U.S. Nuclear Contractor Hit with Maze Ransomware, Data Leaked

A U.S. military contractor involved in the maintenance of the country’s Minuteman III nuclear arsenal has been hit by the Maze ransomware, according to reports – with the hackers making off with reams of sensitive information. The company, Westech International, has a range of contracts with the military for everything from ongoing evaluation for the ballistic missile defense system in Colorado, to a role as a sub-contractor for Northrup Grumman. In the latter capacity it provides engineering support, repair and maintenance for ground subsystems components involved in the Minuteman III intercontinental ballistic missile (ICBM) program.

Critical flaw could have allowed attackers to control traffic lights

The flaw, tracked as CVE-2020-12493, is an “improper access control” issue that could allow hackers to grant root access to the device without access control via network. The flaw could be exploited by low-skilled attackers, it was rated with a CVSS score of 10 and affects all OS versions starting with G4 SWARCO of CPU LS4000. ProtectEM researchers reported the vulnerability to the vendor in July 2019, which released a patch in April.

Google’s indexing of WhatsApp numbers raises privacy concerns

Earlier this year, Bleeping Computer reported how invite links to private groups of messaging apps like WhatsApp and Telegram were visible on Google, letting anyone join the groups. This week, security researcher Athul Jayaram highlighted an issue with WhatsApp’s “wa.me” domain “leaking” contact phone numbers on Google. As stated by Jayaram and confirmed by BleepingComputer, there is no “robots.txt” file on “wa.me” or “api.whatsapp.com” domains that instructs search engines not to crawl phone numbers on the website.

The $100,000 bug in Sign in with Apple

In the month of April, I found a zero-day in Sign in with Apple that affected third-party applications which were using it and didn’t implement their own additional security measures. This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not. For this vulnerability, I was paid $100,000 by Apple under their Apple Security Bounty program.

$350 USB Stick That Claims to Block 5G Is Actually a $6 Generic Thumb Drive

Security firm Pen Test Partners ordered the 5GBioShield, and found that it’s just a cheap unbranded USB stick likely made in Shenzhen, China. PCMag editors select and review products independently. We may earn affiliate commissions from buying links, which help support our testing.

Learn more. No, 5G won’t give you coronavirus. But that isn’t stopping scammers from trying to exploit misguided fears about the technology.

eBay port scans visitors’ computers for remote access programs

When visiting the eBay.com site, a script will run that performs a localport scan of your computer todetect remote support and remote management applications. Many of these ports are related to remote access/remote support tools such as the Windows Remote Desktop, VNC, TeamViewer, Ammy Admin, and more. After learning about this, BleepingComputer conducted a test and can confirm that eBay.com is indeed performing a local port scan of 14 different ports when visiting the site.

Police in China, Dubai, and Italy are using these surveillance helmets to scan people for COVID-19 fever as they walk past and it may be our future normal

Temperature-scanning $7,000 helmets can catch people running a fever. But experts are skeptical about how helpful temperature scanning will really be. Chinese police, health staff, and transport workers have been using smart helmets to monitor people for high temperatures in the fight against COVID-19.

Malicious tweets targeting epilepsy charity trigger seizures

At least two people had seizures after viewing malicious tweets featuring flashing gifs that deliberately targeted the Epilepsy Society. Thames Valley police said it was investigating the tweets as a hate incident, after at least 200 seemingly coordinated messages were sent to the charity and its supporters in recent days. A number of other people including children were traumatised by the tweets, the charity said, stressing that the images could trigger seizures in which teeth and bones are broken and might even be fatal.

Huge, mysterious list appears online of where people met, personal information and more of tens of millions

A huge data dump includes the personal information of tens of millions of people and where they have met – and its origin is a mystery. The breach includes almost 90GB of people’s personal data, including details of where they have been and met people. But there is no clue where the information has actually come from in the first place.

Mitch McConnell is pushing the Senate to pass a measure that would let the FBI collect Americans’ web-browsing history without a warrant

Another amendment blocking the FBI surveillance failed by just one vote Wednesday, bringing McConnell’s proposal one step closer to becoming law. The Senate is expected to vote Wednesday to renew the 2001 Patriot Act, and Mitch McConnell is pushing an amendment to the law that would expand the FBI’s surveillance powers. An amendment proposed by McConnell would, for the first time ever, let the FBI collect records on Americans’ web-browsing and search histories without a warrant.

The Original Cookie specification from 1997 was GDPR compliant

Cookies today are doing all kinds of bad things, but did you know that the original creators wanted to stop that? I had a discussion the other day about GDPR, ePrivacy and all those problems for publishers, and I pointed out that the way we think about this is wrong. We were never supposed to be able to do what most publishers and tech companies do today.

For 8 years, a hacker operated a massive IoT botnet just to download Anime videos

For 8 years, a hacker operated a massive IoT botnet just to download Anime videos The botnet consisted solely of D-Link NAS and NVR devices and the botnet peaked at 10,000 bots in 2015. Named Cereals and first spotted in 2012, the botnet reached its peak in 2015 when it amassed more than 10,000 bots.

Samsung patches 0-click vulnerability impacting all smartphones sold since 2014

Samsung patches 0-click vulnerability impacting all smartphones sold since 2014 Samsung patched this month a critical bug discovered by Google security researchers. South Korean smartphone vendor Samsung released this week a security update to fix a critical vulnerability impacting all smartphones sold since 2014. The security flaw resides in how the Android OS flavor running on Samsung devices handles the custom Qmage image format (.qmg), which Samsung smartphones started supporting on all devices released since late 2014.

New Firefox service will generate unique email aliases to enter in online forms

New Firefox service will generate unique email aliases to enter in online forms Firefox Private Relay add-on to help users safeguard their email addresses from spammers. Browser maker Mozilla is working on a new service called Private Relay that generates unique aliases to hide a user’s email address from advertisers and spam operators when filling in online forms. The service entered testing last month and is currently in a closed beta, with a public beta currently scheduled for later this year, ZDNet has learned.

Trump bans acquisition of foreign power grid equipment, citing hacking threats

President Donald Trump signed today an executive order barring US power grid entities from buying and installing electrical equipment that has been manufactured outside the US. Besides barring power grid operators from buying and installing new foreign equipment, the order also authorizes the Secretary of Energy to start procedures to identify current electrical equipment manufactured outside the US and develop strategies with government agencies and the private sector to have it isolated, monitored, and eventually replaced in the future. The US Department of Energy welcomed the new executive order.

Spyware slinger NSO to Facebook: Pretty funny you’re suing us in California when we have no US presence and use no American IT services

Last October, Facebook and its WhatsApp subsidiary sued the software developer and its affiliate Q Cyber Technologies in California, claiming that the firms made, distributed, and operated surveillance software known as Pegasus that remotely infects, hijacks, and extracts data from the smartphones of WhatsApp users. NSO Group then filed a motion to dismiss the hacking lawsuit, arguing that it can’t be sued in the US: it has immunity because its customers are governments. The social network last week responded by insisting the concept of sovereign immunity doesn’t apply to contractors working for foreign governments and NSO’s software relied on servers provided by Los Angeles-based telecom service provider QuadraNet.

The security behind the NHS contact tracing app

In this blog post, Ian Levy explains how the new NHS COVID-19 app will help us fight the coronavirus while protecting your privacy and security (and not draining your phone battery).

Source: gov.uk

Tesla has been getting rid of computers without wiping them

Tesla claims that the computers are supposed to be wiped before being thrown away, but he is only aware of a reset procedure that can be done at the factory but not at service centers. Either people dumpster dive to grab them and sell them to resellers and they end up on eBay, which is hardly “stealing,” or Tesla employees themselves sell the computers. You can see plenty of them available for sale on the website: Green told Electrek that he even heard about Tesla employees selling computers to third-party Tesla repairers: I know some people on the unauthorized repair side

Apple’s Copyright Lawsuit Has Created a ‘Chilling Effect’ on Security Research

Last year, Apple accused a cybersecurity startup based in Florida of infringing its copyright by developing and selling software that allows customers to create virtual iPhone replicas. Critics have called the Apple’s lawsuit against the company, called Corellium, “dangerous” as it may shape how security researchers and software makers can tinker with Apple’s products and code. The lawsuit, however, has already produced a tangible outcome: very few people, especially current and former customers and users, want to talk about Corellium, which sells the eponymous software that virtualizes iPhones and Android devices.

Children’s computer game Roblox employee bribed by hacker for access to millions of users’ data

A hacker who bribed a worker for the online video game Roblox managed to gain access to the personal information of over 100 million active users, the ability to change passwords and email addresses, and allocate in-game currency. The hacker first paid an employee to look up data about users, and then targeted a customer support representative. They saidthey did it to “prove a point” to the company.