If Vendor insecurity seems to be the new norm then God help all of us

Attackers compromise Twilio's SDK due to misconfigured  AWS S3 buckets left the SDK's path publicly readable and writable for roughly five years. Twilio powers communications for over 40,000 businesses and helps developers add voice, video, messaging, and authentication capabilities. 

The company's customer list includes Twitter, Netflix, Uber, Shopify, Morgan Stanley, Airbnb, Wix, Spotify, Yelp, Hulu, Intuit, ING, eBay, and countless others.

https://www.bleepingcomputer.com/news/security/twilio-exposes-sdk-attackers-inject-it-with-malvertising-code/

Interesting Observations on Hate groups:

 1 - Education plays a MINOR role in determining who does or does not join a hate group. 

2 - The more religious groups on the East Coast, the more hate groups. 

3 - Poverty is a crucial driver. 

https://talglobal.com/knowledge-center/the-map-to-hate-groups/

The Ransomware attack was thwarted but the ransom was paid. Wonder Why?

 By the time the company responded, the unidentifiable hackers already had stolen a data subset. According to the company "We paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed,”.  I, wonder what "confirmation" means here (A picture of Mickey Mouse?)

https://www.hackread.com/cloud-hosting-blackbaud-pays-ransom-ransomware-attack/

Our smart phones have multiple privacy settings that can improve security. Here are a few that we could use

https://www.zdnet.com/article/privacy-settings-how-to-secure-your-iphone-and-android-device/

Finally, Nice to see a solution for the Robocall torture - T-Mobile customers (with Magenta and Essentials plans) will also be able to get a free PROXY phone number that can be used when they want to keep their main (personal) phone number private

https://www.bleepingcomputer.com/news/security/t-mobile-announces-free-scam-shield-robocall-and-scam-protection

Fact is stranger than fiction - This critical WORMABLE vulnerability existed for 17 years - SIGRed (CVE-2020-1350) . The Windows DNS bug can in some cases be exploited with no action on the part of the target user, creating a seamless and powerful attack.

https://thehackernews.com/2020/07/windows-dns-server-hacking.html

Another good reason to deploy MFA and increase Awareness Training / Phishing exercises - Researchers from Agari who discovered the operation — dubbed Cosmic Lynx — claim that this is the first-ever reported case of a Russian cybercriminal outfit running an organized BEC phishing scam.

https://www.scmagazine.com/home/security-news/cybercrime/bec-scams-grow-in-complexity-as-russian-actors-launch-cosmic-lynx-operation/

Top 3 Threats according to DHS Cybersecurity and Infrastructure Security Agency (CISA)- Backdoors (some have forgotten about it), cryptominers, and ransomware constituted more than 90% of the active signatures detected.

https://www.darkreading.com/vulnerabilities---threats/dhs-shares-data-on-top-cyber-threats-to-federal-agencies/d/d-id/1338261

Curious - How many of us think about what happens when we share information online - is it Stored? if so, safely?, How long ?, whom is it shared with? and finally, what happens if it is exposed?

https://www.wired.com/story/dating-apps-leak-explicit-photos-screenshots/

Ripple20 bug - The curse of IoT continues

 19 different vulnerabilities, four of them critical, are affecting hundreds of millions of internet of things (IoT) 

https://threatpost.com/millions-connected-devices-ripple20-bugs/156599/

FREE - 150+ tools and resource from SANS.

https://www.sans.org/media/free/free-faculty-tools.pdf

We can stop using Facebook and Whatsapp for conveying our messages , our light bulbs can do that for us (One minor problem, they can do it without your consent)

.Good news is that it is not easy (at this point in time)as additional gadgets and multiple steps are involved.

https://threatpost.com/lamphone-hack-lightbulb-vibrations-eavesdrop/156551/

Protect your YouTube accounts - Stolen accounts can be used to spread malware and launch fraud scams against viewers, it is also used to blackmail the account owner.

 One snap poll run by an underground forum revealed that 80% of (dark web) members wanted to see more YouTube credentials put up for sale.

https://www.infosecurity-magazine.com/news/dark-web-demand-youtube-account/

Ransom-warez - No hacking skills needed , just visit auction site and bid for (interesting) stolen data.

With many companies losing our personal information , the only solution for us is to be vigilant and follow simple policies like "Think before you Click/Pick (phone)" and keep an eye on credit/bank reports.

https://www.bleepingcomputer.com/news/security/revil-ransomware-creates-ebay-like-auction-site-for-stolen-data/

Important Ransomware Lessons:

1 - "Prevention is better than cure"
2 - Backups help with recovery but, won't prevent a data breach. 

We now have NetWalker - “ransomware-as-a-service” (RaaS) - Threatens to publish victims’ data on the internet if ransoms are not paid.  Attackers send poisoned emails are sent that appear related to the Coronavirus crisis. It  can also masqueraded as the legitimate password management app Sticky Password.

https://www.tripwire.com/state-of-security/featured/netwalker-ransomware-what-need-know/

Salted Passwords are good. but, if old algorithms like MD5 then it is no use

In case of Mathway, the storage mechanism for the passwords is PHPASS, which gets salted MD5. Allan says " if I wanted to crack these passwords,I could do so on a rig that computes millions of MD5 hashes a second. With more secure cryptographic hashes, such as bcrypt or scrypt, it is much slower to compute the hash."

https://www.scmagazine.com/home/security-news/mathway-breach-latest-caper-for-shiny-hunters/

Android user check if your device vendor has a fix for bug StrandHogg 2.0 (CVE-2020-0096)- Similar to previously discovered StrandHogg but more dangerous and more difficult to detect. Attackers can access SMS messages and photos, swipe login credentials, track GPS movements, record phone conversations, access the camera and microphone, and review contact lists and phone logs.

https://www.scmagazine.com/home/security-news/vulnerabilities/strandhogg-2-0-bug-enables-android-app-hijacking-poses-patching-challenge/

ATM Skimmers - This one has three bad news

1 - ATM Skimmers (nothing new)
2 - ATM vendor wanted to install it
3 - The vendor enjoyed legal protection from a top anti-corruption official in the Mexican attorney general’s office.

https://krebsonsecurity.com/2020/05/report-atm-skimmer-gang-had-protection-from-mexican-attorney-generals-office/

Few ransomware stats to help manage your business risk

: 1 - Criminals succeeded in encrypting the data in 73% of these attacks.
2 - 59% of attacks involved data in the public cloud.
3- One in five organizations has a major hole in their cyber security insurance.
4 - The average cost to rectify the impacts is US$732,520 for those who do not pay the ransom, rising to US$1,448,458 for those who pay.

Good news - 56% got data back via backups than by paying the ransom .


https://news.sophos.com/en-us/2020/05/12/the-state-of-ransomware-2020/?cmp=26105

iPhone Spyware called "Hide UI" used by law enforcement, can track a suspect's passcode when it's entered into a phone. In order for this feature to work, law enforcement officials must install the covert software and then set up a scenario to put a seized device back into the hands of the suspect

https://www.nbcnews.com/tech/security/iphone-spyware-lets-cops-log-suspects-passcodes-when-cracking-doesn-n1209296