Canon DSLR Cameras Can Be Hacked With Ransomware Remotely

The threat of ransomware is becoming more prevalent and severe as attackers’ focus has now moved beyond computers to smartphones and other Internet-connected smart devices. In its latest research, security researchers at cybersecurity firm CheckPoint demonstrated how easy it is for hackers to remotely infect a digital DSLR camera with ransomware and hold private photos and videos hostage until victims pay a ransom.

High-security locks for government and banks hacked by researcher

Hackers could crack open high-security electronic locks by monitoring their power, allowing thieves to steal cash in automated teller machines, narcotics in pharmacies and government secrets, according to research to be presented Friday at the annual Def Con hacking conference in Las Vegas. Mike Davis, a researcher with security firm IOActive, discovered the vulnerability last year and alerted government officials and Swiss company DormaKaba Holding (DOKA.S), the distributor of multiple brands of locks at issue. In an interview with Reuters, Davis said he used an oscilloscope worth about $5,000 to detect small changes in the power consumption, through what is known as a side-channel attack.

Zoncolan: How Facebook uses static analysis to detect and prevent security issues

Zoncolan helps security engineers scale their work by using static analysis to examine code and detect security or privacy issues. Facebook’s web codebase currently contains more than 100 million lines of Hack code, and changes thousands of times per day. To handle the sheer volume of code, we build sophisticated systems that help our security engineers review code.

Huawei Firmware Analysis Reveals Security Problems

Finite State located significant security issues in Huawei firmware images, including memory corruption, hardcoded encryption keys, and unsafe functions used in place of the secure alternatives.

Source: infoq.com

These Legit-Looking iPhone Lightning Cables Will Hijack Your Computer

It looks like an Apple lightning cable. It works like an Apple lightning cable. But it will give an attacker a way to remotely tap into your computer.

I plugged the Apple lightning cable into my iPod and connected it to my Mac, just as I normally would. My iPod started charging, iTunes detected the device, and my iPod produced the pop-up asking if I wanted to trust this computer. All expected behaviour.

New advanced malware, possibly nation sponsored, is targeting US utilities

A new piece of advanced espionage malware, possibly developed by a nation-supported attacker, targeted three US companies in the utilities industry last month, researchers from security firm Proofpoint reported on Thursday. Employees of the three unnamed companies, Proofpoint reported, received emails purporting to come from the National Council of Examiners for Engineering and Surveying. This non-profit group develops, administers, and scores examinations used in granting licenses for US engineers.

US Cities Are Helping People Buy Amazon Surveillance Cameras Using Taxpayer Money

The Ring doorbell surveillance camera sits squarely in the center of a Tiffany-blue online flyer, which provides details about a “Security Product Subsidy Event” in Arcadia, California. This isn’t an ad from Best Buy or an electronics store. It’s an ad from the Arcadia city government.

The local city government is selling discounted surveillance cameras directly to its residents, and the ‘discount’ is subsidized by the city. In other words, taxpayer money is being paid to Ring, Amazon’s home surveillance company, in exchange for hundreds of surveillance cameras. Cities and towns around the country are paying Ring up to $100,000 to subsidize the purchase of the company’s surveillance cameras for private residents.

A Military Contractor Is Flying Spy Balloons High Over the Midwest

The United States military is now testing high-altitude surveillance balloons across the Midwest, according to documents a military contractor filed with the Federal Communications Commission. The news was first reported by The Guardian.

The filing states the intent of military contractor Sierra Nevada Corporation is to ‘provide a persistent surveillance system to locate and deter narcotics trafficking and homeland security threats.” The Guardian reported these have been launched and tested across South Dakota, Minnesota, Iowa, Wisconsin, Missouri, and Illinois.

New Dragonblood vulnerabilities found in WiFi WPA3 standard

Earlier this year in April, two security researchers disclosed details about five vulnerabilities (collectively known as Dragonblood) in the WiFi Alliance’s recently launched WPA3 WiFi security and authentication standard. Yesterday, the same security researchers disclosed two new additional bugs impacting the same standard. The two researchers — Mathy Vanhoef and Eyal Ronen — found these two new bugs in the security recommendations the WiFi Alliance created for equipment vendors in order to mitigate the initial Dragonblood attacks.

GitHub sued for aiding hacking in Capital One breach

Capital One and GitHub have been sued this week as part of a class-action lawsuit filed in California on allegations of failing to secure or prevent a security breach during which the personal details of more than 106 million users were stolen by a hacker. While Capital One is named in the lawsuit because it was its data that the hacker stole, GitHub was also included because the hacker posted details about the hack on the code-sharing site. The lawsuit claims that ‘decisions by GitHub’s management […] allowed the hacked data to be posted, displayed, used, and/or otherwise available.’

Researchers Discover New Ways to Hack WPA3 Protected WiFi Passwords

The same team of cybersecurity researchers who discovered several severe vulnerabilities, collectively dubbed as Dragonblood, in the newly launched WPA3 WiFi security standard few months ago has now uncovered two more flaws that could allow attackers to hack WiFi passwords.

Source: thehackernews.com

5G Is Here—and Still Vulnerable to Stingray Surveillance

At the Black Hat security conference in Las Vegas next week, a group of network communication security researchers will present findings on flaws in the 5G protections meant to thwart the surveillance devices known as stingrays. Also called ‘IMSI catchers’ after the international mobile subscriber identity number attached to every cell phone, stingrays masquerade as legitimate cell towers. Once they trick a device into connecting to it, a stingray uses the IMSI or other identifiers to track the device, and even listen in on phone calls.

Unplugging From Digital Controls to Safeguard Power Grids

Late last week, the U.S. House of Representatives passed legislation to mandate federal research on a radically ‘retro’approach to protect power grids from cyber attack: unplugging or otherwise isolating the most criticalequipment from grid operators’ digital control systems. Angus King, an independent senator from Maine whose identical bill passedthe Senate last month, says such a managed retreat from networked controls may berequired to thwart the grid’s most sophisticated online adversaries. Grid cyber experts say the Securing Energy Infrastructure Act moving through Congress isa particular testament toMichael Assante, a gifted and passionate cybersecurity expert whodied earlier this monthfrom leukaemia at the age of 48.

Cybersecurity in the Automotive Industry

Forescout estimates that ‘software in modern cars exceeds 100 million lines of code’ — 15 times greater than in avionics software. That means that hackers have numerous points of entry, whether it’s through mobile apps, cell phone networks, internet access, the vehicle’s Controller Area Network (CAN) bus, or even the onboard diagnostics port. A 2019 Synopsys and SAE study showed that 84% of surveyed automotive professionals worry their current cybersecurity programs aren’t keeping up with the technology they support.

Zoncolan: How Facebook uses static analysis to detect and prevent security issues

Facebook’s web codebase currently contains millions of lines of Hack code. To handle the sheer volume of code, we build sophisticated systems and tools to augment the comprehensive reviews our security engineers conduct. Today, we are sharing the details of one of those tools, called Zoncolan, for the first time.

Zoncolan helps security engineers scale their work by using static analysis to automatically examine our code and detect potentially dangerous security or privacy issues.

Amazon allegedly scammed out of $370K by 22-year-old’s return shipments of dirt

James Gilbert Kwarteng, of Palma de Mallorca, Spain, allegedly swindled Amazon by filling up the ordered items’ boxes with dirt and registering with the exact weight of the product. He would then receive a refund from Amazon and sell the original item, according toEl EspañolandEl Diario de Mallorca. The return packages would end up sitting around in Amazon’s warehouses where they aren’t checked often.

A Technical Analysis of the Capital One Hack

The recent disclosure of yet another cloud security misconfiguration leading to the loss of sensitive personal information made the headlines this past week. This particular incident came with a bit more information from the indictment of the accused party, allowing us to piece together the revealed data and take an educated guess as to what may have transpired leading up to the loss of over 100 million credit card applications and 100 thousand social security numbers. At the root of the hack lies a common refrain: the misconfiguration of cloud infrastructure resources allowed an unauthorized user to elevate her privileges and compromise sensitive documents.

The Technical Side of the Capital One AWS Security Breach

On July 19th, 2019 Capital One got the red flag that every modern company hopes to avoid – their data had been breached. Over 106 million people affected.

140,000 Social Security numbers. 80,000 bank account numbers. 1,000,000 Social Insurance Numbers.

Pretty messy right? Unfortunately, the 19th wasn’t when the breach occurred.

It turns out that Paige Thompson, aka Erratic, had done the deed between March 22nd and March 23rd 2019.

Capital One Data Theft Impacts 106M People

On July 29, FBI agents arrested Paige A. Thompsonon suspicion of downloading nearly 30 GB of Capital One credit application data from a rented cloud data server. Capital One said the incident affected approximately 100 million people in the United States and six million in Canada. That data included approximately 140,000 Social Security numbers and approximately 80,000 bank account numbers on U.S. consumers, and roughly 1 million Social Insurance Numbers (SINs) for Canadian credit card customers.

Russia’s Secret Intelligence Agency Hacked: ‘Largest Data Breach In Its History’

Red faces in Moscow this weekend, with the news that hackers have successfully targetedFSB—Russia’s Federal Security Service. The hackers managed to steal 7.5 terabytes of data from a major contractor, exposing secret FSB projects to de-anonymize Tor browsing, scrape social media, and help the state split its internet off from the rest of the world. The data was passed to mainstream media outlets for publishing.