Insider Threat - Money talks BS Walks - In this case - AT&T employees took bribes to unlock millions of smartphones, and to install malware and unauthorized hardware (rogue Wireless Access points) on the company's network.More than $1 million in bribes were paid to several AT&T employees.

The bribery scheme lasted from at least April 2012 until September 2017

Fahd bribed AT&T employees to install malware on AT&T's network at the Bothell call center.

In November 2014, as Fahd began having problems controlling this malware, the DOJ said he also bribed AT&T employees to install rogue wireless access points inside AT&T's Bothell call center. These devices helped Fahd with gaining access to AT&T internal apps and network, and continue the rogue phone unlocking scheme.

The DOJ claims Fahd and Jiwani paid more than $1 million in bribes to AT&T employees, and successfully unlocked more than two million devices, most of which were expensive iPhones. One AT&T employee received more than $428,500 in bribes over a five year period,

https://www.zdnet.com/article/at-t-employees-took-bribes-to-plant-malware-on-the-companys-network/

“The Equifax settlement is laughable,” Senator Ron Wyden - - “With just $31 million to be divided up by all the Americans who filed to receive their $125 check, Americans have the choice of receiving pennies for having their credit details spilled out online, or receiving virtually worthless credit monitoring,”

As part of the $575 million settlement, up to $425 million was set aside to compensate those who could clearly prove they were victims of identity theft as a result of the breach.

For those unable to prove clear financial harm (most of us), the settlement offered users either free credit reporting for ten years, or a $125 one time cash payout. But because the FTC only set aside $31 million to pay for these payouts, it quickly ran out of cash and is now falsely telling consumers the free credit reporting is a “much better value.”

https://www.vice.com/en_us/article/d3agv7/the-equifax-settlement-is-a-cruel-joke

Unexpected freebie from Google that you might NOT like - A secret (hidden) microphone in home alarm product. Google says it goofed by keeping the microphone secret

    “The on-device microphone was never intended to be a secret and should have been listed in the tech specs. That was an error on our part.”

It went on to explain to Business Insider that it’s not unusual for security systems to have built-in microphones:

    “The microphone has never been on and is only activated when users specifically enable the option.”

https://hotforsecurity.bitdefender.com/blog/google-in-hot-water-after-not-revealing-it-had-hidden-a-secret-microphone-in-home-alarm-product-20863.html

Capital One needed a Skilled engineer for 100M hack, Honda only needed a dumb admin to expose 134M rows of sensitive data

 The data was on an unsecured Elasticsearch database that was freely accessible to anyone who came across it, and contained in-depth information about the company’s security systems and network.

This includes technical details of each individual computer, including IP addresses, operating systems, unique network identifiers and security solutions and patches.


As a result, the data would provide any malicious actors with an exhaustive map of the company’s systems, including all the soft spots that would provide easy access to the network. Any skilled – or even relatively unskilled – hacker could use this information to perform a successful and potentially devastating cyberattack on Honda, such as highly targeted attacks on high value employees

https://www.verdict.co.uk/honda-database-exposure/

Apple iPhone/iPad users - Upgrade you iOS to 12.4 - Apple has fully patched five of six critical flaws including CVE-2019-8624 and CVE-2019-8646, which allow an attacker to read files off an iOS device remotely, without any interaction from the victim. The code to exploit these vulnerabilities is publicly available.

Only 9.6 percent of devices have been updated to iOS 12.4, as of August 1 – 10 days after the patch was released on July 22 and three days after the vulnerability was disclosed to the public on July 29.

“The exploit initiates a dump of the victim’s iMessage database and compromises the iOS sandbox, putting files on the device at risk,” explained Cuddeford, in a post on Thursday. “This vulnerability calls into question the integrity of iOS sandboxing, which is one of the most significant fundamentals of the entire iOS security model. This iMessage exploit has similar implications to a jailbreak in that the weakness in iMessage exposes the file space on the device.”


https://threatpost.com/90-enterprise-iphone-users-imessage-spy-attack/146899/

Capital One, 100M customer info stolen - All it took was a misconfigured firewall and an experienced software engineer.

Misconfiguration is something that  in any security system/application because Vulnerabilities are easier to find compared to misconfiguration.

Approximately 100 million of the affected customers are in the US, with the remaining six million in Canada

The Capital One breach was discovered on 19 July 2019. The hack took place on 22 and 23 March.

On Monday, the FBI arrested the person allegedly responsible: Paige Thompson, a 33-year-old former systems engineer

https://www.verdict.co.uk/capital-one-breach/

After Google it is Apple - Apple contractors 'regularly hear confidential details' on Siri recordings

Apple Watch and the HomePod smart speaker as the most frequent sources of mistaken recordings.

Sometimes, “you can definitely hear a doctor and patient, talking about the medical history of the patient.

A whistleblower , who asked to remain anonymous, expressed concerns about this lack of disclosure, particularly given the frequency with which accidental activation pick up extremely sensitive personal information.

The contractor said staff were encouraged to report accidental activation “but only as a technical problem”, with no specific procedures to deal with sensitive recordings

“There’s not much vetting of who works there, and the amount of data that we’re free to look through seems quite broad. It wouldn’t be difficult to identify the person that you’re listening to, especially with accidental triggers – addresses, names and so on.

https://www.theguardian.com/technology/2019/jul/26/apple-contractors-regularly-hear-confidential-details-on-siri-recordings