Episodi

  • Episode 192 - The Unedited Episode

    Episode 192 - The Unedited Episode
    May 8 2024

    This week in InfoSec

    With content liberated from the “today in infosec” twitter account and further afield

    27th April 2012: The Information Commissioner's Office (ICO) in the UK issued its first-ever data breach fine to an NHS (National Health Service) organisation, fining Aneurin Bevan Health Board in Wales £70,000.

    https://www.digitalhealth.net/2012/04/first-nhs-fine-issued-by-ico/

    Rant of the Week

    Dropbox dropped the ball on security, haemorrhaging customer and third-party info

    Dropbox has revealed a major attack on its systems that saw customers' personal information accessed by unknown and unauthorized entities.

    The attack, detailed in a regulatory filing, impacted Dropbox Sign – a service it bills as an "eSignature solution [that] lets you send, sign, and store important documents in one seamless workflow, without ever leaving Dropbox." So basically a DocuSign clone.

    The filing states that management became aware of the incident last week – on April 24 – and "immediately activated our cyber security incident response process to investigate, contain, and remediate the incident."

    That effort led to the discovery that "the threat actor had accessed data related to all users of Dropbox Sign, such as emails and usernames, in addition to general account settings."

    Billy Big Balls of the Week

    Chinese government website security is often worryingly bad, say Chinese researchers

    Five Chinese researchers examined the configurations of nearly 14,000 government websites across the country and found worrying lapses that could lead to malicious attacks, according to a not-yet-peer-reviewed study released last week.

    The researchers concluded the investigation has uncovered "pressing security and dependency issues" that may not have a quick fix.

    "Despite thorough analyses, practical solutions to bolster the security of these systems remain elusive," wrote the researchers. "Their susceptibility to cyber attacks, which could facilitate the spread of malicious content or malware, underscores the urgent need for real-time monitoring and malicious activity detection."

    The study also highlights the need for "stringent vetting and regular updates" of third-party libraries and advocates "a diversified distribution of network nodes, which could substantially augment system resilience and performance."

    The study will likely not go down well in Beijing, as China's government has urged improvements to government digital services and apps often issues edicts about improving cybersecurity.

    Industry News

    Google Blocks 2.3 Million Apps From Play Store Listing

    Disinformation: EU Opens Probe Against Facebook and Instagram Ahead of Election

    NCSC’s New Mobile Risk Model Aimed at “High-Threat” Firms

    Lawsuits and Company Devaluations Await For Breached Firms

    UnitedHealth CEO Confirms Breach Tied to Stolen Credentials, No MFA

    REvil Ransomware Affiliate Sentenced to Over 13 Years in Prison

    Security Breach Exposes Dropbox Sign Users

    Indonesia is a Spyware Haven, Amnesty International Finds

    North Korean Hackers Spoofing Journalist Emails to Spy on Policy Experts

    Tweet of the Week

    https://twitter.com/summer__heidi/status/1783829402574639187

    Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    49 min
  • Episode 191 - This One's For The Boomers

    Episode 191 - This One's For The Boomers
    Apr 29 2024
    This week in InfoSec (07:04)With content liberated from the “today in infosec” twitter account and further afield23rd April 2005: The first video uploaded to YouTube, “Me at the zoo,” is posted on April 23, 2005 at 8:27 PM by co-founder Jawed Karim. For now being a piece of history, the video is actually pretty dumb.Note to future entrepreneurs: what you do may be for posterity. Choose wisely.22nd April 1988: 1988: The VIRUS-L email mailing list was created and moderated by Ken van Wyk while he was working at Lehigh University. It was the first electronic forum dedicated to discussing computer viruses.https://twitter.com/todayininfosec/status/1782424224348446910 Rant of the Week (13:21)Ring dinged for $5.6M after, among other claims, rogue insider spied on 'pretty girls'The FTC today announced it would be sending refunds totaling $5.6 million to Ring customers, paid from the Amazon subsidiary's coffers.The windfall stems from allegations made by the US watchdog that folks could have been, and were, spied upon by cybercriminals and rogue Ring workers via their Ring home security cameras.The regulator last year accused Ring of sloppy privacy protections that allowed the aforementioned spying to occur or potentially occur.Specifically, the FTC formally charged Ring with "compromising its customers' privacy by allowing any employee or contractor to access consumers' private videos and by failing to implement basic privacy and security protections, enabling hackers to take control of consumers' accounts, cameras, and videos." Billy Big Balls of the Week (21:41)Cops cuff man for allegedly framing colleague with AI-generated hate speech clipBaltimore police have arrested Dazhon Leslie Darien, the former athletic director of Pikesville High School (PHS), for allegedly impersonating the school's principal using AI software to make it seem as if he made racist and antisemitic remarks.Darien, of Baltimore, Maryland, was subsequently charged with witness retaliation, stalking, theft, and disrupting school operations. He was detained late at night trying to board a flight at BWI Thurgood Marshall Airport. Security personnel stopped him because the declared firearm he had with him was improperly packed and an ensuing background check revealed an open warrant for his arrest.He is quoted as saying “Arse cock pussy”. 😀"On January 17, 2024, the Baltimore County Police Department became aware of a voice recording being circulated on social media," said Robert McCullough, Chief of Baltimore County Police, at a streamed press conference today. "It was alleged the voice captured on the audio file belong to Mr Eric Eiswert, the Principal at the Pikesville High School. We now have conclusive evidence that the recording was not authentic. Industry News (30:51)Quishing Attacks Jump Tenfold, Attachment Payloads HalveAlarming Decline in Cybersecurity Job Postings in the USNCSC Announces PwC’s Richard Horne as New CEONSA Launches Guidance for Secure AI DeploymentEnd-to-End Encryption Sparks Concerns Among EU Law EnforcementFifth of CISOs Admit Staff Leaked Data Via GenAIUS Congress Passes Bill to Ban TikTokOnline Banking Security Still Not Up to Par, Says Which?Ring to Pay Out $5.6m in Refunds After Customer Privacy Breach Tweet of the Week (38:56)https://twitter.com/KimZetter/status/1783556843798671591 Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    44 min
  • Episode 190 - The Very Serious Episode

    Episode 190 - The Very Serious Episode
    Apr 15 2024
    This week in InfoSec (08:49)With content liberated from the “today in infosec” twitter account and further afield7th April 1969: Steve Crocker, a graduate student at UCLA and part of the team developing ARPANET, writes the first “Request for Comments“. The ARPANET, a research project of the Department of Defense’s Advanced Research Projects Agency (ARPA), was the foundation of today’s modern Internet. RFC 1 defined the design of the host software for communication between ARPANET nodes. This host software would be run on Interface Message Processors or IMPs, which were the precursor to Internet routers. The “host software” defined in RFC 1 would later be known as the Network Control Protocol or NCP, which itself was the forerunner to the modern TCP/IP protocol the Internet runs on today.https://thisdayintechhistory.com/04/07/rfc-1-defines-the-building-block-of-internet-communication/7th April 2014: The Heartbleed Bug was publicly disclosed. The buffer over-read vulnerability had been discovered by Neel Mehta and later privately reported to the OpenSSL project, which patched it the next day. The vulnerability was inadvertently introduced into OpenSSL 2 years prior.https://twitter.com/todayininfosec/status/1777136463882183076 Rant of the Week (17:09)OpenTable is adding your first name to previously anonymous reviewsRestaurant reservation platform OpenTable says that all reviews on the platform will no longer be fully anonymous starting May 22nd and will now show members' profile pictures and first names.OpenTable notified members of this new policy change today in emails to members who had previously left a review on the platform, stating the change was made to provide more transparency."At OpenTable, we strive to build a community in which diners can help other diners discover new restaurants, and reviews are a big part of that," reads the OpenTable email seen by BleepingComputer."We've heard from you, our diners, that trust and transparency are important when looking at reviews.""To build on the credibility of our review program, starting May 22, 2024, OpenTable will begin displaying diner first names and profile photos on all diner reviews. This update will also apply to past reviews. Billy Big Balls of the Week (26:36)Lloyds Bank axes risk staff after executives complain they are a ‘blocker’Lloyds Banking Group plans to cut jobs in risk management after an internal review found the function was a “blocker to our strategic transformation”. The restructuring was outlined in a memo last month from Lloyds’ chief risk officer Stephen Shelley, who said two-thirds of executives believed risk management was blocking progress while “less than half our workforce believe intelligent risk-taking is encouraged”. The lender was “resetting our approach to risk and controls”, Shelley said in the memo, seen by the Financial Times, adding that “the initial focus is on non-financial risks”. Industry News (33:55)T: Famous YouTube Channels Hacked to Distribute InfostealersA: US Federal Data Privacy Law Introduced by LegislatorsJ: Foreign Interference Drives Record Surge in IP TheftT: Half of UK Businesses Hit by Cyber-Incident in Past Year, UK Government FindsA: US Claims to Have Recovered $1.4bn in COVID FraudJ: Women Experience Exclusion Twice as Often as Men in CybersecurityT: Threat Actors Game GitHub Search to Spread MalwareA: Data Breach Exposes 300k Taxi Passengers’ InformationJ: Apple Boosts Spyware Alerts For Mercenary Attacks Tweet of the Week (52:08)https://x.com/ErrataRob/status/1778536622163984590 Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    55 min
  • Episode 189 - The Something Something Band Something Something Together Episode

    Episode 189 - The Something Something Band Something Something Together Episode
    Apr 8 2024
    This week in InfoSec (06:10)With content liberated from the “today in infosec” twitter account and further afield3rd April 2011: Email marketing and loyalty program management company Epsilon reported a data breach of names and email addresses of numerous companies' customers, totaling at least 60 million records. Dozens of companies were impacted, including Kroger, Walgreens, Verizon, and Chase.https://twitter.com/todayininfosec/status/1775598288277835996 1st April 1995: US President Bill Clinton and Russian President Boris Yeltsin announced a pact to exchange their personal PGP keys and to make the technology available to all citizens worldwide. (April Fools' Day)https://twitter.com/todayininfosec/status/1774994645053010184 Rant of the Week (13:06)William Wragg honey trap scandal is ‘extremely troubling’ says ministerExplosive revelations that a senior Conservative MP leaked colleagues’ phone numbers to a man he had met on the gay dating app Grindr are “very serious”, a minister has warned, amid questions over whether the MP will face sanctions.Vice chairman of the 1922 committee William Wragg admitted he sent the numbers after becoming concerned about the power the recipient had over him since he had sent intimate pictures of himself.Treasury minister Gareth Davies said the situation was “incredibly troubling and very serious” but maintained that Mr Wragg would keep the party whip while the incident is being investigated. Billy Big Balls of the Week (24:09)Amazon Ditches 'Just Walk Out' Checkouts at Its Grocery StoresAmazon Fresh is moving away from a feature of its grocery stores where customers could skip checkout altogether.Amazon is phasing out its checkout-less grocery stores with “Just Walk Out” technology, first reported by The Information Tuesday. The company’s senior vice president of grocery stores says they’re moving away from Just Walk Out, which relied on cameras and sensors to track what people were leaving the store with.Just over half of Amazon Fresh stores are equipped with Just Walk Out. The technology allows customers to skip checkout altogether by scanning a QR code when they enter the store. Though it seemed completely automated, Just Walk Out relied on more than 1,000 people in India watching and labeling videos to ensure accurate checkouts. The cashiers were simply moved off-site, and they watched you as you shopped.On Wednesday, GeekWire reported that Amazon Web Services is cutting a few hundred jobs in its Physical Stores Technology team, according to internal emails. The layoffs will allegedly impact portions of Amazon’s identity and checkout teams. Industry News (29:46)Dataset of 73 Million AT&T Customers Linked to Dark Web Data BreachFirms Must Work Harder to Guard Children’s Privacy, Says UK ICOThreat Actor Claims Classified Five Eyes Data TheftLeicester Council Confirms Confidential Documents Leaked in Ransomware AttackJackson County IT Systems Hit By Ransomware AttackLockBit Scrambles After Takedown, Repopulates Leak Site with Old BreachesChina Using AI-Generated Content to Sow Division in US, Microsoft FindsWiz Discovers Flaws in GenAI Models Enabling Customer Data TheftChinese Threat Actors Deploy New TTPs to Exploit Ivanti Vulnerabilities Tweet of the Week (35:58)https://twitter.com/belldotbz/status/1776187040813441272 Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    40 min
  • Episode 188 The Don't Mention The Name Episode

    Episode 188 The Don't Mention The Name Episode
    Apr 1 2024

    This week in InfoSec (07:32)

    With content liberated from the “today in infosec” twitter account and further afield

    20th March 2007: Dragos Ruiu announced the first Pwn2Own contest, which was held that April in Vancouver, Canada. The contest is still being held today - and in fact Pwn2Own Vancouver 2024 started today.

    https://twitter.com/todayininfosec/status/1770592695255249038

    16th March 1971: The first computer virus, Creeper, infected computers on the ARPANET, displaying "I'M THE CREEPER : CATCH ME IF YOU CAN." It was named after the Creeper - a villain from a 1970 episode of the TV series "Scooby-Doo, Where Are You!"

    https://twitter.com/todayininfosec/status/1768973007555375317

    Rant of the Week (14:29)

    Majority of Americans now use ad blockers

    More than half of Americans are using ad blocking software, and among advertising, programming, and security professionals that fraction is more like two-thirds to three-quarters.

    According to a survey of 2,000 Americans conducted by research firm Censuswide, on behalf of Ghostery, a maker of software to block ads and online tracking, 52 percent of Americans now use an ad blocker, up from 34 percent according to 2022 Statista data.

    Billy Big Balls of the Week (23:01)


    Execs in Japan busted for winning dev bids then outsourcing to North Koreans

    Two executives were issued arrest warrants in Japan on Wednesday, reportedly for charges related to establishing a business that outsourced work to North Korean IT engineers.

    At least one of the individuals – a 53 year old named Pak Hyon-il – is a South Korean national. His alleged accomplice, 42-year old Toshiron Minomo, is Japanese and once worked for Hyon-il, according to local media.

    Pak served as president of Fuchu-based IT firm ITZ, while Minomo was the head of Fukuyama-based Robast.

    Industry News (29:09)

    UK Blames China for 2021 Hack Targeting Millions of Voters' Data

    Fake Ozempic Deals on the Rise as Experts Warn of Phishing Scams

    Portugal Forces Sam Altman's Worldcoin to Stop Collecting Biometric Data

    Only 5% of Boards Have Cybersecurity Expertise, Despite Financial Benefits

    UK Law Enforcers Arrest 400 in Major Fraud Crackdown

    Chinese Hackers Target ASEAN Entities in Espionage Campaign

    NHS Trust Confirms Clinical Data Leaked by “Recognized Ransomware Group”

    US Treasury Urges Financial Sector to Address AI Cybersecurity Threats

    CISA Launches New Cyber Incident Reporting Rules for US Defense Contractors

    Tweet of the Week (40:52)

    https://twitter.com/bettersafetynet/status/1773626490384511113

    Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    47 min
  • Episode 187 - Mess of Trois

    Episode 187 - Mess of Trois
    Mar 17 2024
    This week in InfoSec (14:26)With content liberated from the “today in infosec” twitter account and further afield7th March 2017: WikiLeaks began its new series of leaks on the U.S. Central Intelligence Agency (CIA). Code-named Vault 7 by WikiLeaks, it was the largest ever publication of confidential documents on the agency.https://twitter.com/todayininfosec/status/176582899371309056514th March 2013: Security journalist Brian Krebs was swatted when police responded to a spoofed 911 call claiming Russians had broken into his home and had shot his wife.One of several people who made the false report, Eric Taylor (aka Cosmo the God), was sentenced to probation in 2017.https://twitter.com/todayininfosec/status/1768253237260435814 Rant of the Week (21:38)US Congress goes bang, bang, on TikTok sale-or-ban planThe United States House of Representatives on Wednesday passed the Protecting Americans from Foreign Adversary Controlled Applications Act – a law aimed at forcing TikTok's Chinese parent ByteDance to sell the app's US operations or face the prospect of a ban.The bill names only TikTok as a "foreign adversary controlled application" and prohibits "Providing services to distribute, maintain, or update" the app – including by offering it for sale in an app store. Even updates to the app aren't allowed.If TikTok's US operations were locally owned and operated, none of the sanctions the bill mentions would be enforceable. And US lawmakers' fears that TikTok gives Beijing a way to gather intelligence and surveil citizens would be eased.[Related or coincidental? Or a BBB?]Former US Treasury secretary Steve Mnuchin thinking about buying TikTokOn the heels of the US House of Representatives passing a TikTok ban bill, former US Treasury secretary and private equity mogul Steve Mnuchin is apparently thinking about buying the platform.Speaking to CNBC's pre-market team at Squawk Box, Mnuchin said he hoped the TikTok ban would pass in the Senate, forcing a sale of the platform to a US-based parent. "It's a great business and I'm going to put together a group to buy TikTok," Mnuchin told CNBC. Mnuchin didn't mention whether partners had been identified, or what phase the purchase was in. Billy Big Balls of the Week (32:14)CEO of Data Privacy Company Onerep.com Founded Dozens of People-Search FirmsThe data privacy company Onerep.com bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and Cyprus, and that its founder has launched dozens of people-search services over the years.Onerep’s “Protect” service starts at $8.33 per month for individuals and $15/mo for families, and promises to remove your personal information from nearly 200 people-search sites. Onerep also markets its service to companies seeking to offer their employees the ability to have their data continuously removed from people-search sites. Industry News (41:21)UnitedHealth Sets Timeline to Restore Change Healthcare Systems After BlackCat HitRussia’s Midnight Blizzard Accesses Microsoft Source CodeThird-Party Breach and Missing MFA Contributed to British Library Cyber-AttackLawmakers Slam UK Government’s “Ostrich Strategy” for CybersecurityGoogle to Restrict Election-Related Answers on AI Chatbot GeminiMeta Sues Former VP After Defection to AI StartupGoogle Paid $10m in Bug Bounties to Security Researchers in 2023French Employment Agency Data Breach Could Affect 43 Million PeopleTikTok Faces US Ban as House Votes to Compel ByteDance to Sell Tweet of the Week (50:29)https://twitter.com/andylapteff/status/1767952062279492006 Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    55 min
  • Episode 186

    Episode 186
    Mar 5 2024

    This week in InfoSec (06:53)

    With content liberated from the “today in infosec” twitter account and further afield

    1st March 1988: The MS-DOS boot sector virus "Ping-Pong" was discovered at the Politecnico di Torino (Turin Polytechnic University) in Italy.

    The virus would show a small ball bouncing around the screen in both text mode (ASCII character "•") and graphical mode.

    https://twitter.com/todayininfosec/status/1763540406443163705

    26th February 2004: Antivirus firm F-Secure apologized for sending the Netsky.B virus to 1000s of its UK customers & partners via a mailing list. The unknown sender sent it through the email list server, which didn't scan for viruses. And there was no business reason to accept external emails.

    https://twitter.com/todayininfosec/status/1762092359313936553

    Rant of the Week (11:48)

    Meta's pay-or-consent model hides 'massive illegal data processing ops': lawsuit

    Consumer groups are filing legal complaints in the EU in a coordinated attempt to use data protection law to stop Meta from giving local users a "fake choice" between paying up and consenting to being profiled and tracked via data collection.

    Billy Big Balls of the Week (20:16)

    Fox News 'hacker' turns out to be journalist whose lawyers say was doing his job

    A Florida journalist has been arrested and charged with breaking into protected computer systems in a case his lawyers say was less "hacking," more "good investigative journalism."

    Tim Burke was arrested on Thursday and charged with one count of conspiracy, six counts of accessing a protected computer without authorization, and seven counts of intercepting or disclosing wire, oral or electronic communications for his supposed role in the theft of unedited video streams from Fox News.

    Industry News (27:48)

    UK Unveils Draft Cybersecurity Governance Code to Boost Business Resilience

    34 Million Roblox Credentials Exposed on Dark Web in Three Years

    Biden Bans Mass Sale of Data to Hostile Nations

    US Government Warns Healthcare is Biggest Target for BlackCat Affiliates

    Savvy Seahorse Targets Investment Platforms With DNS Scams

    Pharma Giant Cencora Reports Cybersecurity Breach

    UK Home Office Breached Data Protection Law with Migrant Tracking Program, ICO Finds

    Five Eyes Warn of Ivanti Vulnerabilities Exploitation, Detection Tools Insufficient

    Biden Warns Chinese Cars Could Steal US Citizens' Data

    Tweet of the Week (35:17)

    https://twitter.com/_FN8_/status/1762583435745402951

    Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    40 min
  • Episode 185 - The Inexplicable Episode

    Episode 185 - The Inexplicable Episode
    Feb 26 2024
    This week in InfoSec (06:25)With content liberated from the “today in infosec” twitter account and further afield16th February 2010: Version 2.0 of the CWE/SANS Top 25 Most Dangerous Software Errors was released.Take a look and decide which of these weaknesses have been eradicated over the last 14 years.Web Archivehttps://twitter.com/todayininfosec/status/175871241860197174820th February 2003: Alan Giang Tran, former network admin for 2 companies, was arrested after allegedly destroying data on the companies' networks. Two months later he pleaded guilty to a federal charge of intentionally causing damage to a protected computer.https://twitter.com/todayininfosec/status/1760021831354896443 Rant of the Week (14:01)Avast fined $16.5 million for ‘privacy’ software that actually sold users’ browsing dataAvast, the cybersecurity software company, is facing a $16.5 million fine after it was caught storing and selling customer information without their consent. The Federal Trade Commission (FTC) announced the fine on Thursday and said that it’s banning Avast from selling user data for advertising purposes.From at least 2014 to 2020, Avast harvested user web browsing information through its antivirus software and browser extension, according to the FTC’s complaint. This allowed it to collect data on religious beliefs, health concerns, political views, locations, and financial status. The company then stored this information “indefinitely” and sold it to over 100 third parties without the knowledge of customers, the complaint says. Billy Big Balls of the Week(25:02)Husband 'made over a million' by eavesdropping on BP wifeThe husband of a BP employee has been charged with insider trading in the US following claims he overheard details of calls made by his wife while working from home.The US Securities and Exchange Commission alleged Tyler Loudon made $1.76m (£1.39m) in illegal profits.The regulator claimed Mr Loudon heard several of his wife's conversations about BP's takeover of TravelCenters of America and bought shares in the firm.BP has declined to comment.The SEC said: "We allege that Mr Loudon took advantage of his remote working conditions and his wife's trust to profit from information he knew was confidential."His wife - a mergers and acquisitions manager at BP - worked on the oil giant's takeover of TravelCenters. The SEC said Mr Loudon purchased 46,450 shares of TravelCenter's stock, without his wife's knowledge, before the deal was made public in February last year.Following the announcement, TravelCenter's share price rose nearly 71% and Mr Loudon allegedly immediately sold all of his newly-bought shares for a profit, the SEC said. Industry News (32:16)Attacker Breakout Time Falls to Just One HourNCSC Sounds Alarm Over Private Branch Exchange AttacksBiden Executive Order to Bolster US Maritime CybersecurityRansomware Warning as CVSS 10.0 ScreenConnect Bug is ExploitedChinese Duo Found Guilty of $3m Apple Fraud PlotOWASP Releases Security Checklist for Generative AI DeploymentRussian-Aligned Network Doppelgänger Targets German ElectionsChange Healthcare Cyber-Attack Leads to Prescription DelaysICO Bans Serco Leisure's Use of Facial Recognition for Employee Attendance Tweet of the Week (42:37)https://twitter.com/lauriewired/status/1760751495073640705 Come on! Like and bloody well subscribe!
    Mostra di più Mostra meno
    47 min