- “A totally connected world will also be especially susceptible to cyberattacks. Even before the introduction of 5G networks, hackers have breached the control center of a municipal dam system, stopped an Internet-connected car as it travelled down an interstate, and sabotaged home appliances. Ransomware, malware, crypto-jacking, identity theft, and data breaches have become so common that more Americans are afraid of cybercrime than they are of becoming a victim of violent crime.” https://www.tripwire.com/state-of-security/security-data-protection/cybersecurity-implications-5g-technology/
- “At least until a bug bounty hunter in India found the bug, reported it to Apple, and received a $100,000 bug bounty. Essentially, anyone could request a token for any email ID. Apple’s servers would then verify that token, so an attacker could gain access to any account you had linked to it.” https://www.blackhatethicalhacking.com/news/hacker-finds-huge-apple-security-hole-apple-pays-100000-bug-bounty/
- “According to a cursory analysis of today’s data dump, the leaked data includes 3,671 email addresses, 7,205 account passwords, and 8,580 private keys for .onion (dark web) domains.” https://securityaffairs.co/wordpress/104109/deep-web/daniels-hosting-data-leak.html
- “The main goals and responsibilities of a SOC team are continuously monitoring security, detecting, analyzing, and responding to security incidents in the best way possible using processes and technology. The SOC team is also in charge of proactively investigating abnormal activity and correctly identifying and defending threats to maintain the safety of the infrastructure. Other than specialized expertise, security analysts need to think outside the box when it comes to threat response and also learn progressively.” https://www.threathunting.se/2020/06/01/get-to-know-the-roles-of-soc-analyst-and-the-soc-team-threat-hunter/
- “Facebook announced on Thursday that it’s going to be verifying the identity of some US profiles that pump out posts that reach a mass of people.” https://nakedsecurity.sophos.com/2020/06/01/facebook-to-verify-identities-on-accounts-that-churn-out-viral-posts/
- “JRD full site backups (unencrypted) were stored in a third-party company Amazon Web Services S3 bucket. The third-party company is owned by a former Team Leader, still Member of the JRD team at the time of the breach.” reads the data breach notification. “Known to the current Team Leader at the time of the breach. (https://volunteers.joomla.org/teams/resource-directory-team) Each backup copy included a full copy of the website, including all the data.” https://securityaffairs.co/wordpress/104118/data-breach/joomla-data-breach.html
- “Amtrak looked into the matter and discovered that an unknown third party had gained unauthorized access to some Amtrak Guest Reward accounts. Those types of accounts allow passengers to build up points by riding with Amtrak so that they can ultimately claim rewards.” https://www.tripwire.com/state-of-security/security-data-protection/passenger-railroad-service-says-data-breach-might-have-affected-pii/
- “With an estimated 68% of organizations experiencing zero-day attacks from undisclosed/unknown vulnerabilities in 2019, this is an upward trend that we need to address as an industry by shipping secure code at a reasonable speed.” https://thehackernews.com/2020/06/devsecops-engineers.html
- “On March 11, 2020, the Cyberspace Solarium Commission (CSC), a governmental commission aiming to identify “a strategic approach to defending the United States in cyberspace against cyber-attacks of significant consequences,” published an extensive report outlining a new cyber strategy. The report is based on over 300 interviews and includes more than 80 recommendations for actions across the private and public sectors.” https://resources.infosecinstitute.com/five-key-lessons-from-the-u-s-cyberspace-solarium-commission-report/
- “An exploitable denial-of-service vulnerability exists in VMware Workstation, version 15.5.0, build-14665864. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from a VMware guest and the VMware host will be affected, leading to vmware-vmx.exe process crash on the host.” https://blog.talosintelligence.com/2020/06/vulnerability-spotlight-vmware.html
- “The Nipissing First Nation administration stopped a ransomware attack in its tracks but not soon enough to prevent disruption of communications. The attack was discovered on May 8 and affected all departments of the administration but most of the network remained unaffected.” https://www.bleepingcomputer.com/news/security/ransomware-locks-down-the-nipissing-first-nation/
- “Internet of Things (IoT) devices offer tremendous capabilities to users. Looking around I see more and more ways, especially in a post COVID-19 world, that these devices will make our lives easier and safer, which makes this work more critical than ever. And while cybersecurity is a shared responsibility and the solution will likely require an ecosystem approach, how can IoT devices enable customers’ security goals?” https://www.nist.gov/blogs/cybersecurity-insights/more-just-milestone-botnet-roadmap-towards-more-securable-iot-devices
- “Rod Rosenstein, a former deputy attorney general at the Department of Justice, has been providing counsel on cybersecurity and national security to NSO Group, the Israeli software surveillance firm accused of spying on human rights activists and journalists, according to court documents obtained by CyberScoop.” https://www.cyberscoop.com/rod-rosenstein-nso-group-whatsapp/
- “We know well that the ulterior intention of the United States is to tarnish the image of our state and create a moment for provoking us by employing a new leverage called ‘cyber threat’ together with the issues of nuke, missiles, ‘human rights,’ ‘sponsoring of terrorism’ and ‘money laundering,’” North Korea’s Ministry of Foreign Affairs said in a May 28 statement.” https://www.cyberscoop.com/north-korea-issues-blanket-denial-us-hacking-accusations/
- “According to Troy Hunt at Have I Been Pwned (HIBP), the group of allegedly ill-gotten email addresses and passwords has been circulating in multiple forums, with most of them attributing the credential leak to Anonymous, which is a loose affiliation of individuals that carry out hacking to send political messages. According to multiple social-media posts, Anonymous supposedly carried out the breach/leak in response to the MPD’s role in Floyd’s death” https://threatpost.com/anonymous-hack-minneapolis-police-department-fake/156171/
- “Microsoft has begun to notify users via Windows Update if they are currently blocked from upgrading to Windows 10 2004 due to a compatibility hold. With the May 2020 Update release, Microsoft placed nine compatibility holds on devices that prevent them from upgrading to Windows 10 2004 if they are using specific drivers, applications, or Windows 10 features. These holds are due to conflicts that could cause applications not to run correctly, Windows 10 to have Blue Screen of Death (BSOD) crashes, or Windows 10 to have problems starting.” https://www.bleepingcomputer.com/news/microsoft/microsoft-starts-notifying-users-if-windows-10-2004-is-blocked/
- “Today we’re announcing one of the top requests we’ve received: to bring the Advanced Protection Program to Nest. Now people can seamlessly use their Google Accounts with both Advanced Protection and Google Nest devices — previously, a user could use their Google Account on only one of these at a time,” https://www.bleepingcomputer.com/news/google/google-brings-the-advanced-protection-program-to-nest-devices/
- “The office of Minnesota Gov. Tim Walz says the National Security Agency did not provide the state with signals intelligence as its law enforcement agencies responded to protests against the killing of George Floyd. For awhile this weekend, though, the governor stirred up some confusion about whether the intelligence agency could do so.” https://www.cyberscoop.com/george-floyd-minnesota-nsa-surveillance/
#security #cybersecurity #itsecurity #privacy #5g #apple #bugbounty #kingnull #danielshosting #darkweb #joomla #jrd #devsecops #csc #vmware #Nipissing #NFN #nist #iot #nistir8259a #microsoft #windows2004 #nest #google #nsa