Individuals at Risk
Cyber Privacy
What We Learned About Clearview AI and Its Secret ‘Co-Founder’: Charles Johnson, a notorious conservative provocateur, played a pivotal role at the start of the facial recognition company. The New York Times, March 18, 2021
Facial Recognition: What Happens When We’re Tracked Everywhere We Go?: When a secretive start-up scraped the internet to build a facial-recognition tool, it tested a legal and ethical limit — and blew the future of privacy in America wide open. The New York Times, March 18, 2021
Cyber Update
Google fixes Chrome zero‑day bug exploited in the wild: Google is updating its Chrome web browser to fix five security flaws, including a zero-day vulnerability that is being actively exploited…. WeLiveSecurity, March 16, 2021
Cyber Warning
How cybercriminals are targeting US taxpayers as tax season approaches: The latest scams use phishing emails to deliver remote access trojans to control a victim’s computer and steal sensitive data, says Cybereason. TechRepublic, March 18, 2021
Beware Android trojan posing as Clubhouse app: The malware can grab login credentials for more than 450 apps and bypass SMS-based two-factor authentication. WeLiveSecurity, March 18, 2021
Cyber Danger
Can We Stop Pretending SMS Is Secure Now?: SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that anyone could use to silently intercept text messages intended for other mobile users. KrebsOnSecurity, March 16, 2021
A Hacker Got All My Texts for $16: A gaping flaw in SMS lets hackers take over phone numbers in minutes by simply paying a company to reroute text messages. Vice, March 15, 2021
Cyber Humor
Information Security Management for the Organization
Information Security Management
Cybersecurity Programs Struggling To Keep up With Attack Surfaces, Risk Priorities in Pandemic Conditions: A new report from attack surface management firm Randori indicates that cybersecurity programs are struggling to manage attack surfaces that have become significantly more difficult due to pandemic conditions. Chief Information Security Officers (CISOs) report that organizations are mixed on security spending, and that prioritizing risks and patching is a consistent problem. CPO, March 19, 2021
The Next-Gen Cyber Range: Bringing Incident Response Exercises to the Cloud: At IBM X-Force, we keep our customers on the cutting edge of cybersecurity experiences, centered around incident response, and these include responding in cloud native environments. SecurityIntelligence, March 18, 2021
Tech Vendors’ Lack of Security Transparency Worries Firms: A majority of firms say they’re more likely to buy from suppliers that are open about security issues — yet that sentiment isn’t necessarily reflected in the technology providers they’re currently working with. DarkReading, March 18, 2021
Cyber Warning
Office 365 Phishing Attack Targets Financial Execs: Attackers move on new CEOs, using transition confusion to harvest Microsoft credentials. ThreatPost, March 19, 2021
Cybersecurity in Society
Cyber Crime
Computer giant Acer hit by $50 million ransomware attack: Computer giant Acer has been hit by a REvil ransomware attack where the threat actors are demanding the largest known ransom to date, $50,000,000. BleepingComputer, March 18, 2021
FBI Releases the Internet Crime Complaint Center 2020 Internet Crime Report, Including COVID-19 Scam Statistics: The FBI’s Internet Crime Complaint Center has released its annual report. The 2020 Internet Crime Report includes information from 791,790 complaints of suspected internet crime—an increase of more than 300,000 complaints from 2019—and reported losses exceeding $4.2 billion. State-specific statistics have also been released and can be found within the 2020 Internet Crime Report and in the accompanying 2020 State Reports. FBI, March 17, 2021
Verkada’s Camera Debacle Traces to Publicly Exposed Server: Tales of poorly secured internet-connected cameras come along regularly. But the latest installment seems especially egregious…Bank Info Security, March 17, 2021
Largest ransomware demand now stands at $30 million as crooks get bolder: There’s been a big rise in ransom payments over the past year – and some ransomware gangs are demanding vast amounts. ZDNet, March 17, 2021
Healthcare Security: Ransomware Plays a Prominent Role in COVID-19 Era Breaches: Ransomware is the root cause in a majority of the healthcare breaches analyzed. tenable, March 10, 2021
Cyber Attack
Hackers are exploiting a server vulnerability with a severity of 9.8 out of 10: As if the mass-exploitation of Exchange servers wasn’t enough, now there’s BIG-IP. ars technica, March 19, 2021
Cyber Privacy
Google and the Age of Privacy Theater: The demise of surveillance capitalism has been greatly exaggerated. Wired, March 18, 2021
Google’s privacy push draws DOJ scrutiny, report says: Justice Department investigators are reportedly concerned about the search giant’s moves to phase out third-party cookies. CNet, March 18, 2021
Know Your Enemy
Swiss Firm Says It Has Accessed Servers of a SolarWinds Hacker: PRODAFT report details nicknames hackers used, hours they worked. Bloomberg, March 20, 2021
“Expert” hackers used 11 0-days to infect Windows, iOS, and Android users: The breadth and abundance of exploits for unknown vulnerabilities sets group apart. ars technica, March 18, 2021
WeLeakInfo Leaked Customer Payment Info: A little over a year ago, the FBI and law enforcement partners overseas seized WeLeakInfo[.]com, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card. KrebsOnSecurity, March 15, 2021
National Cybersecurity – Solar Winds
Mimecast says SolarWinds hackers breached its network and spied on customers: Mimecast-issued certificate used to connect to customers’ Microsoft 365 tenants. ars technica, March 16, 2021
National Cybersecurity
White House Weighs New Cybersecurity Approach After Failure to Detect Hacks: The intelligence agencies missed massive intrusions by Russia and China, forcing the administration and Congress to look for solutions, including closer partnership with private industry. The New York Times, March 14, 2021
Cyber Defense
How Did the Exchange Server Exploit Leak: Microsoft Investigating; Devcore Pen Testers Say They’re in the Clear. BankInfoSecurity, March 14, 2021
Financial Cybersecurity
Fintech Giant Fiserv Used Unclaimed Domain: If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [NASDAQ:FISV], a $15 billion firm that provides online banking software and other technology solutions to thousands of financial institutions. KrebsOnSecurity, March 17, 2021
Cyber Enforcement
Verkada Attacker Charged With Wire Fraud, Conspiracy in US: Swiss national Till Kottmann and co-conspirators are accused of breaking into dozens of US companies and government entities. DarkReading, March 19, 2021
