News Nuggets 11/25/2022

U.S. govt seizes domains used in 'pig butchering' scams For the first time, the U.S. Department of Justice seized seven domains that hosted websites linked to "pig butchering" scams, where fraudsters trick victims of romance scams into investing in cryptocurrency via fake investment platforms. The list of domains seized includes simexcbr.com, simexlua.com, simexwim.com, simexarts.com, simexrue.com, simexvtn.com, and simexbiz.com, all of them spoofing the one used by the Singapore International Monetary Exchange (SIMEX). While originating from…
Read More
06 Oct 2022
By Mary

InfoSec News Nuggets 10/06/2022

Former Uber security chief convicted of covering up 2016 data breach  A former chief security officer for Uber was convicted Wednesday of federal charges stemming from payments he quietly authorized to hackers who breached the ride-hailing company in 2016. Joe Sullivan was found guilty of obstructing justice for hiding the breach from the Federal Trade Commission, which had been probing Uber’s privacy protections at the time, and of actively hiding a felony. The verdict ended a dramatic…
Read More