Coder charged in massive CIA leak portrayed as vindictive

A Manhattan jury heard conflicting portrayals of Joshua Schulte, a former CIA coder accused of sending the anti-secrecy group WikiLeaks a large portion of the agency’s computer hacking arsenal tools the agency had used to conduct espionage operations overseas. Schulte left a trail of evidence despite learned attempts to erase his digital fingerprints, Assistant U.S. Attorney Matthew Laroche said in closing arguments. Schulte became disgruntled at the CIA, he said, and took meticulous steps to plan and cover up the 2016 theft.

Apple reportedly ditched plan for encrypted iCloud backup after FBI pressure

The company wanted to offer people end-to-end encryption for iCloud two years ago, according to Reuters. Apple reversed course on a plan to enable people to fully encrypt backups of their iPhone data on its iCloud service after the FBI aired concerns that it would hurt investigations, Reuters reported Tuesday. About two years ago, Apple reportedly told the FBI it wanted to make hacking its cloud storage service more difficult by offering people end-to-end encryption.

Pen Testing Ships

Partially driven by the upcoming inclusion of Cyber Security by the IMO (International Maritime Organisation), 2019 was a really busy year for maritime security testing at PTP. What can we all learn from a year of evaluating the security of ships? We’ve been involved in all sorts of ship testing, here are a few examples: What are the common (in)security themes we keep finding?

There is a distinct lack of understanding and interaction between IT and OT installers/engineers on board and in the yard. The OT systems are often accessible from the IT systems and vice versa, often through deliberate bypass of security features by those on board, or through poor design / poor password management / weak patch management.

Facial recognition company Clearview AI hit by data theft

The controversial facial recognition company Clearview AI has notified its customers that a bad actor had “gained unauthorized access” to its entire customer list, which includes some of the most powerful law enforcement agencies in the United States. According to the notification obtained by the Daily Beast, the stolen information includes customer names, the user accounts that the customers had set up, and even the number of searches that they ran through the service. Details are rather sparse about the nature of the incident and it’s not immediately clear how it unfolded.

FBI Says $140+ Million Paid to Ransomware

Through the analysis of collected ransomware bitcoin wallets and ransom notes, the FBI states that victims have paid over $140 million to ransomware operators over the past six years. At the RSA security conference this week, FBI Special Agent Joel DeCapuaexplained how he used bitcoin wallets and ransom notes that were collected by the FBI, shared by private partners, or found on VirusTotalto compute how much money was paid in ransom paymentsover6 years. According to DeCapua between 10/0/1/2013 and 11/07/2019, there have been approximately $144,350,000 in bitcoins paid toransomware actors as part of a ransom.

Clearview AI loses entire database of faceprint-buying clients to hackers

Clearview AI, the controversial facial recognition startup that’s gobbled up more than three billion of our photos by scraping social media sites and any other publicly accessible nook and cranny it can find, has lost its entire list of clients to hackers – including details about its many law enforcement clients.

Source: sophos.com

FBI recommends using passphrases instead of complex passwords

FBI suggests using longer passwords combining multiple words into a long string of at least 15 characters instead of short passwords with special characters Recent guidance from the National Institute of Standards and Technology (NIST) highlights that the password length is much more important than password complexity. The recommendations are part of the Protected Voices initiative launched by the FBI to help 2020 political campaigns and American voters protect against online foreign interference. The FBI, the Department of Homeland Security, and the Office of the Director of National Intelligence have provided guidance and information as part of the Protected Voices campaign.

European Commission has chosen the Signal app to secure its communications

The European Commission has decided to adopt for its staff the popular cross-platform encrypted messaging service Signal for its communications. The news was first reported earlier this month by the Politico website, a message issued on the commission’s internal messaging boards asked employees of the European Commission to use Signal. Of course, Signal have to be used only to send non-classified, but sensitive information, because classified documents must be transmitted through more secure channels.

Zyxel 0day Affects its Firewall Products, Too

On Monday, networking hardware maker Zyxel released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products. This week’s story on the Zyxel patch was prompted by the discovery that exploit code for attacking the flaw was being sold in the cybercrime underground for $20,000.

123 Million Records Leaked by Decathlon

It was reported yesterday that French sporting retail giant Decathlon leaked over 123 million records through an improperly secured ElasticSearch server, leaving customer and employee details exposed. The leak was spotted by security researchers Noam Rotem and Ran Locar at VPNmentor on 12th February, Decathlon were notified four days later, the leak was investigated, and the server pulled down shortly after.

Source: itsecurityguru.org

Kr00k Wi-Fi Encryption flaw affects more than a billion devices

A high-severity hardware vulnerability, dubbed Kr00k, in Wi-Fi chips manufactured by Broadcom and Cypress expose over a billion devices to hack. Cybersecurity researchers from ESET have discovered a new high-severity hardware vulnerability, dubbed Kr00k, that affects Wi-Fi chips manufactured by Broadcom and Cypress. The vulnerability could have a severe impact on the IT sector, the flawed chips are used in over a billion devices, including routers, smartphones, tablets, laptops, and IoT gadgets.

After blowing $100m to snoop on Americans’ phone call logs for four years, what did the NSA get? Just one lead

The controversial surveillance program that gave the NSA access to the phone call records of millions of Americans has cost US taxpayers $100m – and resulted in just one useful lead over four years. That’s the upshot of a report [PDF] from the US government’s freshly revived Privacy and Civil Liberties Oversight Board (PCLOB). The panel dug into the super-snoops’ so-called Section 215 program, which is due to be renewed next month.

Android malware can steal Google Authenticator 2FA codes

A new version of the ‘Cerberus’ Android banking trojan will be able to steal one-time codes generated by the Google Authenticator app and bypass 2FA-protected accounts. Security researchers say that an Android malware strain can now extract and steal one-time passcodes (OTP) generated through Google Authenticator, a mobile app that’s used as a two-factor authentication (2FA) layer for many online accounts.

Source: zdnet.com

Amazon engineer calls for Ring to be ‘shut down immediately’ over privacy concerns

‘The privacy issues are not fixable with regulation and there is no balance that can be struck,’ the Amazon employee said of Ring. The post was published Sunday by the advocacy group Amazon Employees for Climate Justice and it was meant to protest the company’s external communications policy.

Source: businessinsider.nl

Wells Fargo to pay $3 billion over fake account scandal

Wells Fargo, the nation’s fourth-largest bank, agreed Friday to pay a $3 billion fine to settle a civil lawsuit and resolve a criminal prosecution filed by the Justice Department over its fake account scandal. Under pressure to meet sales quotas, bank employees opened millions of savings and checking accounts in the names of actual customers, without their knowledge or consent. Since the fraud became public in 2016, the bank has faced a torrent of lawsuits.

These Guys Figured Out a Way to Get Endless Free McDonald’s

Last November, software developers Lenny Bakkalian and David Albert discovered two loopholes in the German McDonald’s system which allowed them to order an endless supply of free food. Recently, I met the two Hamburglars and their colleague Mats Tesch at an East Berlin McDonald’s so they could show me how they did it. McDonald’s receipts in Germany end with a link to a survey page.

Leaked Document Shows How Big Companies Buy Credit Card Data on Millions of Americans

Yodlee, the largest financial data broker in the U.S., sells data pulled from the bank and credit card transactions of tens of millions of Americans to investment and research firms, detailing where and when people shopped and how much they spent. The company claims that the data is anonymous, but a confidential Yodlee document obtained by Motherboard indicates individual users could be unmasked. The findings come as multiple Senators have urged the Federal Trade Commission (FTC) to investigate Envestnet, which owns Yodlee, for selling Americans’ transaction information without their knowledge or consent, potentially violating the law.

Big Telecom Say It Has First Amendment Right to Sell Your Private Data

ISPs say that a law requiring users to opt-in to having their location and financial data sold is a ‘burdensome restriction’ on their ‘protected speech.’

Source: vice.com

MGM Hotel Hack Leaves 10.6M Guests’ Personal Data Exposed

10.6 million people who had stayed at MGM Resorts have had their personal data published on a hacking forum, it was revealed this week. It is thought that the recent breach stems from an earlier incident which occurred last year, whereby unauthorised actors were able to access MGM’s internal cloud and therefore the personal information of previous guests. The biggest concern in the MGM disclosure is that hackers stole deeper, more sensitive data on 1300 individuals, including information off driver’s licenses and military D cards.

Google to Samsung: Stop messing with Linux kernel code. It’s hurting Android security

Samsung’s attempt to prevent attacks on Galaxy phones by modifying kernel code ended up exposing it to more security bugs, according to Google Project Zero (GPZ). Not only are smartphone makers like Samsung creating more vulnerabilities by adding downstream custom drivers for direct hardware access to Android’s Linux kernel, vendors would be better off using security features that already exist in the Linux kernel,according to GPZ researcher Jann Horn. It was this type of mistake that Horn found in the Android kernel on the Samsung Galaxy A50.