❌

Reading view

↗️

Update your RSS feed! ~this week in security~ has moved

✇~this week in security~ Archive Feed
Update your RSS feed! ~this week in security~ has moved
Same newsletter, new digs! Please update your RSS feed.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

~ ~

PLEASE UPDATE YOUR RSS FEED!
Hello cyber friends!

This is Zack from ~this week in security~ with a quick message about this RSS feed. The short version is that I've moved to Ghost! The move includes a brand new website, over seven years of past newsletter issues, plus much more.

To keep receiving the newsletter by RSS feed, you'll need to swap out the new feed address in your reader app. (Sorry for the hassle.)

The feed for all newsletters is: https://this.weekinsecurity.com/past-issues/rss/

But wait, there's more! As part of my move to Ghost, ~this week in security~ has also expanded into a blog with regular cyber analysis and more for premium subscribers. Of course, there's also a feed you can monitor for when new articles drop. You can keep track at https://this.weekinsecurity.com/articles/rss

Thanks so much for reading!

Zack
this.weekinsecurity.com
~ ~

BONUS CYBER CAT
From my personal collection, this is Toby, who spends much of his Sunday mornings snuggling by my side and snoozing while I write the newsletter.
Toby is my tabby cat who can be seen here snoozing on the couch.
~this week in security~ doesn't track email opens or clicks.
($) indicate sites with paywalls or logins. Please support journalism!

Our mailing address is: 
~this week in security~
Zack Whittaker
PO Box 415
Jersey City, NJ 07303-0415

Add us to your address book

You can update your preferences or unsubscribe from this list.
  •  
  • ↗️
↗️

this week in security — august 24 2025 edition

✇~this week in security~ Archive Feed
this week in security — august 24 2025 edition
UK to drop Apple backdoor demand, Scattered Spider hacker jailed, Workday hit by Salesforce breach, feds seize massive DDoS-for-hire botnet, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 34
View this email in your browser | past issues | RSS

~ ~
Before we begin... ~this week in security~ is moving to Ghost. Same newsletter, new digs! Look out for an email from me soon. For now, onwards to this week's news!
~ ~

THIS WEEK, TL;DR

U.S. spy chief says U.K. drops demand for Apple backdoor access
Washington Post ($): The latest round of Crypto Wars came to a somewhat bureaucratic end this week when the U.S. spy chief Tulsi Gabbard tweeted that the U.K. had "agreed to drop" its secret legal order demanding an encryption backdoor to Apple's cloud. You'd be right to be cautious and somewhat skeptical of the announcement, given that the U.K. hasn't commented yet (only to say it doesn't comment on these matters), and neither has Apple, which remains technically subject to the U.K.'s secret backdoor demand until we hear otherwise. In short, the U.K. government sought secret access to any Apple-held customer data in its encrypted cloud, but that drew ire from the U.S., and the White House reportedly threatened ending its data-sharing agreement as a result. Yes, this a win for common sense, but these laws exist for the sole purposes of surveillance and they're unlikely to go away. Even though Google and Meta say they haven't been ordered to backdoor their systems for U.K. access, the risk remains in the future. In any case, it's unlikely that Apple's top cloud security feature, ADP, will ever return to the U.K.
More: Reuters ($) | BBC News | The Times ($) | @DNIGabbard
DNI Tulsi Gabbard tweet: "Over the past few months, I’ve been working closely with our partners in the UK, alongside @POTUS and @VP , to ensure Americans' private data remains private and our Constitutional rights and civil liberties are protected. As a result, the UK has agreed to drop its mandate for Apple to provide a "back door" that would have enabled access to the protected encrypted data of American citizens and encroached on our civil liberties."
Man charged with running Rapper Bot, a DDoS service that targeted the Pentagon
KrebsOnSecurity: A 22-year-old man from Oregon has been arrested and charged with running a massive DDoS-as-a-service that was capable of knocking entire websites offline. Ethan Foltz allegedly ran the "Rapper Bot" botnet made up of some 65k-90k hacked internet-connected devices around the world, clocking traffic-flooding attacks in the range of 2 terabits per second, making it one of the largest known "booters" today. According to the criminal complaint, Foltz tried to stay off the feds' radar by ensuring the botnet never pointed at Brian Krebs' website, fearing an attention-grabbing attack would get the botnet caught. This strategy seemed to be largely working, with the botnet growing in size. In May 2025, KrebsOnSecurity was hit by an unrelated 6.3 terabit DDoS attack (the largest Google, which protects the site, had ever defended). It was this attack that caught the attention of Rapper Bot, saying "going against Krebs isn’t a good move" (fact check: accurate). Still, targeting the Pentagon also wasn't a good idea, and ultimately got the operator caught.
More: Justice Department | DefenseScoop | Cyberscoop | @briankrebs

First member of 'Scattered Spider' sentenced to 10 years
Bloomberg ($): After a few years of high-profile hacks and a blitz of data breaches, the first member of the notorious Scattered Spider hacking group has been jailed for his role in the gang's cyberattacks. Noah Urban, 20, got 10 years in prison for wire fraud and aggravated identity theft, for his role as a "caller," a skilled social engineering who calls up IT helpdesks or phone companies and tricks employees into handing over access to an employee or customer's accounts (though, these skills were allegedly not always necessary...). These attacks worked incredibly well at times, allowing the hackers to break into some of the biggest tech companies, like LastPass, DoorDash, Mailchimp, and others. The gang went quiet for a bit after Urban's arrest, but came back with a vengeance, attacking retail, insurance and transportation sectors. To note just how brazen these hackers are: One suspected group member "hacked a Florida-based magistrate judge to see whether a defendant had provided information about his co-conspirators" 👀... The hacker "accessed a copy of Urban's sealed indictment" before their access was shut down.
More: Justice Department | Daytona Beach News-Journal | KrebsOnSecurity | DataBreaches.net

Workday says personal data stolen from its Salesforce database
TechCrunch: Workday had a data breach of one of its Salesforce databases, exposing the contact (read: personal) information of an unspecified number of individuals. Workday, which is the world's largest HR tech giant with data of more than 11,000 corporate customers (and millions of their employees), said it had "no indication" of access to customer tenants or their data. Not the strongest statement in the world, as regular readers will know. A spokesperson wouldn't budge on disclosing the number of those affected or if the company has logs to detect any access to customer data. (Disclosure: I wrote this story!) Workday is the latest firm to have its Salesforce data swiped in recent months; Cisco, Qantas, and Google are also affected; Google attributed these hacks to ShinyHunters, which is said to be preparing a leak site. (Also, good grace points deducted from Workday for using "noindex" code on your site — don't hide your data breach notices from search!)
More: Workday | Bleeping Computer | Cybersecurity Dive | Archive: CISA
~ ~

THE STUFF YOU MIGHT'VE MISSED
Age verification is breaking the internet
Mashable: Solid reporting from Mashable looking at age verification, an emerging but ongoing threat to the open internet. Just this week, Bluesky pulled its service from users in Mississippi after an age-checking law took effect. By siloing users or regions that require age checks before users can get access to websites is creating a fragmented, broken internet that's also fueling the massive surveillance of collecting people's identity documents (related: Wired ($)'s story from late July is also a great read.). Protect the children, sure, but not at the expense of everyone losing their privacy. This isn't a zero-sum game; governments, do better! At a time when North Koreans are spitting out fake IDs a dime a dozen to gain fraudulent employment, the very process of checking IDs doesn't even work.
Sam Sabin post on Bluesky: "North Korean IT workers are pretty good at whipping up fake ID documents and resumes. AI is only making them better. These examples from real cases might have obvious tells to us now — but recruiters are pouring through hundreds of applications. The tells aren't so clear after a certain point," followed by two photos, one including a fake U.S. ID of a North Korean IT worker.
Lumma password-stealing malware bounced back after FBI takedown
Recorded Future: New research shows the world's largest password-stealing malware, Lumma, has bounced back following a law enforcement takedown operation earlier this year. The malware, which is often found buried in normal-looking but malicious apps, continues to pose a "significant threat, actively exfiltrating data from individuals, organizations, and governments." More from @julianferdinand in a Bluesky thread.

New zero-day startup offers $20 million for tools that can hack any phone
TechCrunch: A startup called Advanced Security Solutions (yes, that acronym) is offering a $20 million bounty for anyone who can hack any phone with a text message. Shady companies like this exist effectively as brokers of zero-day bugs to anyone who will pay full price — typically governments — but realistically anyone with enough money can buy phone-busting exploits despite little regulation. A source familiar with the zero-day market told TechCrunch that the $20M price-tag was about right, if not on the lighter side, depending on "how unscrupulous you are."

Proton says it's moving out of Switzerland amid surveillance law
Proton: The maker of privacy focused apps, Proton, says it's moving its physical infrastructure out of Switzerland as the country's lawmakers are planning to pass a surveillance law, which would effectively undermine the company's privacy promises. Alas, many folks are increasingly realizing that ostensibly private borders like Switzerland actually never really were, and can (and do) change over time. The best way to secure data from prying eyes is by not having access to it, or simply not collecting it to begin with.

Telco giant Colt cyberattack likely stems from SharePoint flaw
Double Pulsar ($): It looks like the cyberattack on U.K. telco giant Colt was ransomware, as taken credit by the Warlock gang. Trend Micro has a good blog on Warlock, which targets unpatched SharePoint servers to gain access to a victim's network. Per @GossiTheDog, aka Kevin Beaumont, Colt had an on-premise SharePoint server that had already been backdoored (via CVE-2025-53770) in the recent mass-hack wave by the time it was patched. As usual, this was a really good blog by Beaumont, providing a run down on how the Colt attack went down, but with sage advice and learnings peppered in. Also, again on the noindex nonsense...

Home Depot sued for allegedly secretly using facial recognition
PetaPixel: Looks like Home Depot is in hot water (yes, that's a home improvement pun) for allegedly using facial recognition at its checkout cameras. One shopper saw himself with a green box around his face appear on a checkout screen, and later launched a class action suit [PDF]. Look, I'm no genius but, please, do judge for yourself. Good luck (/sarcasm) to the Home Depot lawyers on this one.
A photo of a checkout screen showing a person taking a photo of himself, with a green box around his face, indicating likely use of facial recognition.
Microsoft curbs early access for Chinese firms to cyber flaws
Bloomberg ($): Microsoft won't provide companies in China (or any other country where companies have to report flaws to their governments) with access to advance notifications about bugs in its technologies through its program called MAPP. Previously, the aim was to provide details of flaws so security vendors can roll out fixes faster, but after the recent SharePoint-related mass-hacks, there were fears (though no evidence yet) that MAPP could've given the hackers a heads-up.

FBI warns Russian gov't hackers are exploiting bug in end-of-life Cisco routers
FBI IC3: Hackers linked to the Russian government are exploiting a 7-year-old unpatched flaw in end-of-life Cisco routers, aka CVE-2018-0171. Cisco updated its advisory following an FBI alert this week to warn about the flaw being used to target critical infrastructure.
~ ~

OTHER NEWSY NUGGETS
Oracle chief security officer suddenly departs: The surprise departure of Oracle's long-time security chief Mary Ann Davidson, who joined the company in 1988, took plenty by surprise. The departure — the specific reason as yet unknown — comes after Oracle announced job cuts as it ramps up on AI. Davidson's departure also comes after a massive data breach of its Oracle Health (Cerner) division, as fresh breach notifications continue to roll in. (via Bloomberg ($), CSO Online)

The week where weed deets leaked: Not a great week for weed users in Ohio and the U.K., where two unrelated companies apparently exposed their customers' private information. Per Website Planet, which first reported the incident, the Ohio case saw close to a million customer records — including Social Security numbers, government IDs, and health conditions, exposed to the internet. (via Cannabis Health, Wired ($))
A redacted screenshot of a ton of driver's licenses and other ID cards that were exposed to the web.
Orange Belgium breach hit 850,000 customers: At the end of July, Orange Belgium was hit by a hack that compromised the personal data, phone number, SIM card number and corresponding PUK codes of 850,000 customers, per the phone giant's latest statement. The breach is separate from a hack affecting Orange Group customers in France, which resulted in gigabytes of data stolen in a ransomware attack attributed to Warlock, per Bloomberg ($). (via Orange Belgium)

German top court overturns ad-blocker ruling: For more than a decade, a legal case brought by German publishing giant Axel Springer involving Eyeo, the maker of Adblock Plus, has been winding its way through the German legal system. While Eyeo has largely prevailed and the legality of ad-blockers remains untouched, Germany's top federal court has now partially overturned an earlier decision and remanded the case for further proceedings. Mozilla has a good post on this messy situation. The implications of this ruling aren't clear, and may not be for some time, but consider this a matter placed very much on your radar. (via @jsrailton)

Zscaler CEO says company using customer logs to train AI: The CEO of enterprise security giant Zscaler said this week that the company is using half-a-trillion daily "complete logs" to train its AI models. (This was first covered by The Stack last year with more details.) As SDX Central noted: "In practice, this means a substantial volume of data – traffic that enterprises typically regard as encrypted and protected – is being intercepted, processed, and effectively ingested into Zscaler’s systems." (via Steven Swift (LinkedIn), @vxunderground)

New Apple zero-day drops: Update your iPhones, iPads and Macs for the second time this week, a new zero-day just dropped. The bug can be triggered by way of a malicious image file, so that's... broad. Apple says it has a report that the bug may've been exploited in an "extremely sophisticated attack against specific targeted individuals" (its standard language these days). Don't delay! (via @zackwhittaker, @ryanaraine)

U.K. criminal background checker breached: Keep an eye on this major breach: A leading U.K. provider of criminal records checks for employers, Access Personal Checking Services (APCS), which runs background checks for 19,000 organizations, has confirmed a data breach. The hack initially stems from a software development company called Intradev. (via The Register)
~ ~

THE HAPPY CORNER
What's that sound? It's peaceful, quiet and calm in the happy corner.

When the world is spinning out of control and everything seems to be breaking, remember that this is the true way:
Tinker post on Mastodon: "Move slowly and fix things."
Browsers are a personal choice, and not all are created equally. (I stopped using Chrome as Google began phasing out support for popular ad-blockers.) Firefox seems better, but even then it's getting bogged down by AI junk. Thanks to @gaytabase, there are a few Firefox settings that you can consider changing to switch it off.

And lastly, this week, a bonus cybercat, because why not? (As someone who has two cats who regularly "help" edit this newsletter, I certainly empathise with this.)
Elizabeth Tasker post on Mastodon: "My coauthor, not entirely helping. #NorahNeko," followed by a photo of her calico cat lying on a desk in front of a computer screen showing a journal paper that their human is currently checking to cite in the paper she's writing.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is CISO Storm, who can be seen here supervising active defense from the cyber-security team. You're doing the absolute best work, Storm, keep it up. Thanks so much to Paul W. for sending in!
Storm is a beautiful white fluffy kitty who is sat on an accessibility chair, looking into the camera.
🐈‍⬛ Send in your cyber cats! 🐈‍⬛ Got a cyber-cat or a non-feline friend? Send me an email with their photo and name and they will be featured in a future newsletter!
~ ~

SUGGESTION BOX
That's it for a very busy week in security. I'll be back as you'd expect next week with your usual round-up from the week, and more!

Thanks so much for reading and supporting this newsletter. It really means the world. As always, please get in touch if you have anything you want to share with me for the newsletter.

Catch you later,
@zackwhittaker
~this week in security~ doesn't track email opens or clicks.
($) indicate sites with paywalls or logins. Please support journalism!

Our mailing address is: 
~this week in security~
Zack Whittaker
PO Box 415
Jersey City, NJ 07303-0415

Add us to your address book

You can update your preferences or unsubscribe from this list.
  •  
  • ↗️
↗️

this week in security — august 17 edition

✇~this week in security~ Archive Feed
this week in security — august 17 edition
Russia blamed for US Courts and Norway dam hacks, NetScaler attacks hit critical infrastructure, Def Con research, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 33
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

U.S. officials suspect Russia of being behind U.S. court records hack
The New York Times ($): We start with Russia, which U.S. officials this week blamed for a long-running hack affecting the U.S. federal courts filing system, known as CM/ECF (or PACER). Russian hackers went from being merely suspected of orchestrating the hacks to probably doing the thing, making this (at least) the second major hack of the federal courts' filing system since the 2020 SolarWinds hack (also the Russians), say sources speaking to the Times. Per Bloomberg ($), the hackers lurked in the system for years, targeting "sealed documents in espionage and other sensitive cases," including those involving fraud, money laundering, and agents of foreign governments. Politico, which first broke the story, says the bugs exploited this time around were known since the first hack back in 2020. This is arguably the first major cyberattack of Trump's presidency, and so far, honestly, crickets from the White House about it. Trump had face-time with Russia's Putin this week, a rare meeting of the two superpowers, which by all accounts didn't go very well, but would've also been a good opportunity to ask Putin and his cyber cronies to dial back on some of their cyberattacks.
More: TechCrunch | Wired ($) | CNN | Politico

Norway spy chief blames Russian hackers for dam sabotage
The Register: Speaking of Russia, Norway's spy chief blamed Russia for a cyberattack targeting a dam in the west of Norway earlier this year. The breach allowed the hackers to open a floodgate for several hours, spilling the equivalent of three Olympic-sized swimming pools of water out of the dam before the attack was discovered and stopped. It's the latest reported effort by Russian hackers to meddle in other countries' critical infrastructure, efforts that Russia knows all too well. According to Reuters ($), Polish authorities also revealed that they foiled a suspected Russian-backed cyberattack on a large Polish city's water supply, which could have cut off supplies to local homes. Critical infrastructure remains massively underfunded low-hanging fruit for malicious hackers.
More: Reuters ($) | SecurityWeek | VG.no

NetScaler hacks hit Pennsylvania AG, Dutch critical infrastructure
Statescoop: It's looking like the office of Pennsylvania's attorney general is having a rough one after disclosing a "cyber incident," per a statement. According to @GossiTheDog, the breach is linked to the recent NetScaler attacks, which took down the office's email, its website, and phone lines. The same NetScaler bug, disclosed last month and tracked as CVE-2025-6543, is also wreaking havoc in the Netherlands, where critical infrastructure systems were hit (including traffic systems), said the country's cybersecurity center. There are said to be thousands of vulnerable NetScaler devices still on the internet, despite patches being released.
More: Cybersecurity Dive | @shadowserver | @paattorneygen

Def Con's final day drops reams of research and Pwnie Awards
As expected, there was plenty of spillover from last week's Def Con into this week's newsletter, thanks to some top-notch findings revealed last Sunday. We have... *breathes in*... hackers breaching a North Korean hacker's computer and writing about it for Phrack... a hacker found bugs exposing access to a carmaker's centralized car portal, allowing the remote control of some car functions (disclosure: I wrote this!)... a peek inside the gray market of video game hacks... and, the winners of the Pwnie Awards — congrats to @micahflee whose amazing reporting and research on Signalgate won the White House the Pwnie's Epic Fail award. But, this wasn't a Def Con without controversy, as the show faced heat for cozying up to the U.S. military and authoritarian regimes like Bahrain.
More: TechCrunch | Wired ($) | Heise.de | Jack Poulson | @micahflee
Micah Lee post on Mastodon: "Check out my #DEFCON33 talk about the Signalgate, full of unbelievable incompetence from the highest levels of the Trump administration."
~ ~

THE STUFF YOU MIGHT'VE MISSED
Security pros' paper reveal Iranian cyber threat tactics
Tarah Wheeler: Top security boffs Wheeler et al dive into the many ways that network defenders can get ahead of Iranian hackers, an increasingly formidable group of cyber-actors today. Some of Iran's top hacks rely on simplicity and scale, like email spearphishing. This blog outlines some of the top things to look out for from the perspective of front-line cyber defenders who live and breathe this.

Ransomware gangs have added EDR-killers to their hacking arsenal
The Register: Ransomware gangs are incorporating kernel-level malware capable of disabling endpoint detection (aka EDR) systems and allowing the hackers to steal data and extort victims.At least nine ransomware gangs have been seen using EDR-killers in recent months. "This isn't state stuff," says @hacks4pancackes, referring to criminals using these exploits, not government hackers.
Lesley Carhart post on Bluesky: "You really should read this article on how criminal groups routinely bypass EDR. This isn’t state stuff. I see it all the time, and have for a while. The sad truth is EDR is one rung in defense in depth and it surviving tampering is a perpetual cat mouse game."
How Apple's XProtect's detection rules have changed over 6 years
Eclectic Light Company: Here is a little look inside how XProtect, the anti-malware engine built into macOS, has changed over the past six years, notably growing its signature list by fourfold.

Security founders discuss lessons in bootstrapping their startups
Dark Reading: I enjoyed this read on startup bootstrapping, especially in cybersecurity, at a time when VC money is flooding the market (and sprinkling everything with AI for the sake of it). Huge respect to those who can bootstrap, but definitely in awe of anyone who stay bootstrapped years in. Thinkst Canary and IOActive, to name a couple, are examples of cyber companies doing things right.

Data broker behind major SSN breach returns. Here's how to opt-out
PCMag: Bankrupt, but not out, National Public Data, the data broker that had a massive breach of Social Security numbers last year, is now back after new (unknown) owners saved the company from going under. As such, National Public Data is back online (yuck) but you can at least opt-out of having your data searchable. (More words from DataBreaches.net.) Meanwhile: The Markup reports that data brokers are hiding their opt-out and privacy tools from search engines, and now at least one U.S. senator wants answers as to why, per Wired ($).
~ ~
THANK YOU FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
British bobbies expand face scans with vans: Facial recognition is rolling out on wheels (think local police vans) across the U.K., despite the unreliability of facial recognition and the chronic problem of false positives wrongly identifying suspects. The Register has a good look at how the U.K. government is getting high on its own surveillance supply... (via The Register)

Canadian Commons reports data breach: A breach at the Canadian House of Commons saw information about government employees and devices stolen, per CBC News, citing an unspecified Microsoft vulnerability as to blame for allowing the hackers into a database. It's not clear what the Microsoft bug is referring to, despite warnings about SharePoint and Exchange of late. (via CBC, The Record)

Spilling TeaOnHer users' data in less than 10 minutes: Last week I reported on a super shady dating gossip app called TeaOnHer that publicly exposed users' driver's licenses, which users had to upload before they could access the app. This week I wrote the post-mortem (disclosure alert!) about how I found the easy-to-find bugs within 10 minutes of being sent its App Store listing. Not a flex; the bugs were literally that easy to find. Follow along for the ride and subsequent disclosure. (via TechCrunch, @senatorshoshana)
Two driver's licenses, one from Texas and the other from Massachusetts (redacted) which were exposed by the TeaOnHer app.
Warlock gang hacks telco giant Colt: U.K. telco and networking giant Colt has been hacked by the Warlock ransomware gang, with the company taking down its customer portal and voice API platform as a "protective measure." The gang took credit for the breach and is now selling data stolen from its internal network. Colt hasn't given a timeline for its recovery. (via Bleeping Computer, GossiTheDog)

Resettled Afghans hit by second data breach: Thousands of Afghans who were brought to the U.K. after a 2022 data breach (which was kept a secret until July) exposed their data and put them at risk of death from the Taliban, have been subject to another data breach. This time it's the fault of Inflite The Jet Centre, which provides ground services for flights at London airports. (via BBC News)
~ ~

THE HAPPY CORNER
*trumpets trumpeting* It's back! It's the happy corner, where nobody knows your name (because privacy, obviously).

We start with a cat caption contest.
A cat sat at a table in a livign room, looking at the camera, with a tiny cat-sized laptop in front of them.
It sounds like the start of a joke, but... A duck walks into a highly secure datacenter... (the thread continues...)
Pepign post on Mastodon: "I'm on the server floor of a "highly secure data center with 24/7/365 surveillance, direct access control and robust perimeter security". An actual duck just walked by. 🦆 The panic is absolutely glorious. I think this just became one of the highlights of my life."
When a flamboyant Waluigi workplace profile picture chooses you.

I absolutely loved this project by Daniel Cuthbert, hacker and photographer extraordinaire, who used a decades-old Sony Mavica MVC-FD88 camera with a 1.44" floppy disk drive for storage, to capture retro-style photos of today's top hackers from this year's Def Con. Very cool indeed!

And lastly, a final and everlasting thank you to Stephanie "Steve" Shirley, who died earlier this month at the age of 91. Steve, as she was known, was a computing and tech pioneer whose early work on women's rights helped to bring in some of the smartest minds the world has ever seen in what was a male-dominated field. Amazing reporting from BBC News, which chronicled some of her life in their obituary. Rest in power, Steve.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
A rare triforce of cats, meet Ray, Moo, and Sis (back to front), who can be seen here scarfing down their dinner after a busy day of hacking. Remember, cybersecurity takes a village and the more eyes the better. Thanks to Tori N. for sending in!
Keep sending in your cyber cats! Got a cyber-cat or a non-feline friend? Send me an email with their photo and name and they will be featured in a future newsletter!
~ ~

SUGGESTION BOX
And that's it for this week, thank you so much for reading! I'll be back next Sunday with the roundup from the week. As always, feel free to drop me an email with anything about or for the newsletter. 

See you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — august 10 edition

✇~this week in security~ Archive Feed
this week in security — august 10 edition
Black Hat and Def Con 2025, Google and Cisco disclose Salesforce data breaches, U.S. Courts' PACER hacked (again), and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 32
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Black Hat kicks off annual 'Hacker Summer Camp' week in Las Vegas
Welcome, and happy Hacker Summer camp week to all those who celebrate! It's that time of year where hackers from around the world descend on Las Vegas to see and hear new cybersecurity talks and research. Black Hat kicked off by featuring keynotes from Citizen Lab's director, who warned of rising U.S. authoritarianism at a time when hackers can fight back, and the ACLU's top surveillance lawyer, who called for better privacy and better care of our data. Thinking about people, their data, and how to protect it was a key theme at the show, with NSA top brass warning small defense businesses to shore up their security, and others are helping security leaders plan for the worst. The show also dished out some fun new findings, like hacking satellites; uncovering privacy flaws in Apple's new AI features; and a bug that left Dell laptops exposed to hacks, per Reuters ($). There are plenty of photos from the show, so you, like me (who wasn't there this year), can live vicariously through others who were on the ground.
More: HelpNetSecurity | The Register | Cyberscoop | Wired ($) | TechCrunch | @pjhillier | @metacurity

Def Con hacking conference follows as new research drops
And as soon as Black Hat is done, it's time for Def Con, the slightly more chill and laid-back affair compared to Black Hat. The Register had a great tl;dr ahead of the week. Def Con founder Jeff Moss chatted about the show's history, as well as with ex-NSA director Paul Nakasone, who — albeit slightly tipsy — warned about the "new direction" we're collectively moving in. But we also saw some top research from the show, including how a school vape detector turned into a wiretap, per 404 Media ($); how a low-cost quantum sensor could advance the field according to Wired ($); and how hackers are helping to protect critical infrastructure, like water systems. Plus, a story from me about how a prolific SMS scamming operation netted thousands of stolen credit cards (disclosure alert!). And... if you think I was kidding last week about plugging in a keyboard into a bus... think again. (FYI, there may be more from Def Con next week as the show finishes at the same time this newsletter is written!) The happy corner below has some especially good news from Def Con...
More: 404 Media | Wired ($) | ABC News | TechCrunch | @kevincollier
Kevin Collier post on Bluesky: "I'm at Dec Con watching @thedarktangent.bsky.social interview former NSA/Cyber Command head Paul Nakasone. I'm not sure if he's going to say anything newsworthy (I'll holler if he does), but I can tell you he did three shots of bourbon before the talk and you can really tell," followed by another post that reads: "I'm not a cop but for context it's 10:49am local time."
Air France, Cisco, Google, and KLM hit by Salesforce data thefts
Bleeping Computer: What do Air France, Cisco, Google, and KLM have in common? They've all had data stolen from their Salesforce instances. Google became the latest corporate giant to admit it had some customer data stolen from a Salesforce server, attributing the hack to ShinyHunters. Google said in an updated blog post about the hackers that they were likely preparing a leak site to extort victims into paying them. (@Metacurity has a copy of the breach notification.) By all accounts, there's a fair number of affected companies so far. Cisco also said it had data popped in a suspiciously similar way. Bleeping Computer connected the Air France and KLM breaches to Salesforce, too. Of course, the excellent DataBreaches.net parses some of the latest developments, including the new victims. Whenever this supposed leak site comes out, expect it to make waves.
More: WWD ($) | TechCrunch | @campuscodi | @troyhunt

U.S. Courts warns of new hack affecting PACER federal courts system
Politico: OK, what year is this, 2021?! Nope, it's the year 2025 and we're back with yet another hack of the U.S. Courts record filing system, aka PACER. Politico broke the news this week that PACER, and many of the "sealed" and non-public files within — including witnesses and testimony — may have been accessed during a sweeping hack affecting multiple states. It's not yet clear who's to blame, but last time it was the Russians exploiting the SolarWinds software. This time it could be the same or anyone else in between, including state actors or non-affiliated cybercriminals. The U.S. Courts confirmed the breach soon after Politico's story, saying it's made security progress since the last hack (but evidently, not enough). I feel like there is a lot more to this story, and we may learn more soon.
More: U.S. Courts | Fedscoop | DataBreaches.net
~ ~

THE STUFF YOU MIGHT'VE MISSED
SonicWall says dozens of attacks linked to 2024 bug, not zero-day
SonicWall: SonicWall said the five-alarm alarm over recently observed exploitation of its customers' firewalls devices was related to the older CVE-2024-40766 bug, which is already patched and not caused by a zero-day as first believed. That said, SonicWall said there have been around 40 incidents detected so far related to exploitation of the bug.

CISA sounds alarm about spicy Exchange security bug
CISA: U.S. cybersecurity agency CISA is warning about a new bug in self-hosted Exchange servers, aka CVE-2025-53786. If exploited, the bug can allow malicious hackers with a foothold already on the on-premise server to pivot to a victim's cloud-based systems in hybrid configurations. The bug hasn't come under exploitation yet, but CISA says it's serious enough to require government agencies to patch by... Monday. If you're affected, you should as well!
David DiMolfetta tweet: "NEW: The Microsoft Exchange vulnerability disclosed tonight coincided with a talk delivered at Black Hat, where a security researcher demoed the exploitation. Federal systems are exposed and an emergency directive is planned tomorrow, I’m told:"
Mobile app library caught leaking users' personal data
Cossack Labs: An unnamed code library used in a mobile app for analytics was leaking customer data to its backend, including passwords and tokens. The library is now fixed. Apps can be packed with trackers and bits of code used by developers for analyzing bugs, for example, but can also contain logs and other sensitive information collected from the app. A reminder to be careful about what code you rely on, it can burn you (and your customers).

Encrypted chat apps caught spilling unencrypted data
DataBreaches.net: Broxis and Chatox claim to be secure messaging apps that tout their encryption, but both apps — owned by the same developer — were spilling their backend database containing reams of unencrypted names, usernames, passwords, chat messages and attachments... woooof. Who needs a repeat of Signal-gate, said nobody ever?

uBlock Origin Lite comes to Safari users
Apple App Store: The maker of one of the web's favorite open-source ad blockers, uBlock Origin, has released (for iOS 18.6 and later) a lite version for Safari users. That's huge news for users who want to browse the web free of ad trackers and other web snoops. (Additional shoutout to Wipr2, another excellent ad blocker with a history of privacy-preserving awesomeness.)

Microsoft's new NLWeb protocol hit by embarrassing bug
Medium ($): Security researcher Aonan Guan has already found a pretty glaring security bug in NLWeb, the new protocol that allows AI-style search for any website (me: so half the time it'll get it wrong?). The flaw allows any remote user to read sensitive files on the server, like API keys. Worse, the bug is a path traversal, meaning it's easy to exploit with a malformed web address (aka "three dots to root")... which, if you haven't seen researchers ripping into their ease of exploitability, you're missing out. Microsoft has since fixed the bug. The Verge has more.
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A selection of stickers made by Zack Whittaker, including two cybercat mugs (one in black, one in white), on a grassy background,
~ ~

OTHER NEWSY NUGGETS
Infostealers on the NHS network: Thousands of employee login credentials for accessing the U.K.'s National Health Service have been swiped by infostealing malware, putting the health network at risk of hacks. Infostealers are usually installed by way of a legitimate-looking but malicious app that's packed with password-stealing code. The NHS says it uses multi-factor authentication, which — sure, great — but a lot of infostealers also steal session tokens and cookies, which can be used to bypass MFA. (via Bloomberg ($))

Deux hacks, très mauvais: Two of France's largest phone providers have been hacked in recent weeks, the latest is telecom giant Bouygues, which confirmed a breach affecting the personal information of 6.4 million customers (out of about 27 million mobile users). (Disclosure: I wrote this story.) The breach page is hidden by "noindex" code so it's effectively hidden from search engines (companies: don't do this). Orange was hacked in late July, causing disruption to services, though little was disclosed at the time. (via Bouygues, TechCrunch)

San Francisco under tech bro surveillance: If you want to enjoy California without having your face, likeness, and conversations recorded by tech bros wearing AI hardware pins and wearables that watch and listen to everything you do, maybe avoid San Francisco for the foreseeable future. (via San Francisco Standard)

California mulls banning surveillance pricing: Staying with California... A new state bill would ban tech companies from using discriminatory surveillance pricing to jack up costs and fees using phone data. If the bill becomes law (and there's still a way to go), it would prevent car-sharing giants like Uber and Lyft from using a person's low phone battery or location data to artificially increase the cost of a car share under the assumption that the user will accept the fee. (via The Markup)

Senators slam UHC for (more) security failings: A pair of U.S. senators sent a letter this week ripping into health tech company Episource after a breach affecting over 5 million people's personal and protected health information. Episorce is owned by UnitedHealth — yes, the same insurance giant responsible for the biggest healthcare-related data breach in history. Now UHG is on the hook for this latest breach. (via Healthcare Finance, U.S. Senate)

TeaOnHer, a rival Tea app for men, also spilled users' data: First there was Tea, an app that allows "verified" women to post about men they date, which was hideously coded and exposed the government IDs that women uploaded to login to the app. Now, there's TeaOnHer, an app for men to talk about women. What could go wrong...? Except, well, everything. For TechCrunch (disclosure alert!), I wrote about how the app had at least two major security flaws that we found were exposing the private data of its users, including driver's licenses and more. From leaky apps to a flawed fish tank, please stop vibe coding your stuff and actually put security first. (via TechCrunch)
~ ~

THE HAPPY CORNER
A very warm welcome to all! This is the happy corner.

First up this week, feel free to use this free and reusable "get out of meeting" card, courtesy of @evacide.
Evacide post on Mastodon: "I'm sorry I will have to miss this meeting because the cat has fallen asleep with his head on my shoulder and is making little snoring sounds."
TIL: If you've ever wondered why some malicious hackers try to use regular apps, like Slack, Discord, and Telegram as their command and control servers, it's so that the network traffic blends in with the rest and is more difficult to identify. Here are some cats that illustrate the point.

Congrats to former CISA head Jen Easterly who joins Huntress as an adviser. Easterly told Axios she was eager to join to help secure "target rich, resource poor" organizations, like the critical infrastructure sector, which keeps the lights on and the water running.

Someone made a browser-ready version of Windows XP (and docs to go with it), if you want some instant early '00's nostalgia.

*in a very loudspeaker voice* "Can the hackers on the casino floor please stop interfering with the equipment... thank you."
UltraSunshine post on Mastodon: "I just sorta assume this was one of us..." followed by a photo of a casino machine with a large screen with booting options displayed, clearly malfunctioning.
And... finally, but absolutely not least. A major congrats to hacker extraordinaire @BiaSciLab, the newest member of the Cult of the Dead Cow, the hacker supergroup that helped shape and change the world. What an absolutely incredible and well-deserved recognition for someone who is already leading the next generation of hackers! (via @RayRedacted, @medus4_cdc) 
Bia tweet: "The leaders have spoken. I have officially become the newest member of the Cult of the Dead Cow May this group live on forever .ooM" followed by a photo of the CDC group and a DEFCON 33 schedule.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's two-for-one cybercat special features Batman (top) and Arya (bottom), who can be seen here snoozing in the sun after a long day hacking. Zzzzzz. Thanks so much to Emily Y. for sending in!
Batman (top) and Arya (bottom) are two black and white, very cute sleeping kitties, basking in the sun.
🚨 Send in your cyber cats! 🚨Got a cyber-cat or a non-feline friend? Send in an email with their photo and name and they will be featured in a future newsletter!
~ ~

SUGGESTION BOX
That's it for this week, I hope you have a great rest of your day and weekend. For those heading home after Vegas, travel safe. If you saw anything from the shows you want me to highlight next week, drop me an email, I'd love to hear from you.

This newsletter was brought to you by some strong coffee, my cat Theo who was curled up by my side for much of the morning, and some glorious weather here in the New York area.

I really appreciate you for reading. I'll catch you up next Sunday with everything you need to know from the week.

All my best,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — august 3 edition

✇~this week in security~ Archive Feed
this week in security — august 3 edition
Senate approves Trump's first cyber official, NSA's top lawyer ousted, ShinyHunters behind Salesforce data grabs, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 31
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Senate votes to approve U.S. national cyber director
Nextgov: The Trump administration (finally) has its first Senate-approved cybersecurity official, Sean Cairncross, the new national cyber director, following a 59-35 vote on Saturday. Cairncross, by his own admission, doesn't have a technical background but will now oversee the office, first set up during Biden's term, as the government's director of cyber policy across all federal agencies. If the White House also gets its way, it's also on track to get its pick of CISA director passed in the Senate, now that Sen. Ron Wyden has agreed to lift the hold on Sean Plankey's nomination after the agency confirmed it would release a long-withheld report detailing the state of security in the U.S. telecoms sector. This comes at the same time that U.S. states are saying they are increasingly wary of the federal government's cuts to cyber under Trump. At least two states, Arizona and New York, said these cuts are hurting their states and their ability to withstand cyberattacks as they effectively "go it alone."
More: Nextgov | Cyberscoop | NBC News | TechCrunch | @ericjgeller

Top lawyer at NSA is fired at urging of far-right influencer
The New York Times ($): From one government department to another... things are looking pretty bleak at the NSA. The U.S. eavesdropping agency is now without its top lawyer after its chief counsel April Falcon Doss was fired, which was blamed on far-right influencer Laura Loomer. (Loomer, well known for chaining herself to the doors of Twitter's HQ, previously took credit for the earlier ousting of the agency's director and its deputy.) Doss, who is well known in cybersecurity and privacy circles, has been the agency's top lawyer since 2022. Several lawmakers sounded the alarm on Doss' firing, not least because the role of the NSA's chief lawyer is critical for signing off on surveillance and hacking operations, which the NSA now doesn't have. This is one of the most powerful spy agencies in the world and presently rudderless. This happened in the same week that the U.S. Army Secretary rescinded a job offer at the U.S. Military Academy at West Point to the former CISA director Jen Easterly, who served in the Army, at Loomer's demand, as the purge of the U.S. government's institutional cyber knowledge continues.
More: Politico | MSNBC | @pwnallthethings | Jen Easterly (LinkedIn)
Pwnallthethings post on Bluesky: "If you want to understand just how big a loss, well, get and read her book, and you'll see the diversity of nuanced thought around privacy, data sovereignty, law, and national security that really very few people could equal, and that's what the US loses from a role that needs that more than ever"
SharePoint exploit now seen in ransomware attacks
Cybersecurity Dive: Security researchers at Palo Alto Networks said they are now seeing ransomware attacks as part of the mass-hacks targeting on-premise SharePoint servers, aka CVE-2025-53770. According to reports this week, close to a hundred state and local government systems were targeted in the wake of the attacks. China-backed hackers were among the first to exploit the bug in hacking campaigns, leading to a key question of how they discovered the bugs so quickly. ProPublica, which previously reported on Microsoft's use of engineers in China for national security projects, is now reporting that Microsoft's support for SharePoint is handled by another China-based engineering team — though, there's no evidence of wrongdoing. All of this comes at a time when Microsoft is trying to repair its image following security scandals in recent years, with some calling into question (with colorful headlines) its own secure-by-design initiative.
More: Reuters ($) | ProPublica | Heise.de
~ ~

THE STUFF YOU MIGHT'VE MISSED
U.K. age checks are blocking legitimate content and rely on AI guess work
BBC News: If you thought any of this age verification calamity was dying down, think again. Ostensibly "adult" content, like news reports on Gaza and Ukraine, are getting caught up under the U.K.'s new age checks system that took effect last week. Some online services are bucking the trend and using common sense by not relying on third-parties to do government ID age checks. But it's clear these age check requirements weren't thought out and are having real knock-on effects by preventing access to legitimate content. Now we're relying on tech companies using AI to guess someone's age — I'm not kidding — and if it guesses wrong, you have to upload your ID. Australia is next on the age checks list, so let's hope they don't face the same headaches as the U.K. and others have.

Google to disclose bug timelines within one week of discovery
Project Zero: Google's elite group of zero-day bug hunters, Project Zero, said it has started publicly announcing when it has started the clock on a 90-day bug disclosure period. By disclosing that "a bug" (without sharing specific details, of course) has been found in a particular product and with a timeline for disclosure, it hopes to help others who rely on that software to be ready for patches.
Natalie Silvanovich post on Mastodon: "While most vendors ship timely patches for vulnerabilities reported by Project Zero, they don’t always reach users. Today, we’re announcing Reporting Transparency, a new policy to encourage downstream fixes"
ShinyHunters said to be behind Salesforce data thefts
Bleeping Computer: A series of Salesforce-related data grabs of late, including at Qantas, Allianz Life, and luxury brand LVMH, was reportedly carried out by the ShinyHunters group. Bleeping dives into the group's latest activities, which relies on voice phishing to break into these cloud-stored CRM systems, and how this activity differentiates from Scattered Spider, which launched similar attacks around this time. Solid read. (via @ransomwaresommelier)

Sex toy maker Lovense exposed user email addresses and accounts
BobDaHacker: A security researcher said they found bugs in Lovense's API that exposed user email addresses, and put accounts at risk of takeovers, prompting store retailers to pull the company's sex toys from their shelves. (I confirmed the email disclosure bug and wrote about this for TechCrunch, disclosure alert!) The company eventually fixed the bugs but not without having a legal-related temper tantrum in the process.

Authorities seize BlackSuit ransomware gang's infrastructure
Lower Saxony State Criminal Police: A little sprinkling of good news from German authorities: U.S. and European police seized the infrastructure of BlackSuit, a prolific ransomware gang (formerly Royal), which hacked over 180 victims and netted over $500 million. The seized data will now be used to help identify other individuals associated with the gang. (via @campuscodi)
A screenshot of the BlackSuit ransomware site, now seized
Defected North Korean IT worker talks about their work
BBC News: The BBC has an interview with a North Korean IT worker, who was able to defect and tell their story. I bring up this threat on the semi-reg because of how widespread and global this issue is. Spotting this kind of activity is tricky, but one increasingly popular tactic is getting interviewers to go outside with their phone or laptop with their video on, as this makes it more difficult to deepfake someone else. Or, of course, ask your suspected North Korean interviewer to say something mean about Kim Jong Un. (It works!)
~ ~
THANK YOU FOR YOUR SUPPORT!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A selection of stickers made by Zack Whittaker, including two cybercat mugs (one in black, one in white), on a grassy background,
~ ~

OTHER NEWSY NUGGETS
Scramble as Dropbox, Microsoft drop passwords: Dropbox has announced it will discontinue Dropbox Passwords, the company's password manager, at the end of October. Meanwhile: If you haven't taken action already, well, welp, as Microsoft Authenticator dropped support for passwords on August 1 and stored passwords deleted. (via The Register, Associated Press)

Privacy for thee, but not for me: Senators may soon vote on a bill that would allow lawmakers to scrub some of their information about their houses and travel from the internet. Of course there are genuine risks with having your information out there, but if only these senators could think a little outside the box and expand this provision to all of America, we'd be in a much better place. (via Rolling Stone, Tech Policy Press, @evacide)

Two-year-old PaperCut flaw under attack: CISA has added a two-year-old vulnerability (CVE-2023-2533) in printer management software PaperCut to its list of known exploited vulnerabilities, after evidence emerged that the bug is being used in active hacking campaigns. The bug allows malicious hackers to remotely run arbitrary code on an affected system. (via SecurityWeek)

More Tea spilled: The Tea app breach gets even worse. After last week's publicly exposed bucket left 72,000+ images of selfies and IDs online, a second breach exposed users' private direct messages. This app has already been considered a "privacy nightmare." Incredibly, the app remains in the top spots on Apple's app store, despite the reporting, which seems odd given how (allegedly) pro-security and privacy Apple claims to be. (via 404 Media ($), Daring Fireball)

ChatGPT convos indexed by search engines: Nothing you share with AI is ever truly private, but it's especially problematic when Google begins indexing some of your ChatGPT queries. That's exactly what happened when users hit "Share" on the AI chatbot, not realizing that this was publicly sharing the user's prompts and making them indexable by search engines. OpenAI apologized. (via Fast Company ($))

Google says it wasn't backdoored: In a stunning display of poorly executed comms, Google reluctantly and begrudgingly admitted this week, on the record, that the company has not been ordered to backdoor its encrypted services at the request of U.K. authorities, like Apple has been. Ron Wyden asked other tech giants if they had been backdoored, but Google refused to answer — even Meta flat out said it hadn't been ordered to make a backdoor. Google eventually acquiesced and confirmed it hadn't been — but maybe had they just told the lawmaker what he wanted to hear first time around, we wouldn't have wasted an entire news cycle on this. (via Washington Post ($), TechCrunch)
~ ~

THE HAPPY CORNER
Alright, that's the news done with. Let's have some fun in the happy corner. Rejoice!

First up, shout out to the excellent @selenalarson for the amazing work chatting with local seniors about cybersecurity. This is great to see because a lot of scams these days are designed to target older folks, but helping them to be aware and know what to look out for can be enormously helpful for keeping them, their friends and family cyber-safe.
Selena Larson post on Bluesky: "Today I spoke with a small group of seniors to do a cybersecurity training. It went really well! They had great questions, shared stories, and wanted to talk much more about how cybercriminals operate. I’ve already been invited back to host another class."
Funnily enough, in somewhat tangentally related tweets:
Anna Baas tweet: "A friend learned COBOL and received a codebase where the last change was done in the 90s... by. his. mum," followed by a tweet reply: "that's not how inheritance is supposed to work in programming."
Ever wondered what happens if you plug in a keyboard to the back of a bus seat? Maybe not actually this, but I still cracked up anyway.

TIL: Cats are not subject to corporate non-disclosure agreements. Also, TIL: you can probably hack into most companies with just a piece of sashimi.
A photo of a cat on the lap of a remote worker at their desk, with the caption "Behind every remote worker is a cat that hasn't signed an NDA and will sell all the secrets for a piece of sashimi"
And lastly, this week... if you're heading to Las Vegas for Black Hat and Def Con, have fun! And — for the love of all that is holy — hydrate! And while we're on the subject of summer camp, here's your mini check-list from security veteran @wendynather, who always has your back.
Wendy Nather post on Mastodon: "- Don’t forget your EFF badge if you had it shipped - Paint those toenails! Especially if you’re going to a pool party - Bring N95 masks and earplugs - Hangover remedies - Write your lawyer’s number on your ankle, NOT your arm"
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet Sage, this week's cyber cat, who... sssshhh... don't wake her, she's probably plotting her next major hack. Thanks so much to Matt B. for sending in!
Sage is a light and dark brown tabby kitty asleep on a blanket, looking extremely cute and fuzzy.
Keep the cyber cats coming in! Got a cyber-cat or a non-feline friend? Send in an email with their photo and name and they will be featured in a future newsletter!
~ ~

SUGGESTION BOX
That's all for this week's bumper edition of ~this week in security~! For all those heading to Vegas, safe travels (and keep your devices safe, too). I'll be back next week with your roundup from the show's best research as told to reporters; (I won't be there this year, but if you have anything to share with me, drop me an email!)

Catch you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — july 27 edition

✇~this week in security~ Archive Feed
this week in security — july 27 edition
Hundreds of SharePoint servers hacked, US woman jailed for running North Korean laptop farm, Allianz Life hacked, UK age checks bypassed, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 30
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Microsoft faces fresh security scrutiny after 400+ SharePoint servers hacked
Wall Street Journal ($): The SharePoint zero-day disclosed last weekend is now fixed after Microsoft rushed out patches to affected customers running the self-hosted SharePoint software. Now all eyes are on Microsoft to see if it can handle its latest scandal. The SharePoint bug saw at least 400 SharePoint servers confirmed hacked so far, including federal government agencies like the Homeland Security, the Dept. of Energy, and others. The number may be higher, as China-backed hackers seek to exploit the bug to gain access to the files and documents inside affected systems. Per Bloomberg ($), Microsoft is reportedly probing if its program for alerting vendors to security bugs may have exposed the unpatched flaw. But since this isn't Microsoft's first major cybersecurity incident (remember the mass-hacks targeting Exchange servers back in 2021?), the technology giant is likely to face even greater scrutiny of its security practices. Given that CitrixBleed 2 (albeit unrelated) was only a couple of weeks ago, buggy enterprise software sure seems to be the root of a lot of security problems these days.
More: KrebsOnSecurity | Bloomberg ($) | Cyberscoop | TechCrunch | @curiousrobot

Clorox sues Cognizant for allegedly giving hackers employee passwords
Reuters ($): Consumer products giant Clorox is suing its helpdesk provider Cognizant for allegedly allowing hackers to walk in its digital front door by simply asking the helpdesk for a password to the network. Clorox had a major cyberattack in 2023 that cost the company at least $49M in expenses after hackers linked to Scattered Spider broke in. The company shut down its network and expelled the hackers, but the recovery took a while. According to the newly filed suit, the Cognizant-run helpdesk granted the hacker access to Clorox's network without any verification checks. Cognizant fired back on all cylinders, accusing Clorox of having an "inept internal cybersecurity system." In any case... this lawsuit is worth reading, not least from a defensive planning point of view.
More: Lawsuit (DocumentCloud) | The Register | @raphae.li

U.S. woman gets 8 years in prison for running laptop farm for North Korea
BBC News: This week saw the sentencing of Christina Chapman to eight years in prison for running a laptop farm for North Korean IT workers. I've mentioned this scheme a fair bit in this newsletter because it's increasingly a big deal — sanctioned North Korean workers get jobs at unwitting U.S. companies and earn a wage for North Korea's nuclear program. They do this using U.S. intermediaries, like Chapman, who run fleets of laptops for the remote workers on the other side of the world. The scheme has brought in billions of dollars for the regime's nuke program, and yet U.S. companies are ignoring the warnings, per the WSJ ($), and hiring the workers anyway. The Treasury's latest round of sanctions targeting the North Korean operation now makes this an even bigger problem that U.S. businesses have to get ahead of, or face stiff financial penalties if caught. Bloomberg ($)'s deep dive with Chapman is worth your time to read, including naming a few affected companies.
More: Justice Dept. | WSJ ($) | Cybersecurity Dive | NPR

Age verification checks have arrived... and kids are bypassing them
Wired ($): The big "age verification" switch got flipped in the U.K. on Friday, thanks to the Online Safety Act taking effect, forcing users across the country to hand over their driver's license or other government-issued document to prove they're old enough to access certain websites. Age checks are meant to protect children, but the way politicians have gone about it mean private companies are now taking on huge amounts of highly sensitive data of ordinary people so they can "prove" they are allowed access to potentially adult stuff on the internet, from Bluesky to Reddit, Discord, Grindr and more. There are huge implications for free speech and expression, including a potential chilling effect, since many folks will balk at the idea of giving over their ID to access a website. Let's just hope the kids haven't found a way t... aaaand of course they've already found a way to bypass the checks. The U.K. isn't the only one rallying behind this, plenty of U.S. states, wider Europe, and Australia are also rolling out age checks.
More: The Verge | Pink News | Alec Muffett
A Discord chat showing a user tricking an age check feature by using a character from "Death Stranding," followed by a Discord message saying: "We determined you're im the adult age group."
~ ~

THE STUFF YOU MIGHT'VE MISSED
Google took a month to shut down a spyware operation hosted on its servers
TechCrunch: Google finally took action against a phone spyware operation called Catwatchful, which was operating from Google's own Firebase service. After Catwatchful became the latest spyware operation in recent years (the 26th, by TechCrunch's count) to have a data breach, I contacted Google to alert them that Catwatchful was hosted on Firebase. The company only took action this week — but wouldn't say why it dragged its feet. (Disclosure alert: I wrote this story!)

Talent agency Toptal had its GitHub hacked to push destructive packages
Socket: Hackers have hijacked the GitHub account belonging to Toptal, which maintains the Picasso design system, to push malicious updates containing code capable of wiping a developer's system. According to security startup Socket, the code exfiltrates the developer's credentials then attempts to delete their machine. The malicious packages accumulated 5,000 downloads before they were detected. Bleeping Computer has more.

A new hack defeats car key fob security protections
Straight Arrow News: A new attack using a $1,000 Russian-developed custom firmware made for the Flipper Zero hacking tool can unlock cars in close proximity by intercepting and cloning a key fob's radio signal. The attack bypasses the key fob's authentication known as rolling codes, which generate one-time codes each time a key fob is pressed, by calculating valid key fob commands using a single intercepted signal. If you open your car trunk, a malicious actor can steal your entire key fob.
Mikael Thalen post on Bluesky: "NEW: A custom firmware for the Flipper Zero, being sold by a Russian hacker for up to $1,000, can bypass modern security protections on key fobs.

 The hack defeats rolling codes & lets you clone every key fob button—lock, unlock, trunk—by capturing just a single command."
Sacramento power company tipped police to high energy usage
EFF: Tropical fish tank or weed farm? Despite a California law protecting the privacy of your smart electricity meter, Sacramento's power company has passed on thousands of tips about "high" household energy usage to the police, ostensibly looking for homes growing weed. The good folks at the EFF are suing to stop this dragnet surveillance practice. More from Ars Technica.

158-year-old company goes under after ransomware attack
BBC News: The BBC's Panorama program covered the gutting story of a U.K. transportation company that went out of business following a 2023 ransomware attack. The hackers broke into the company's network by guessing an employee's password. The framing of the BBC's story, however, which blamed the password (and to a degree, the employee) for the breach, seemed to miss a key point that years of the company's management underinvesting in cybersecurity and poor corporate security practices was ultimately what allowed the hackers to do so much damage the company's network, not the employee.
JP post on Mastodon: ""One password is believed to have been all it took for a ransomware gang to destroy a 158-year-old company and put 700 people out of work." Well there was also the lack of working backups that were not vulnerable to the primary site infraction, the lack of partitioning and segmentation, no MFA on admin level credentials, etc. No really big system failure happens because of one small thing. It's lots of things, in a cascading failure. Usually many of them were known about but no one did anything about them until it was too late."
U.K. to back down on Apple backdoor after U.S. pressure
Financial Times ($): The London's FT (via Ars Technica) reports that the U.K. is seeking to wiggle out of a problem of its own making — undoing its call for a backdoor to access any customer's data in Apple's cloud. The demand (and the precedent it would set) royally annoyed the U.S., and Washington pretty much told the U.K. to back down. Daring Fireball had a good take: Love or hate the U.S. government right now, this was the right call to make — for security, privacy, and common sense.

Sam Altman warns of AI voice fraud crisis in banking
Associated Press: OpenAI boss Sam Altman warned this week that AI-generated or "deepfaked" audio can be abused to trick security checks that rely on authenticating using a person's voice, such as when you call your bank. The good news is that @spencerdailey has been warning about this very issue as far back as 2021, even if Altman is oblivious to the very problems he's ultimately helping to create. Switch off voice identification when you can.
A meme of a guy in a hot dog suit, with the caption: "We're all trying to find the guy who did this" with Sam Altman's face superimposed.
~ ~

OTHER NEWSY NUGGETS
EU healthcare operator AMEOS breached: AMEOS, which operates a large health network across Europe, was hacked. The company told the DPA news agency that the company's German operations were affected, and said in a statement that "data belonging to patients, employees, and partners" was likely taken in the breach. (via AMEOS, DataBreaches.net)

U.K. mulls ransomware ban: The U.K. government said that following an earlier public consultation it will move to ban public sector bodies and critical infrastructure operators, like the NHS, local councils and schools, from making ransomware payments. Businesses not covered would still be required to notify the U.K. government if they plan to pay a hacker's ransom. The U.K. didn't give a timeline for the legislative proposal, but said the data will help the authorities "hunt down perpetrators and disrupt their activities." (via U.K. Government)

'Majority' of Allianz Life customers' data stolen: U.S. insurance giant Allianz Life confirmed Saturday that the "majority" of its 1.4 million customers had personal information stolen in a mid-July data breach. (Disclosure: I also wrote this!) The company said its CRM database was compromised. It's not known which CRM database Allianz Life is referring to, but recent social engineering hacks targeting Salesforce organizations are notably on the rise. (via TechCrunch)

Spyware founder wants FTC ban reversed: The FTC banned Scott Zuckerman from the surveillance industry in 2021 after his spyware company Support King (aka SpyFone) had a security lapse that exposed the private phone data of thousands of people it was snooping on. Now, Zuckerman wants the FTC to reverse that ban, but he pinky promises he'll stay out of the surveillance industry if the order is vacated or modified. If you want to say your piece about the proposal, the FTC's comments are open until mid-August. (via TechCrunch — double disclosure!)

XSS.is admin arrested: The alleged administrator of the notorious XSS.is cybercrime forum was arrested in Ukraine and its website seized. Per Europol, the site had more than 50,000 users and that data will now help the authorities in their ongoing investigations. French prosecutors said (en français) they wiretapped a Jabber server to identify the admin. (via Europol)
the seizure notice on XSS.is, which reads: "This domain has been seized by la Brigade de Lutte Contre la Cybercriminalité with assistance of the SBU Cyber Department."
Travel plans left online: Simple security bugs in the website of U.K.-based luggage service Airportr, a premium travel service used by 10 different airlines, exposed the personal information of virtually every customer, including flight itineraries, and could have allowed malicious hackers to redirect or steal luggage in transit. (via Wired ($))

Spill the Tea... no, not like that! A new app called Tea, a dating safety app with 1.6 million users that rocketed to the top of the iOS App Store chart in recent days, spilled the private government-issued IDs of its users through shoddy coding and an exposed backend Firebase database. Some 72,000 images (and thousands of selfies) spilled online. The company confirmed the breach soon after. The claim that Tea was required to store raw ID documents doesn't really pass the sniff test. (via 404 Media, @malwaretech)

CISA nomination stumbles on election fact check: Trump's pick to lead the U.S. cybersecurity agency CISA, Sean Plankey, faced a grilling by lawmakers this week, but wouldn't be drawn on whether the 2020 election was rigged or stolen, which... is kind of a big deal for CISA, given that the agency is still tasked with election cybersecurity. Plankey isn't likely to be CISA director any time soon, as Sen. Ron Wyden still has a hold on Plankey's nomination over CISA's response to the Salt Typhoon hack targeting telcos and more. (via Cyberscoop, Cybersecurity Dive)
~ ~
THANK YOU FOR YOUR SUPPORT!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
And breeeeeeathe. That's the news done with. It's time for the happy corner.

Thanks to this absolute mood of late. (If you're reading this and don't know what a phone connecting to the internet sounds like, I gotchu.) 
Karen K. Ho post on Bluesky: "We should have listened when the modems screamed at us."
And, we're blessed to have another episode of, What Can Doom Run On? This time, its a decade-old bicycle navigator. Thanks to Raymii.org, this little bike-sized device might not have the bells and whistles of today's sat-navs, but is still very capable of running the first-person shooter.
A photo showing a bicyle navigator device that's running Doom.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat mini-void floof is PJ, who can be seen here all tuckered out after a very busy day of lock picking practice. Gotta get 'em started hacking young! (Side note: I have melted, PJ is so damn fluffy and cute.) Thanks so much to Rusty S. for sending in; the absolute highlight of my week.
PJ is a jet black "void" floof kitten lying on a desk asleep, surrounded by a keyboard, a laptop and lock-picking tools. I cannot stress how cute this kitten is. Squeeee.
Keep the cyber cats coming in! Got a cyber-cat or a non-feline friend? Send in an email with their photo and name and they will be featured in a future newsletter!
~ ~

SUGGESTION BOX
Aaaannndd I'm outta here! I've kept you for long enough with this extremely busy edition, thanks for reading! Enjoy the rest of your weekend! If you have anything you want to share for next week, get in touch.

Peace,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — july 20 edition

✇~this week in security~ Archive Feed
this week in security — july 20 edition
UK reveals 2022 Afghan data breach, Trump's $1b offensive cyber budget, American trains have hackable brakes, SharePoint zero-day, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 29
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

U.K. reveals 2022 data breach exposed thousands of Afghans fleeing Taliban
The Guardian: We start this week in the U.K., where the government is mopping up probably one of the most serious data breaches in recent history. The 2022 breach, caused by a U.K. military official mistakenly emailing a spreadsheet of nearly 19,000 people — mostly Afghans trying to flee the Taliban but also some British spies and special forces personnel — which made it into the public domain more than a year later. Thousands of people on the list were relocated, costing more than £2 billion ($2.6bn). The government at the time gagged the press (and government ministers!) using a superinjunction, which barred anyone from disclosing the breach or even the gag order itself, fearing the disclosure would put those whose names are on the list at risk of persecution. By the U.K.'s own admission, it's not known how many people may have been killed as a result of the leak. This is a huge mess with real world consequences. I genuinely gasped while reading about the scale of this breach.
More: Gov.UK | BBC News | DataBreaches.net | Reuters ($) | Bloomberg ($)

Trump to spend $1 billion on offensive cyber operations while gutting cyber defense
TechCrunch: Moving onto the United States... Last week's newsletter noted that Trump's One Big Beautiful Bill Act, which passed into law earlier in July, cut more than $1.2 billion from the U.S. defensive cyber budget. Buried in the budget, however, was also a provision to add $1 billion for offensive cyber operations in the Asia-Pacific region, effectively allowing the U.S. to target China. It's not clear exactly what offensive operations would entail. Sen. Ron Wyden said in response that cutting a billion from CISA and defensive cyber programs while spending a billion on hacking operations would "invite retaliation." And worse, we might not even have the defensive capability to withstand such retaliation.
More: Forbes ($) | Fast Company | @lorenzofb

Microsoft to stop using Chinese engineers to work on U.S. military projects
ProPublica: ProPublica published a deep dive this week exposing a weakness in the way that Microsoft uses Chinese engineers to work on sensitive U.S. military cloud projects. These projects allow the Chinese engineers to work and code under the supervision of "digital escorts," who have security clearances but often lack the technical skills to know what the engineers are actually doing. One of the escorts told ProPublica that they rely on the goodwill of the engineers that what they code isn't malicious. The system, which has been in place for more than a decade, is only coming to light now — but already got the kibosh from the Pentagon. Secretary of Defense Pete Hegseth said in a video on Friday that China will "no longer have any involvement whatsoever in our cloud services."
More: Reuters ($) | ProPublica | @DAlperovitch
~ ~

THE STUFF YOU MIGHT'VE MISSED
Hackers can remotely trigger brakes on American trains
404 Media ($): American trains are fitted with radio-controlled brakes that can be triggered from the driver's cabin (helpful, since trains can be very long!), but these radio signals can also be triggered by anyone using a software-defined radio within proximity of an affected train, "new" research has found. Who knew and how new? Well... actually, the industry has known about the vulnerability for years, but by CISA acknowledging the bug this week, this might actually light a fire under the train operators who rely on these buggy breaks. Really great thread from @midwestneil, who reported the bug.
Neil Smith tweet: "So how bad is this? You could remotely take control over a Train's brake controller from a very long distance away, using hardware that costs sub $500. You could induce brake failure leading to derailments or you could shutdown the entire national railway system."
Hackers are planting custom backdoors on end-of-life SonicWall devices
Google Cloud: Google has sounded the alarm after discovering a new hacking group compromising SonicWall Secure Mobile Access appliances, which big companies use to allow employees access to the network using their mobile devices. Little's known about the hackers or their motives, but clearly enough activity for Google's researchers to go public. The affected servers are end-of-life, so won't get patches, but are still widely used in enterprises. More from Ars Technica.

U.K. age verification checks to come into force July 25
BBC News: Age verification checks will be enforced starting July 25. The BBC has a pretty bleak picture into how these online age checks will work, who will get the data, and what some of the privacy issues are. The obvious concern is that this will end up with people's data getting leaked or stolen (let's hope it's the politicians who are compromised first!). Collecting data isn't the answer here. One expert (rightfully) told the Beeb: "The only non-hackable database is no database at all." Preach.

Hackers exploiting blind spots by hiding malware inside DNS records
Ars Technica: TXT records are public DNS/internet records typically used to prove domain ownership when setting up an online service, but TXT records can realistically include anything from ASCII art to malware. New research from DomainTools found hackers were able to host a malicious binary within DNS records by breaking up the payload into chunks, encoding the files into hexadecimal, then hosting the broken up file as TXT records on an attacker-controlled domain. This could be a way to sneak malware onto a company's systems via network traffic that can be difficult to monitor. Interestingly, the use of TXT records have also been seen containing prompt injections used to mess with drive-by AI agents.

Misbehaving AI Corner, featuring Gemini, Grok-4, Claude, Meta flubs
SecurityWeek, TechCrunch: Speaking of misbehaving AI agents... Here is... *drumroll please* Misbehaving AI Corner™. (I can't think of a better name.) In case you thought AI was in any way ready for use (it's not), this week we saw: Google's Gemini being tricked into showing a phishing message hidden inside an email; X's Grok-4 jailbroken to produce a recipe for molotov cocktails; Anthropic's Claude hacking itself; and, Meta confirming it fixed a security bug that allowed anyone to access anyone else's chat prompts and AI-generated content (disclosure: I wrote this story!). And that's not all: MIT Technology Review ($) reports a major open-source training set contains "millions of images of passports, credit cards, birth certificates," and more — so, yeah, all in all, not a great look (or week) for AI. Maybe it's time we stop feeding AI our most personal data? (I wrote this one, too!)

How China's "honkers" became the nation's top cyberspies
Wired ($): @kimzetter dives into some hacker history with a new story on Honkers, a.k.a teens and young Chinese hackers from the late 90's that launched "patriotic cyberattacks" against Western targets deemed disrespectful to China. These are the hackers who have, over time, essentially become some of China's most prolific cyberspies. Here's the original research [PDF].

Microsoft can't protect French data from U.S. government access
Ben Werdmuller: Sounds so simple and perhaps obvious, but this is very important to note. If you interact with a company from another country, those laws can (and usually do!) still apply. The same works when U.S. companies, like Microsoft, provide services to Europe. If the U.S. demands access to that European customer's data, it can pressure the U.S. company into granting that data, as dug into by @ben (via PPC Land). Trust alone isn't a data protection strategy. (Damn, I wrote about this very issue back in 2011 — woooof, I got old!)
~ ~

OTHER NEWSY NUGGETS
SharePoint Server zero-day under attack: Well this is rare, uhh, weekend breaking news but, Google says a zero-day in self-hosted/on-premise Microsoft SharePoint is under active attack. News of the critical bug came out Saturday. Microsoft said it's "aware that an exploit" for the bug exists. If you haven't already, check out Microsoft's post, patch, and then run some logs to see if you've been exploited. (via @cR0w, MSRC)

Rough week for Russia: Russia was hit with a trifecta of cyberattacks this week. A major drone supplier was hacked and data destroyed (Ukraine took credit for this). A top Russian gas supplier was also hacked, as was a major vodka producer. You know it's serious when the Russian vodka supply gets hit. (via Kyiv Independent, The Record)

U.S. Army soldier pleads guilty... again: Former U.S. Army soldier Cameron Wagenius has pleaded guilty for a second time; now, he'll face jail for charges stemming from hacking and extortion related to hacking phone companies. Wagenius pleaded guilty earlier this year to hacking and stealing customer data from telcos AT&T and Verizon. (via Justice Department, TechCrunch)
Allison Nixon post on Bluesky: "Unit 221B thanked by DOJ in 1st guilty plea of the Snowflake hacker gang. Last year they threatened me for no reason, so we broke their opsec. The Army member, "Cameron Wagenius", leaked Trump call logs from AT&T and faces 27 years. He was easy to find."
Co-op confirms millions hit by breach: The U.K. retail giant Co-op has revealed "all" of its 6.5 million members had personal information stolen in its recent cyberattack. The stolen data includes names, addresses and contact information. Still no word yet on the number of people affected by other breaches in the same Scattered Spider hacking campaign, notably Marks & Spencer's. (via BBC News)

China targeting Singapore's infrastructure: Singapore is responding to cyberattacks targeting its critical infrastructure and other essential services, per the national security minister, who blamed the hacks on UNC3886, which Google's Mandiant says is a China-nexus spying group. Reuters ($) separately reported that China-aligned hackers are targeting Taiwan's chip industry and investment analysts, at a time when China is ramping up hacks on its regional neighbors. (via Reuters ($))

New SS7 exploit under attack: Security researchers at Enea have caught a surveillance company in the Middle East exploiting a new attack capable of tricking phone operators into disclosing a cell subscriber's location. I wrote about the findings in for TechCrunch (disclosure alert!). The bug involves exploiting a bypass attack in SS7, the protocols used by global phone networks to route calls and texts around the world. SS7 has long had security problems, and surveillance companies know this. (via TechCrunch)

Five Four-and-a-Half Eyes: Mark Warner, the top Democrat on the Senate Intelligence Committee (read: knows a lot of highly classified stuff) escalated his criticism of the U.S. top spy Tulsi Gabbard, saying Gabbard politicizing the role makes her unfit for the job. As such, Warner said he believes that the Five Eyes intelligence partners — Australia, Canada, New Zealand and the U.K. — are dialing back how much intelligence they are sharing with the United States. (via Politico)
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Welcome back to the glorious, wonderful, and peaceful happy corner.

A spin-off from a classic xkcd, I loved this @bolson.org post this week. This is incredibly spot-on.
A modified xkcd cartoon, "All modern digital infrastruture," containing a stack of precariously balanced objects held up by a single LGBTQIA+ flag.
Ever wonder what happens when you reach the error message... for the error message? Well, someone on Hacker News found Gmail's.
A screenshot of an error message trying to load Gmail, it reads: "Dear valued user, You have reached the error page for the error page... You win!!"
And, since it's a short one this week, here's a double-bonus cybercat.
Ken White post on Bluesky, featuring two half-asleep cats, one black on the left and a ginger tabby on the right.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Double... double cybercats this week: here are Pien (left) and Muis (right), a very cute brother-sister pair of cybercats, who can be seen here once again interfering with their human's security work by demanding urgent pets and snuggles! Thanks so much to Rick R. for sending in!
Two lovely cybercats, Pien (left, a black and white cat), and Muis (right), who is black, white and ginger, who are stood on their human's desk trying to get their attention.
Ding-dong: it's the cybercat gong! Got a cyber-cat or a non-feline friend? Send in an email with their photo and name and they will be featured in a future newsletter!
~ ~

SUGGESTION BOX
Well that's all there is for this week's news! Join me again next weekend for your usual roundup of everything you need to know in cyber. As always, if you want to get in touch about the newsletter, please do!

For now, have a great and enjoyable rest of your weekend. I really appreciate you for reading!

Ta ta,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — july 13 edition

✇~this week in security~ Archive Feed
this week in security — july 13 edition
CitixBleed 2 under attack, 'Hafnium' hacker arrested, Jack Dorsey's not-so-'secure' messaging app, Gemini accessing other Android apps, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 28
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Everyone but Citrix agrees that 'Citrix Bleed 2' is under attack
The Register: For the past week, security researchers have been sounding the alarm over cyberattacks linked to "Citrix Bleed 2," (aka CVE-2025-5777) a bug that can be used to extract sensitive credentials from an affected Citrix NetScaler device and used to break into a company's wider network. The bug takes its name from CitrixBleed due to its similarity to the 2023 flaw in the same product. With exploits now public and evidence of hacks dating back to mid-June, CISA has added its name to the chorus of folks warning about its exploitability. Citrix, meanwhile... *crickets*... seems to be the only one left not to acknowledge the active hacking campaigns abusing the bug, instead just telling customers to patch as soon as possible. That's a pretty lousy response all in all. Maybe it has something to do with the fact its CEO was moonlighting at DOGE for the past few months? Nah, it's Citrix, we've been here many times before already! If you haven't patched already, patch — and hunt for activity — today.
More: CISA | Citrix | DoublePulsar ($) | ReliaQuest | TechCrunch | CSO Online

U.S. feds announce arrest of 'Hafnium' Exchange email hacker
Justice Department: The still-somewhat-functioning U.S. DOJ announced the arrest(!) of a Chinese national who prosecutors say is a key figure within "Hafnium," a hacking group that works on behalf of the Chinese government. The hacker, Xu Zewei, who was arrested in Italy, is accused of working for a company Shanghai Powerock Network that conducted cyberattacks and breaches for China's interests, including stealing COVID research from U.S. universities during the height of the pandemic. The "Hafnium" hacking campaign saw the alleged hacker and another named Chinese national mass-hack thousands of self-hosted Exchange email servers across the world, stealing mailboxes and contacts. It's believed "Hafnium" effectively morphed into Silk Typhoon, another campaign aimed at breaching large companies and government departments (remember the Treasury hack?) to steal information. Suffice to say, when the arrested Chinese hacker arrives in a U.S. court, we may get more information about how the long-running hacks went down.
More: Microsoft | Bleeping Computer

Four arrested over recent U.K. retail hacking spree
BBC News: The feds (or in the U.K., plods) had a busy week rounding up four alleged members of the Scattered Spider hacking collective — a woman aged 20, two men aged 19, and a minor aged 17, per the U.K. National Crime Agency. The suspects can't yet be named due to the quirks of British law... nevertheless, some of the identified hackers are accused of, well, hacking (obviously), but also blackmail, money laundering and participating in the activities of an organized crime group. The plods directly attributed the arrests to the breaches at Marks & Spencer and the Co-op, and the cyberattack targeting Harrods. With any luck, we'll also figure out more about the hackers, their techniques, and operations. As an amorphous and loose-knit threat, Scattered Spider remains a major, major problem for network defenders.
More: National Crime Agency | DataBreachToday | Wired ($) | KrebsOnSecurity

Chinese hackers suspected in breach of powerful D.C. law firm
CNN: Suspected Chinese hackers broke into the email accounts of Wiley Rein, one of the biggest law firms in Washington, D.C. The firm told its clients that the stolen information relates to "trade, Taiwan and U.S. government agencies involved in setting tariffs and reviewing foreign investment," so... pretty sensitive stuff as of late. It's the latest major law firm to have been hacked in recent years; it actually happens a fair bit, like Orrick, Fragomen, and others. Not only are law firms a target, some firms are said to have actively hired hackers to dig up damaging information on litigants to win their cases. Just this week, a pair of lawsuits were resolved (with no admission of liability) following claims by an airline executive that his emails were targeted, hacked, and leaked.
More: @snlyngaas | @AnnieGrayerCNN | Archive: Readme (2023)
Eva Galperin post on Bluesky: "I cannot overemphasize to you how often law firms are targeted by hackers, sometimes employed by opposing parties in cases they are working on, and how profoundly unprepared most law firms are to defend themselves."
Jack Dorsey's 'secure' Bitchat app wasn't security tested before launch
TechCrunch: Twitter co-founder Jack Dorsey vibe coded his way through last weekend to develop the terribly named decentralized messaging app Bitchat. Dorsey said the messaging app relies on nearby Bluetooth signals rather than the internet, making it helpful where the internet is monitored or offline. He also billed the app as "secure." Just one major problem — it isn't secure, not least because of a serious bug that undermined the app's encryption (which Dorsey closed without learning more), but that Dorsey didn't even bother getting the app security tested before launching, by his own admission. To be clear, words matter. Claiming something is secure when it's not is the sort of dumbassery (or Jack-assery, amiright?) that could get someone in a high-risk situation put in harm's way, or worse. Not a good look for one of the world's richest people. Riches can't buy you common sense, clearly.
More: TechCrunch | Supernetworks | GitHub | @jack
A screenshot of a GitHub issue asking "what is a good way to report security flaws for this project" — and it showing Jack Dorsey closed the ticket pretty much immediately without asking for more details. I've included my own series of red question marks over the image to show how silly this was to do.
~ ~

THE STUFF YOU MIGHT'VE MISSED
Android is allowing Gemini to access third-party apps
Ars Technica: A whole new surveillance hellscape just opened up: Google, beginning this past Monday (with barely any heads up), began rolling out an update that allows its Gemini AI to access the data from other apps on a user's Android device. Yes, that also includes end-to-end encrypted apps like WhatsApp, and more. (What could go wrong, except a million things?) Actively removing the Gemini app is a pain but might be worth it, and Ars has the details. Meanwhile: Meredith Whittaker (by far the smartest Whittaker I can think of) warned against this exact kind of threat, by way of AI compromising the app-layer protections that messaging apps put in place to prevent other apps from reading their private messages.

Trump seeks unprecedented $1.2 billion cut to federal cyber budget
CSO Online: Trump's tax bill, which became law on July 4 will overall cut the federal cyber budget by more than a billion dollars, a 10% drop in cyber expenditures in 2026, when the tax bill takes effect. Experts say it's a hard sell to be spending less on cybersecurity these days. Cue this incredibly telling line, per the Cyber Threat Alliance CEO: "If I were a nation-state adversary, I would be joyous at what's going on inside the US government. Decreased funding is only going to fuel that." Welppp.

Litigious company demanding tweet removal learns of Streisand effect
Techdirt: The very excellent @joebeone is a fountain of knowledge and awesomeness, so when he posts or tweets, people read. But Hall found himself in receipt of a legal threat from a company called Cloud Innovation, simply for posting a tweet of a link — yes, just a link — to this story about Cloud Innovation's litigious conduct in Africa regarding the region's internet registry. Hall fired back a letter from his own lawyer (worth reading, it's scathing!) and got a fantastic write-up in Techdirt about the saga. It'd be a real shame if you read the story that Cloud Innovation clearly doesn't want you to know about!

'123456' password risked exposing McDonald's job applicants' data
Ian Carroll, Sam Curry: Carroll and Curry, a hacking duo behind some roaring findings in recent years, found that a McDonald's hiring site called McHire, which was using an AI chatbot that filters out prospective employees, was protected with a password of "123456," allowing access to the internal API. Thanks to a separate IDOR bug, the hackers could access the private data on potentially millions of applicants. The bugs were reported, fixed, and disclosed. As you'd expect, Wired ($) has a great write-up.

State Dept. investigating Marco Rubio impersonator
Reuters ($): The State Department is investigating a Marco Rubio impersonator, who allegedly used an AI voice to contact three foreign ministers and two U.S. officials over Signal and text messages pretending to be the U.S. top diplomat. This probably wouldn't be much of an issue if Rubio et al didn't occasionally use non-official channels (like that Signal group chat) to communicate with their counterparts. At least if he stuck to classified only channels, he probably wouldn't have someone running around on Signal pretending to be him. (In news you can use, here's some solid advice from @RachelTobac on how to detect AI voice clones.)

Spain awards Huawei contracts to manage spy agency wiretaps
The Record: This story is submitted (almost) without comment... Huawei, the Chinese tech giant that was banned from use in the U.S. over national security fears that it could (or will) provide sensitive network data and internet traffic back to the Chinese government, will now manage and store judicially authorized wiretaps for Spain's intelligence agencies. Yeah, not sure that's the smartest idea... This is pretty much what Spain's intelligence allies look like right now:
A photo of a meme of Matthew McConaughey in character, with an alarmed/panicked look on his face, taking a heavy drag from a lit cigarette.
~ ~

OTHER NEWSY NUGGETS
DOGE accesses huge database on farmers: NPR has a new long read on DOGE's latest data dive, and this time they're coming for U.S. farmers. With access to a database that contains vast amounts of financial data on farmers and personal information on their workers — including immigration status — DOGE now has control over tens of billions of dollars in government payments and loans to America's food growers. If farmers can't guarantee receiving loans or payments, this could "disrupt entire growing seasons." Just absolutely stellar reporting here from one of NPR's best journalists. (via NPR, @jennamclaughlin)

Ingram hobbles back online: Following its ransomware attack, Ingram Micro is back online as of July 9 after restoring its operations globally. It's not clear yet if any customer data was stolen in the hack, or who it relates to. Given that Ingram Micro provides and ships tech to many of the world's biggest companies (and their remote employees!) it could be sizable, so one to keep an eye out for. (via SecurityWeek)

CoD offlined after players hacked: A source with knowledge of the situation said game publisher Activision took down its Call of Duty: WWII game from the Microsoft Store after players reported targeted hacks during their gameplay. Turns out Activision patched the bug once already, but forgot to port the fix over when it launched the game for PCs. In one video posted to X, one player's gameplay froze and a couple of command prompt windows appeared, with text saying that someone had just "RCE'd [their] ass." (via TechCrunch)
A screenshot of a gamer playing Call of Duty: WWII and mid-way through the game two command line windows appear, one of which says "just RCE'd your ass."
Stingrays caught snooping on ICE protests: Wild reporting here: @MikaelThalen found evidence that an IMSI-catching surveillance device (think "stingray") was being used during a July 4 protest at an ICE immigration detention facility. This shows law enforcement's appetite to use cell site simulators and other surveillance tech at protests. Stingrays are generally only allowed to be used in exigent or emergency cases, circumstances that are often subjective (and favorable) to the cops using the damn things. (via SAN)

10/10 bug warning in Wing FTP: A very easy-to-exploit bug found in Wing FTP Server, used by thousands of big companies around the world, allows anyone to break into an affected server. The bug is rated 10/10 in severity because of its simplicity. Huntress said it's seen one customer exploited so far; let's hope it stays that way. (via RCE Security, Huntress, The Register)
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
The sun is shining, the birds are chirping, and the water is warm. This is as happy as the happy corner gets.

Congratulations to the good people at the Electronic Frontier Foundation on their 35th anniversary! Thanks to everyone there for all you do to support the cyber community. Throw 'em a tax-deductable(!) donation if you can spare a few.

If you need a good laugh today, and let's be honest — we all do (/me gestures wildly in every direction), one Redditor recently found that it's still possible to jailbreak ChatGPT into spitting out things that it shouldn't. This time, the chatbot can be tricked into providing Windows 7 product activation keys, thanks to the "grandma exploit." This is a trick where you convince the chatbot into thinking outside of its guardrails and pretending to be a fictional grandma who recently passed away. This trick isn't new, but has been used to trick chatbots into spitting out instructions for things like napalm. 

It's that time again... Let's buckle up for another round of Patch Tuesday and...
...Microsoft reported no actively-exploited zero-days! That's rare in itself. (Mind you, there are still patches to install!) Google also had a good week — confirming there are no Android security patches in the July 2025 security bulletin. @campuscodi notes that this is the first month without one in six years.

The Onion wins this week's best headline. (Even for parody, this is pretty spot on.)
A headline from The Onion: "Study: 97% Of Average American’s Day Spent Retrieving 6-Digit Codes"
And finally: From the National Park Service:
National Park Service tweet: "“We hope this email finds you well.” Then: The email finding us," followed by an owl squinting, as if to give shade.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet this week's cyber cat kitten, Gidget, who can be seen here glaring at her human to demand more cuddles. That's social engineering at its finest! Thanks so much to Tristan for sending in.
Gidget is a grey and brown/orange tinged tabby kitten with a blue collar, very cute!
Keep sending in your cyber-cats! Got a cyber-cat or a non-feline friend? Send me an email with their photo and name and they will be featured in a future newsletter. 
~ ~

SUGGESTION BOX
That's it for this week's busy edition of this newsletter, thanks so much for reading! I hope you have a great week ahead of you. I'll be back on Sunday with your roundup.

Want to get in touch with something for next week's edition, like good news or a cyber cat? I'd love to hear from you — I'm just an email away!

Offlining for now,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — july 6 edition

✇~this week in security~ Archive Feed
this week in security — july 6 edition
US busts North Korean IT workers operation, Ingram Micro hit by ransomware, Catwatchful spyware exposed, Qantas breach, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

🎉 volume 8, issue 27 🎉
View this email in your browser | past issues | RSS

~ ~
I'm starting with a little personal note from me. This newsletter edition marks the seventh(!) anniversary since launching ~this week in security~. I'm thankful, honored and grateful for your trust, readership, and support. Writing this weekly dispatch to thousands of people every Sunday is the highlight of my week, as much as I hope it's one of yours.

More from me in a few, but first, I guess we should do… the news!
~ ~

THIS WEEK, TL;DR

U.S. DOJ announces charges, actions against North Korean IT worker operation
Justice Department: Some great news to start the week! Phhhrrbbbt! 🥳 The U.S. announced it successfully outed and knocked back North Korea's remote IT workers' operations. This long-con scheme has been described as a "triple threat" because these North Koreans infiltrate tech companies to earn a wage, stealthily steal their intellectual property, and then use the data to extort the companies for money. North Korea uses its regular payday to fund its sanctioned nuke program to the tune of billions of dollars. (Yeah, they're not messing around!) The DOJ announced multiple charges to name-and-shame the operators (who are still in North Korea), as well as taking down over two-dozen "laptop farms" across 16 states that were used by the North Korean spies to remotely "log in" to the U.S. as if they were located here. These North Korean scammers are deeply embedded in the crypto world as well as the Fortune 500 — and yet this scheme allows them to make bank, per the WSJ ($), which profiled one affected firm. Microsoft has a good dossier on the threat, but remember that this recent catch of spies is still only a drop in the ocean.
More: Associated Press | Wired ($) | TechCrunch | The Record | ABC News
A screenshot from the DOJ indictment, which reads: "According to the same May 2022 advisory, North Korean IT workers often work on multi-member teams. One such team identified during this investigation is pictured below:" followed by a photo of several North Koreans working from an office, albeit with their faces redacted.
U.S. probing whether ransomware negotiator took slice of hacker payments
Bloomberg ($): Sticking with the feds for a hot second, in separate news, the DOJ is reportedly investigating a former ransomware negotiator who allegedly took a cut of the ransom payments paid to hackers. The former negotiator isn't named, but worked for DigitalMint, which the company confirmed in a statement. Negotiators "help" (air quotes) to settle ransomware attacks by facilitating ransom payments to hackers who lock a victim's systems with file-encrypting malware. This isn't illegal, but the FBI and others have long advised against paying ransoms because (for many reasons...) this doesn't guarantee the data's safe return or that the victim won't get re-victimized with another ransom demand. Watch this space: It seems like this entire cottage industry (which ProPublica profiled in 2019) is on shaky ground. The DOJ hasn't commented yet, nor released the allegations.
More: Bleeping Computer | CoinTelegraph

Ingram Micro outage caused by ransomware attack, company confirms
Bleeping Computer: Prepare for a rough week if you've got any dealings with Ingram Micro... Bleeping Computer reports the U.S. tech distributor and managed service provider (read: outsourced IT) was hit by a SafePay ransomware attack, citing sources and employees who saw ransom notes visible on internal computers. The company said in a statement on Saturday that it "identified ransomware" on internal systems. The outage began Thursday, just ahead of the July 4 holiday (which probably isn't a coincidence — incidents happen around holidays and downtime). By Friday, Ingram Micro hadn't disclosed anything untoward beyond a "technical difficulties" notice (heavy wink) on its website, until Saturday when it was forced to 'fess up after Bleeping's reporting. Clearly, everything is not fine and we'll likely hear more about the incident and its downstream effect this week.
More: Ingram Micro (statement) | Reuters ($) | The Register | Reddit /r/msp
~ ~

THE STUFF YOU MIGHT'VE MISSED
Xfinity Wi-Fi 'motion tracking' feature allows data sharing with cops
Xfinity: Comcast has a new "feature" in early preview called Wi-Fi Motion, which uses Wi-Fi signals to detect motion in a person's home if they're away. Sounds cool in theory, but Comcast makes it clear that it may "disclose information generated by your Wi-Fi Motion to third-parties without further notice," which can include telling law enforcement whether you're home or not.

AT&T rolls out new account lock security feature
The Verge: In news you can use: AT&T has a new security account lock feature that allows customers to prevent unauthorized modifications to their phone account, with the aim of preventing SIM swap attacks and phone number changes. It's a good (overdue) step that tacitly confirms phone companies are still battling SIM swappers and other social engineering attacks. Verizon, T-Mobile and others have a similar feature, too.

Catwatchful spyware bug exposes thousands of hacked phones — and its admin
TechCrunch: Security researcher Eric Daigle found an SQL injection bug in an unauthenticated API of a stealthy phone monitoring app called Catwatchful. The bug exposed thousands of users who signed up to spy on someone's phone (gross, illegal... and did I mention... gross?!). Daigle shared the extracted text-only database of customers and victims with me, which contained real-world and identifiable information on none other than Catwatchful's "anonymous" administrator, which I reported for TechCrunch. (Disclosure alert!) Sweet karma aside, the Catwatchful spyware also has a backdoor code, so the hidden app is easy to identify, which I explain in my piece. With no prospect of the administrator disclosing the breach, the data was shared with breach notification site Have I Been Pwned.
Have I Been Pwned tweet: "New sensitive breach: Last month, spyware app Catwatchful had 62k records breached via a SQL injection vulnerability that exposed email addresses and plain text passwords. 30% were already in @haveibeenpwned"
Criminals are smarter and faster: CISOs must rethink defense playbooks
CSO Online: Cynthia "Metacurity.com" Brumfield has solid analysis and advice out this week on how and why CISOs should rethink their defensive planning and strategies, especially in the face of today's financially motivated attacks, which are faster and more ruthless than ever and lead to ransomware and extortion attacks (think Scattered Spider!) Now, the real trick is getting the C-suite executives to actually care before it's too late.

Iran's internet blackout exposed political disinformation operation
Joe Tidy: An Iranian government-ordered internet outage caused one of the country's major long-running disinformation operations to go silent, inadvertently exposing it, per the BBC's cyber reporter. The network of some 1,300 fake social media accounts used for meddling in politics disappeared for 16 days, a period that "directly aligned with Iran's nationwide blackout," which began after the brief military conflict between Iran, Israel and the U.S. a few weeks ago. Guess what happened when the power went back on? Bingo.
Joe Tidy post on Bluesky: "Did Iran's internet shutdown inadvertently unmask a prolific and long-standing disinfo op? Intriguing research from Cyabra: A network of 1,300 fake social media accounts that have stirred political events around the world since the 2014 Scottish independence vote went dark during Iran’s blackout."
'El Chapo' cartel used phone data and CCTV cameras to find FBI informants
DOJ OIG: Absolutely wild disclosure from the DOJ's watchdog, which conducted an audit of the FBI's counter-surveillance and opsec practices for protecting sensitive investigations. Turns out that in 2018, a hacker hired by the Mexican drug cartel run by notorious kingpin "El Chapo" was somehow "able to use" (it wasn't specified how) an FBI attache's phone to grab calls and location data to identify and "kill potential sources [or] witnesses." Spyware would make sense, but practically speaking, given how many bugs are in the SS7 protocol that connects much of the world's telcos together akin to string and sticky tape, that'd be my top guess.

Android 16 can warn users connecting to fake cell towers
Android Authority: Speaking of dodgy cell shenanigans: Android 16 is getting a new feature that can alert users when their device connects to a potentially fake cell tower. These are sometimes called "stingrays," a secretive cell site simulator device that cops use to mimic cell towers, which can be used to identify the locations of nearby phones. These are often used in criminal investigations, but also sometimes deployed at big events, per Wired ($).
~ ~
THANK YOU FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A selection of ~this week in security~ swag, including a "Cybercat" themed mugs (in both black and white) and a bunch of custom cybersecurity-themed stickers on a grassy background
~ ~

OTHER NEWSY NUGGETS
Qantas cyber "incident": Aussie airline giant Qantas said 6 million records of customer data may have been stolen from a third-party platform in one of its contact centers. Qantas admitted fault. The data includes email addresses, names, phone numbers, dates of birth and frequent flyer numbers. Side note: please don't "noindex" your breach pages. (via Qantas, News.com.au)

Applicants' data stolen in Columbia University hack: Bloomberg ($) confirmed and verified that a database allegedly stolen from Columbia University was in fact authentic by contacting individuals whose information was in the dataset. The information contains applicants' information — including citizenship data — going back years. That's hugely sensitive, especially given today's politics and, well, everything regarding the university right now. On the other hand, The New York Times published a piece using that hacked dataset, which was provided by a promoter of white supremacy, to smear a New York mayoral political candidate. Politics notwithstanding, actually: for a news outlet to use hacked data in this way was deeply unethical and not justified. (via Columbia Journalism Review)
KEvin Collier post on Bluesky: "Since 2016 the mainstream media (self included) has spent God knows how many hours fretting and gaming out and strategizing the right and ethical way to cover hack and leaked information. I don't see any way to justify doing this story the way the NYT did here."
IU cyberattack... cover-up? Indiana University has acknowledged that a weeks-long outage of its websites was a "security incident," but the university's top IT official seems to think he doesn't expect there to "ever be a public airing" about the breach. Well, that's deeply unethical as noted by @tarah. Cue the inevitable floodgates opening in 3... 2... 1... (via IPM, @the_real_sand)

International Criminal Cyberattack Court: The International Criminal Court confirmed it was hit by a fresh cyberattack that it described as "sophisticated" (yeah, yeah, they all say that). Little else was said about the incident, but notable since by the court's own admission that this is its second hack in three years. (via ICC)

Treasury just can't stop getting hacked: More great reporting from Bloomberg ($), looking at a trio of hacks that befell the Treasury in recent years, raising questions about the department's ability to protect itself from hacks, in spite of its... *checks notes* $1 billion cybersecurity budget...(!) This is a long-read, but worth it. (via Bloomberg ($))

Medicare.gov accounts used in fraud scheme: The U.S. Centers for Medicare & Medicaid Services (CMS) alerted over 100,000 beneficiaries of Medicare that their information was breached after scammers created online accounts using their previously-made public information as part of a fraud scheme to steal funds from the government. A similar-ish fraud scheme hit the U.K. taxation office some weeks back. (via DataBreaches.net)

Swiss government data hit by ransomware: Zurich-based non-profit health organization Radix said it was hacked and hit with ransomware, after a gang posted stolen data on its dark web leak site. The data can be restored, but apparently also affects several Swiss government agencies. (via Swiss government, The Record)
~ ~

THE HAPPY CORNER
Ding, dong, it's the good news gong. Welcome once again to the happy corner! There's a little something for everyone.

I have to admit that I laughed when I saw this historical reason for blocking access to Mastodon from a school's network.

It's always good to see a ransomware gang shut down.

I'm absolutely thrilled to return with another episode of What Can Doom Run On?, and this week it's... a set of earbuds?! Oh-kay then. You'll want to read this hilarious teardown of these headphones and the security flaws found along the way. 
A photo of a pair of ikko earbuds in a box, which features a small LCD display, which has been loaded with "Doom."
And finally... seven years flies by so fast... I can't tell you enough how much of a joy it is to write and curate this newsletter for you every week; some of you have been reading since the very first edition back in July 2018! Since its launch, ~this week in security~ has grown to thousands of weekly readers all over the world, with friends of the newsletter regularly contributing interesting news stories, groundbreaking research, cool things from around the web — and, of course, cyber cats (and friends!) that are featured each week. (If you haven't sent one in already, please do!)

Without your support, I doubt ~this week in security~ could've lasted this long, as the costs of running the newsletter continue to go up. As a working journalist, I cannot accept ads or sponsors, so this newsletter relies entirely on the generous donations from you to keep it running. If you love this newsletter, please consider donating a few bucks or more to get cool swag from me to say thanks!

You may remember a few months ago, I ran a feedback survey to hear from you about what you like and what you'd want more of in this newsletter. Hundreds of you reached out with your insightful and kind feedback, and I'm excited to share more with you in the next few weeks. Don't worry; this free weekly newsletter isn't going away anytime soon — here's to another seven years!
~ ~

CYBER CATS & FRIENDS
Meet Rosie ... this week's cybercat... or this week's cyber eavesdropper. You never know when your communications are being monitored, especially by a cat-in-the-middle attack. Thanks so much to Michael T. for sending in!
Rosie is a beautiful brown and black kitty who's sitting next to her human as she uses their laptop.
Keep sending in your cyber-cats! Got a cyber-cat or a non-feline friend? Send me an email with their photo and name and they will be featured in a future newsletter. 
~ ~

SUGGESTION BOX
This edition has already gone on for way too long... thanks for sticking around! I'll sign off for now and let you get back to your weekend. If you do want to get in touch, please do reach out!

See you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — june 29 edition

✇~this week in security~ Archive Feed
this week in security — june 29 edition
Scattered Spider hacking airlines, US charges prolific hacker, Iran cyber retaliation, CitrixBleed 2, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 26
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

FBI, cyber firms say Scattered Spider is now targeting airlines
CNN: We start this edition with a warning for the airline industry, after the FBI and cybersecurity firms Mandiant and Palo Alto sounded the alarm on Scattered Spider cyberattacks targeting aviation and the transportation sector. The collective of mostly English-speaking teenagers and young adults are highly financially motivated, and synonymous with their tactics of breaking into networks by any means, such as multi-factor bombing, deceiving help desks, and in sometimes even using threats of violence. The feds said "anyone" in the airline industry could be at risk, from vendors to contractors, which makes sense given airlines are by nature an enormous attack surface. This comes as the hackers moved on from U.K. retail to the insurance industry of late. Given that at least two airlines were hacked this month, Hawaiian and WestJet (with the latter linked to Scattered Spider, per media reports), we can probably expect to see more hacks, or previously unreported hacks disclosed.
More: Cyberscoop | Wall Street Journal ($) | Axios | Bleeping Computer | Charles Carmakal (LinkedIn) | @fbi
John Hultquist post on Bluesky: "Mandiant is now aware of multiple incidents in the airline sector that resemble Scattered Spider. The industry should button up its call centers where this actor has had a lot of success with social engineering."
U.K. man charged with hacking spree; France arrest 'ShinyHunters'
DataBreaches.net: The feds scored a sizable win this week by nabbing a top hacker and administrator of the notorious BreachForums, a former hacking forum known for sharing breaches and selling stolen data sets until the feds seized it (on at least two occasions). The forum's original admin, Conor Brian Fitzpatrick, aka "Pompompurin," was arrested in 2023, but since the site was revived and lived on. French authorities confirmed Thursday that they arrested  "IntelBroker," a British national called Kai West, 25, earlier this year in February and since charged by U.S. authorities. West was allegedly behind some major data breaches listed on BreachForums, including a telco, an ISP, and a healthcare provider, stealing gobs of data and causing millions in damages, per the U.S. feds. Several other French nationals, who the authorities believe are BreachForums admins, were also arrested as alleged members of the ShinyHunters group, which was responsible for a ton of breaches, including many across France. With West expected to be extradited to the U.S., we'll likely hear a lot more about the hackers and their activities at his trial.
More: Justice Department | DataBreaches.net | TechCrunch | The Record

Iran's cyber forces may retaliate following air strikes on nuclear sites
Washington Post ($): We're back in Iran after what was a frenetic (and kinetic) few days of missiles, air strikes... and then... pretty much nothing. A ceasefire between the U.S., Israel, and Iran is mostly holding — for now — with the entire situation there largely unresolved over whether Iran can in fact build a nuclear weapon at speed. At least in the short term, the focus is now on Iran's cyber capabilities in retaliation, and... even then, there hasn't been so much on that front either. It seems it's possible that Iran's cyber prowess was overstated, or its hacktivist network was hobbled by the recent strikes. Homeland Security still warned of low-level cyberattacks from Iran targeting the U.S., and for companies to be on guard. The takeaway is that we're not out of the woods yet, and while it's so far so quiet on the threat of retaliation, that could change and now would be a better time than any to button up your perimeters.
More: DefenseScoop | NBC News | Associated Press | WSJ ($)

A new CitrixBleed bug is now believed to be exploited in attacks
Bleeping Computer: Flip the "days since a zero-day was found in enterprise tech" back to zero. Security firm ReliaQuest said it's seeing potential exploitation of a new bug in Citrix gear (CVE-2025-5777), dubbed CitrixBleed 2, for its likeness to the original CitrixBleed bug discovered in 2023. The bug, found in NetScaler ADC and Gateway devices, can be abused to allow remote unauthenticated attackers (read: no passwords needed) to steal memory from a vulnerable device, such as credentials and session tokens — you know, all the fun stuff you need to hack into a network. Citrix says, basically, that there's no evidence of exploitation — but do you really want to take the chance? Update your Citrix tech today, don't delay.
More: Citrix | The Register | DoublePulsar ($)
~ ~

THE STUFF YOU MIGHT'VE MISSED
Scale AI exposed sensitive data about its clients in public Google Docs
Business Insider: Scale AI, which relies largely on an army of hundreds of thousands of freelancers and contractors to train its models for its big tech clients, left much of its Google Docs files public and accessible to anyone with the link — including Business Insider reporters. Some of the files were marked "confidential," while others included details about the contractors themselves. Scale AI said that it takes "data security seriously." Ehhhh...

An AI bot now leads the HackerOne bug bounty charts
Bloomberg ($): AI bot Xbow is now the top ranked "hacker" on HackerOne's bug bounty charts. The tool automates the discovery of security flaws, which the company behind it uses to file bugs with HackerOne and claim the bug bounty prizes. I'm an AI skeptic, no secret, and the framing of this story was odd; to call this AI bot a hacker, let alone a good one, does a real disservice to actual hacking. That said, it's good to see AI weeding out real flaws, but right now it's still tackling low-level bugs that need fixing but don't have the human resources allocated to them.

U.S. cyber agency warns of six-year patched bug under attack
CISA: I don't know who needs to hear this but... if you happen to have a Fortinet device on your network that you haven't patched in, oooh, say, six years, you might want to get on that right away. CISA said it has evidence that this Fortinet bug from 2019 is now under attack. The bug involves Fortinet's use of a hardcoded key in some of its products. Listen to @caseyjohnellis!
Casey Ellis tweet: "Note the CVE date… for the love of God, PATCH YO’ FORTINET," quote tweeting Lindsey O'Donnell Welch, who posted a screenshot of the 2019-dated Fortinet CVE.
Microsoft to boot out security firms from the Windows kernel
The Verge: Remember around this time last year when that buggy CrowdStrike update caused a massive Windows outage across the globe? (Time flies... except when the airlines crash.) Microsoft said it will soon boot out cybersecurity firms from accessing the very core of the Windows operating system, aka the kernel, which those firms have long needed to scan the inner workings of your device for malware. It's a long-game process that won't happen overnight, but the cyber firms (and video game makers, which also rely on access to the Windows kernel to detect cheaters) will be part of the ongoing discussion.

Sharp uptick in cybercrime across Africa
Interpol: Two-thirds of Interpol's African members said cybercrime accounts for about 30% of all crime in Western and Eastern Africa, with scams, ransomware and business email compromise (think breaking into email accounts and rerouting funds) as the top issues. It's worth noting that these cyber issues affect victims globally and are not just a problem in isolation.
An Interpol matrix showing region vs cybercrime type of the most frequently reported cyberthreats across African Interpol members. Most of the severe cases were under "online scams and phishing" affecting all regions the most.
Multiple vulnerabilities found in Brother printers
Rapid7: If you have a Brother printer, there's a good chance that it may have a problematic, unfixable bug. The good folks at Rapid7 found eight new flaws affecting more than 700 models of printers from Brother's range (and some others). One of the worst bugs is CVE-2024-51978, effectively an authentication bypass that can turn a device's serial number into the default admin password for the affected printer. Bad news, though — CVE-2024-51978 cannot be fixed in existing models, so you'll have to buy a new printer. Printers can be great for hacking — both as a foothold to the wider network, and for stealing previously printed documents from their memory. SecurityWeek has some yarn on the bugs.
~ ~
DONATE TO SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A selection of ~this week in security~ swag, including a "Cybercat" themed mugs (in both black and white) and a bunch of custom cybersecurity-themed stickers on a grassy background
~ ~

OTHER NEWSY NUGGETS
Canada warns of Salt Typhoon intrusions: Hot on the heels of last week's disclosure that the Chinese-backed hacking group Salt Typhoon targeted satellite telco Viasat as part of its stealthy espionage campaign snooping on senior American officials, the Canadian government now says its phone networks were compromised by the same hacking group. The China-backed hackers reportedly used a bug in Cisco routers to siphon internal telco network traffic, but that the telco hadn't patched the affected routers at the time. (via Ars Technica, Canadian Government)

SCOTUS OK's porn ID checks: The U.S. Supreme Court has ruled in favor of Texas, allowing state governments to require ID checks before individuals can access adult websites. The decision ultimately means that databases of people's information will be kept and will inevitably become a target for hackers and extortionists. The three Democrat-appointed judges dissented. (via Texas Tribune, @chrisgeidner)

U.K. says ransomware contributed to patient's death: The Qilin ransomware attack on U.K. pathology lab Synnovis in 2024 contributed to the death of a patient, according to the result of an investigation published this week. The long wait for a blood test result was a factor in the death, the NHS hospital trust said. It's a painful and tragic reminder that cyberattacks can and do have real-world consequences. (via Bloomberg ($))
Joe Tidy post on Bluesky: "I just spoke to the Qilin hackers responsible for this now fatal cyber attack. Over encrypted text I asked them if they had any thoughts or response to the news. 'Hi, no comments' is all they replied."
UNFI escapes data breach: United Natural Foods, which was hacked some weeks back and caused widespread food supply chain shortages, said in an 8-K filing that it does not believe it experienced a data breach as part of the cyberattack. Some employees told me that they were concerned their personal information may have been stolen in the attack. UNFI's core systems are now back online. (via U.S. SEC)

Trump's cuts spark cyber disarray: @ericjgeller paints a pretty bleak picture of the U.S. government's cyber power, citing more than a dozen sources. Recent workforce chaos has "seriously weakened" public-private partnerships that protect critical infrastructure, the government has cancelled meetings with infrastructure operators, and coordination projects scrapped. The end result is a "growing national vulnerability to debilitating hacking campaigns," at a time of precarious international stability. (via Cybersecurity Dive)
A meme/animated GIF of Jimmy Fallon saying, "Levels of concern have gone from mild to medium"
~ ~

THE HAPPY CORNER
Honestly, we couldn't get to the good news fast enough. Breathe, relax, and soak up the fun stuff. Welcome to the happy corner.

Anyone want a cup of [CLASSIFIED] coffee? I hear the beans are [REDACTED].
Silas Cutler post on Bluesky: "Totally normal for DC," followed by a photo of a professional coffee machine with a "TOP SECRET//SAR" red sticker indicating that the device is U.S. government property and the machine is classified. (Probably a joke.)
Here's a "404 page not found" page that we can all relate to... except if you're under the age of 25, as some of these GIFs won't make any sense to you. (seen via @wendynather).

The EFF has a great guide on covering your OPSEC and identifying what data of yours can get snatched up by the cops. This is a really good at-a-glance look at how these legal processes work, and what you can do to protect your data as best as you can.

File this under harmless hacks: For some reason, apparently you can use a Flipper Zero to give Teslas... wings.
A short animated GIF of someone using a Flipper Zero to remotely (but nearby) open the charging port on a nearby Tesla.
A very happy Pride to everyone. For those who are heading out to marches this weekend, have fun. 🏳️‍🌈

And finally: here's a bonus cybercat, because we definitely need it. 
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Arya, who... *taps mic*... [in their best podcasting voice:] will be delivering your Meow FM cyber news digest at the top of the hour, but for now, we'll leave you with some smooth, smooth jazz. Thanks to Joel F. for sending in!
Arya is a beautiful kitty who can be seen sat/stood in front of an on-air podcasting microphone.
Got a spare minute? Send in a cyber-cat! Drop me an email with a photo and name of your cyber-cat (or non-feline friend!) and they'll be featured in a future newsletter. Sent in a snap before? Updates are very welcome and appreciated! 
~ ~

SUGGESTION BOX
Thanks for tuning in and sticking with me for what has been... one busy, slightly crazy, and unpredictable week of cyber. I'll be back next week with what is likely to be a shorter newsletter than usual given the July 4 holiday in the U.S., but don't worry — there's no scrimping on everything that you need to know!

Please do get in touch if you have something or anything you want to share with me or for the newsletter. It's nice to hear from you! In the meantime, I hope you have a great week and I'll catch you next.

Take care,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — june 22 edition

✇~this week in security~ Archive Feed
this week in security — june 22 edition
Iran hit with bombs and cyberattacks, Scattered Spider targeting the insurance industry, SMS 2FA codes exposed, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 25
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Iran in internet darkness as conflict escalates, amid fears of cyber spill-over
NBC News: We start this week in Iran, where on Saturday the U.S. bombed three of its top nuclear sites. The politics of the military action notwithstanding, the U.S. is now embroiled in another conflict in the Middle East that has security folks and network defenders around the world on high alert. In the preceding days, Israel attacked Iran with airstrikes and via cyber, with Predatory Sparrow, a pro-Israel hacking group, taking out a major Iranian bank and the country's largest crypto exchange one after the other, wiping out millions from the Iranian economy. The internet there largely collapsed, now confirmed as blocked by the Iranian government. Israel, meanwhile, warned that Iran is hijacking web-connected cameras of Israelis to gather intelligence, per Bloomberg ($), similar to tactics used by Russia following its invasion of Ukraine. To be clear, this is a messy ongoing situation. Iran is a major cyber power and emerging nuclear threat. The effect this conflict will have around the world isn't clear, and critical networks in the U.S. are preparing in the event of Iranian retaliation.
More: Reuters ($) | Wired ($) | TechCrunch | Politico | Associated Press
Jeff Moss post on Mastodon: "Note to self: start scheduling backups and don’t be surprised by cyber attacks from Iran or their supporters. Right after dismantling CISA, perfect timing."
Scattered Spider attacks now targeting insurance industry
CNN: In other major threat news, one of Google's top security folks is warning the insurance industry to be on guard against Scattered Spider-style attacks, whose tactics involve social engineering and imitating help desks and more (as well as using threats and sometimes violence) to get access to networks. The alert came from @johnhultquist, who says he's losing sleep over the threat from Scattered Spider attacks; these are largely young'uns and adults who are incredibly financially motivated and, frankly, quite dangerous. The insurance industry has most of our collective data, so it's a prime target for these hackers, which can in some cases execute their attacks in a matter of hours, not days. On the back of hitting the retail sector, now several insurance companies of late have been hacked, including Aflac, but it's not clear just yet how linked they are to this latest round of cyberattacks; we may learn more in the coming weeks when data breach disclosures come out. Don't underestimate this threat.
More: Cyberscoop | Bleeping Computer | The Record

Middleman telco could access two-factor codes for the world's tech giants
Lighthouse Reports: Fantastic story here by Lighthouse — also Bloomberg ($) — looking at how a little-known Swiss telco called Fink, which has links to intelligence agencies and the spy industry, was carrying SMS-based two-factor codes for some of the world's biggest companies, including Amazon, Google, and Meta. Of course, the lesson here is SMS 2FA isn't secure as telcos can inherently access these messages. (There have been similar exposures of SMS 2FA codes back in 2018 and 2024.) The main takeaway is to still multi-factor all the things, but if at all possible, use an app-based method or a passkey (or hardware key) if at all possible. As an aside: Some of you may've seen that "16 billion password breach" story this week, which Bleeping Computer debunked and rebalanced things by doing a great job explaining why this matters to you and what you can actually do about it. In cybersecurity, you need news you can use, not just be needlessly alarmed by! @jerry has a good short take on this.
More: Ryan Gallagher (LinkedIn) | @lighthousereports
~ ~

THE STUFF YOU MIGHT'VE MISSED
Alleged shooter found Minnesota lawmakers’ addresses online, per court docs
Politico Pro ($): The alleged shooter behind the killings of two Minnesota Democrats at their homes used "people search" websites to find the names and addresses of his intended targets, per @alng. These sites are fed by data brokers and are entirely legal, because the U.S. doesn't have any privacy rules stopping this (yes, still). Remember: not all data removal offerings are equal (or effective), but good folks like @yaelwrites has a list of sites you can opt-out from.

Helsinki's data breach post-mortem identifies security failings
Finland's Safety Investigation Authority: Last year, the city of Helsinki had a data breach affecting thousands of kids, their parents and guardians, and city workers. Now, the country's investigators have published a detailed post-mortem of the cyberattack. The full report is in English (and translated into others!), so CISOs put on a pot of coffee and go read this and take notes. (via @campuscodi)
A screenshot from Helsinki's data breach post-mortem, which shows four servers storing a collective 2 terabytes of data, with huge quantities of data exfiltrated over the course of several days.
Websites are tracking you via your browser's fingerprint
Texas A&M University: Interesting research out of Texas examining the privacy risks of browser fingerprinting, a way to use the unique characteristics of your browser, such as screen size, user agent, browser plugins and more, to track you around the web. This kind of tracking has been known for some time, and the EFF has been sounding the alarm on this for years. Using an ad-blocker can help in some cases to block some of the trackers that use browser fingerprinting. Using an ad-blocker is like your crash helmet for the internet. You don't have to think about it, and it'll help to keep you safer online.

When is a good time to fix that vulnerability?
Patrick Mathieu: I enjoyed reading this blog, looking at vulnerability management. Patching your devices and systems just isn't that easy in practice and goes quite far beyond just "patch everything and often." This blog looks at triaging what are the most pressing bugs to fix, and why. Funnily enough, much of this applies in journalism, too: Many vulnerability news stories are designed to scare folks into reading but don't offer much beyond "patch your stuff," and seldom take into account exploitability — which, ideally, should be one of the main things to consider.

Microsoft cut off ICC chief's email, sparking concerns for Europeans
The New York Times ($): Earlier this year, Trump issued sanctions against the International Criminal Court's top prosector, a move that effectively cut off the ICC's chief from the United States — including his Microsoft-hosted work email account. That prompted a huge alarm, allowing the U.S. to unilaterally penalize individuals across the world using sanctions. This is yet another reminder that we are often at the mercy of cloud or tech providers that can cut us off at any moment.

Exposure of forensic phone dumps found online
Martin Seeger: Security researcher @JayeLTee found an exposure of what appears to be forensic phone dumps, which include highly confidential information taken from the phones of suspects. The leak was traced to what is likely the Montana Department of Justice. The general reluctance, it seems, to get the damn thing fixed was arguably just as bad. If you don't have any public means for a security researcher to contact you, you're not doing it right. DataBreaches.net also has more.
~ ~
THANKS FOR YOUR SUPPORT!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Hackers strike reporters' email accounts: Hackers targeted the email accounts of Washington Post reporters, apparently as part of an effort to gather intelligence to "benefit China's interests." This obviously isn't great, but probably worth a wider question as to how the hackers got in. Since the Washington Post is a Microsoft email shop, and given the Chinese, the Russians (and the Russians again) have broken into Microsoft-hosted email accounts in the past few years, maybe that's where the scrutiny should be. (via Wall Street Journal ($), @dnvolz)
Dustin Volz tweet: "The breach is believed to be the work of a foreign government and stretches back at least a month. Some of those compromised focus their reporting at least partially on China, sources said."
UNFI's week of silence: The cyberattack at UNFI, the main food distributor to Whole Foods and other small grocery stores and large supermarkets alike, is about to enter its third week, and we haven't heard anything new from the company since its brief most recent update on June 15, saying the company was making "significant progress" in its recovery. No filings with the SEC since, either, all the while folks are still reporting food shortages at stores across the United States. (Disclosure alert: I wrote this story!) (via TechCrunch)

New named victim of Salt Typhoon hacks: Remember last year when Chinese spies were running around the networks of U.S. phone and internet giants? Bloomberg now reports that Viasat, the satellite provider (which was also hacked during Russia's invasion of Ukraine) was the latest victim of those Chinese espionage hacks. AT&T, Lumen, and Verizon were named victims of the Chinese espionage campaign, as well as Comcast and datacenter giant Digital Realty named recently. The long-running breach affected more than 100 million records belonging to 1.3 million users — mostly in the Washington DC area. (via Bloomberg ($))

Third time flip-flop on TikTok: I know it's been a while but... remember when TikTok was banned on national security grounds and nothing much ever really came of it? Yes, it's still going, with the Trump administration extending the full-blown ban for a third time for reasons that are frankly unclear. TikTok is a big deal to a lot of folks (and fair, to be honest). But the longer that the U.S. delays this ban, the less officials get to argue about the pressing risk of content manipulation by China. The U.S. can't have it both ways! (via Associated Press)

WhatsApp-a-Mole on Paragon exploits: A nondescript bug in the FreeType open source library discovered in March by the security folks at WhatsApp was being exploited by Paragon-made spyware, the company confirmed this week. If you recall, Paragon's Graphite spyware was also being widely used to spy on journalists and others mostly who have some link to Italy (and beyond). It's the latest in an ongoing Whac-a-Mole situation where WhatsApp keeps outing Paragon's exploits, and Paragon must be getting reeeeeally annoyed. Good! (via SecurityWeek)

San Diego exposed license plate data exposure: The San Diego Police Department uses the surveillance giant Flock for its automated license plate readers. Flock is a network of searchable databases that other U.S. police departments and law enforcement agencies can access. But San Diego's settings were misconfigured and allowed any other agency to query its databases – nearly 13,000 times in just two weeks between 2023 and 2024. Notwithstanding the fact that this was unlawful under California law, it is also a terrible security practice. (via Times of San Diego)

Kicking 23andMe while it's down, U.K. edition: UK's data protection agency the ICO has lobbed a fine of £2.3 million (around $3m) at failed genetics testing firm 23andMe for its massive data breach back in 2023. But even by the ICO's own acknowledgement, it's not clear if the data watchdog will end up collecting since the company filed for bankruptcy earlier this year (though, the company might still be rescued). The ICO's more detailed report [PDF] is worth reading because it's a rundown of the many, many security failings that could have otherwise been an opportunity by 23andMe to identify the breach. (via ICO, BBC News)
~ ~

THE HAPPY CORNER
All aboard the happy bus! Next stop, the happy corner. Ding ding!

Pssst. Hey, kids. Wanna see a bunch of mansion-living cybercriminals get raided by the cops? Yeah you do. According to Thai cops, the crims were running an investment fraud ring that targeted Australians, duping unsuspecting victims out of a couple of million Aussie bucks.
A snapshot from a BBC News video, supplied by Thai police, showing a scam call center in a mansion, with police.
Thanks to @lisaforte, I've had that song stuck in my head for the past few days...
Lisa Forte post on Bluesky: "We built this city, we built this city on ICS with default passwords."
Obviously the next... uh, while... is going to be a busy and likely stressful time in cyber. But these words from @cR0w really stuck with me this morning as I was writing this newsletter. It's not easy staying focused when the world feels like it's on fire. It probably feels very "First Time?" meme for a lot of folks. But remember, we are collectively(!) a great team, and can accomplish great things if we work together. Share something that can help someone else. Share something that can make someone smile. We — each other — are all we have!
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
You know sometimes when the excitement just hits? Well, meet this week's cyber cat pup, Whisky, who clearly cannot contain herself. According to her human, Whisky is incredibly cute and soft, and whose pupper superpower is melting away anyone's ill-will. Get Whisky to the cyber front-lines, stat! Thanks to Kathrin M for sending in!
Whisky is a very cute labrador (I think) who can be seen lying on the floor with and mouth open in excitement, as such the photo is slightly blurry!
Keep sending in your cyber-cats! Drop me an email with a photo and name of your cyber-cat (or non-feline friend!) and they'll be featured in a future newsletter.
~ ~

SUGGESTION BOX
On that week, I bid you good day for now and wish you all the best for this week. We're all in this challenging time together, but we can do this — for ourselves and each other. Love is the antidote to hate! I'll continue to keep a close eye on all things cyber and report back next Sunday in my usual dispatch. 

As always, feel free to drop me a note if there's anything you want to share for the newsletter. If you have a cyber cat to share, I doubly want to hear from you!

All my best,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — june 15 edition

✇~this week in security~ Archive Feed
this week in security — june 15 edition
UNFI cyberattack sparks food shortages, Paragon spyware hacked journalists, Google phone number bug, and more..

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 24
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Cyberattack at U.S. grocery distributor UNFI affecting store shelves
TechCrunch: It's been a rough week if you're into, well, food. A cyberattack saw one of the top food distributors in North America, United Natural Foods (UNFI), shut much of the company's operations down last week (which wasn't disclosed until a Monday filing) hampering shipments to local grocery stores and large supermarkets. Whole Foods was one of the bigger retailers hit, in part due to its size and that UNFI is its "primary distributor," telling staff the shelf shortages were due to an "outage" at its distributor. (How quaint!) By Saturday, things were starting to return online, but widespread disruption continues across the U.S. and Canada, per affected customers chatting with me over the past few days. (Disclosure alert: I wrote these stories!) I think we sometimes forget how fragile the supply and logistics industry is. No word yet on UNFI's full recovery, or whether data was stolen in the incident. Expect more updates this week, as (hopefully) store shelves will start to recover as the company begins slowly shipping goods out again, but still may take time.
More: UNFI statement | KARE11 | WTIP | Grocery Dive | NBC News

Paragon spyware confirmed used against journalists
Citizen Lab: An ongoing spyware scandal in Italy continues to unravel... the latest twist is that researchers at Citizen Lab have confirmed two journalists — Fanpage reporter Ciro Pellegrino, and the other is unnamed — were hacked with spyware made by Israeli surveillance vendor Paragon. Citizen Lab said the two were probably hacked by the same customer. But whom? All eyes are on Italy, since a parliamentary report confirmed that some of the people involved in this spyware scandal were spied on, in some cases for 'lawful reasons' (heavy quotes for obvious reasons), but that there was no mention of spying on journalists, like Pellegrino. So, is this a cover up? It's starting to look a little more than suspicious, and now Paragon has pulled its contract with Italy over the scandal. As the excellent @jsrailton told my TechCrunch colleague @lorenzofb that last week Italy was "putting this scandal to bed [but] now they'll have to reckon with new forensic evidence." The ball is in Italy's court. Meanwhile: Apple quietly disclosed this week that it fixed the zero-day bug back in February that was being used to hack the journalists.
More: TechCrunch | Associated Press | TechCrunch | The Guardian | Haaretz ($)
Bill Marczak tweet: "Around the same time this phone made these requests, it was silently communicating with an iMessage account (which we redact as "ATTACKER1"). We conclude that ATTACKER1 deployed a sophisticated zero-click attack against the device. Apple (silently) mitigated it in iOS 18.3.1," followed by a screenshot of the Apple advisory.
Interpol and police across Asia take down infostealer operations
Interpol: A little amuse-bouche of good news ahead of the happy corner: Interpol released details about a sizable law enforcement operation across Asia that saw more than 20,000 malicious domains used in info-stealing operations taken down over a four-month effort. Password stealers are still a major worldwide security problem; by stealing passwords, attackers can break into systems that aren't protected with MFA. (In some cases infostealers can bypass multi-factor authentication by stealing your logged-in session tokens.) No specific malware groups named (yet) but more than 216,000 victims and potential victims notified with actionable recommendations on what to do next (such as changing passwords, freezing accounts; all the usual jazz). Authorities in Sri Lanka, Nauru, and Hong Kong among others assisted. This is a pretty good result, but still a drop in the ocean to the wider info-stealing economy.
More: The Register | SecurityWeek | CSO
An infographic provided by Interpol showing 25,917 IPs/domains investigated and 20,642 taken down, over 69 infostealer variants and 216,058 victims notified.
~ ~

THE STUFF YOU MIGHT'VE MISSED
Apple will allow users to transfer passkeys
Ars Technica: At last! (Well, almost.) Apple will soon allow users to import, export and transfer their passkeys across platforms, reducing a significant headache and barrier to using the passwordless tech. The news was revealed at Apple's annual developer conference, WWDC. Also announced: Apps developed for Apple platforms will be able to adopt new security features like pointer authentication, which makes it harder to exploit memory corruption bugs to leak data from your apps. (via @never_released)

Android 16 features Advanced Protection for better security
Android Authority: Google fans aren't left out of this week's mobile security fun-fest. Android 16 devices will land with Advanced Protection (a feature similar to Apple's Lockdown Mode) allowing Android users to lock down their devices further to protect against advanced external threats, like spyware. Interestingly, the feature includes Intrusion Logging, which includes logs for forensic analyses to determine if a device was compromised. That's going to be huge for researchers investigating spyware. (Relatedly, there's a section in Citizen Lab's report on Paragon — mentioned earlier — about the challenges of Android logging.)

Privacy research: Detecting hidden GPS trackers
ResearchGate: Two interesting research papers worth looking at. One study looked at the risks and dangers of hidden cellular-enabled cellular GPS tracking devices on vehicles, and provides an "affordable and practical solution for would-be victims" to detect trackers using relatively cheap hardware. Also: the University of Cambridge dug into the risks associated with commercial menstrual apps, which track periods and fertility cycles and more, given that this data in the wrong hands can be catastrophic for individuals. It's always important to think about where your data is and how it can be accessed (and by whom).

Bug could reveal any phone number linked to a Google account
brutecat: Security researcher brutecat found a way to determine the private recovery phone number of pretty much any Google account, the sort of attack that would be a boon for SIM swappers. The bug involved in part bypassing an anti-bot protection, allowing the brute-forcing of phone numbers. In some cases a number can be determined in a matter of minutes, or faster. Google has fixed the bug. 404 Media ($) has a good write-up. (I also wrote some words!)

Telegram servers controlled by man with links to Russian intelligence
OCCRP: The Organized Crime and Corruption Reporting Project has a deep-dive story about a Russian network engineer called Vladimir Vedeneev, who runs a company that controls thousands of Telegram IP addresses and maintains many of the company's servers, all the while keeping extremely close ties with Russia's intelligence services. This reporting is a good explainer on why you pretty much use Telegram at your own risk, since messages aren't end-to-end encrypted by default. (For more, read up on @pwnallthethings from 2022 on how Russia monitors Telegram using metadata.)

How Waymo handles footage from events like protests
Wired ($): Driverless cars like Waymos (and also those creepy autonomous food delivery robots) are packed with cameras, sensors and other data collectors as they drive around cities transporting folks (or food) from one place to another. All of that collected data, of course, can be accessed by police. Waymo doesn't say much about when it gives over data to cops (even though it does!). All to say, any time you see a Waymo, know that it's also seen you, too.
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Com kids' crimes carry consequences: At Sleuthcon, the incredible @nixonnixoff spoke about the Com, one of the most pressing cyber and real-world threats of today. These are "not the stereotypical old-school hacker"-types, per Nixon, but are typically teenagers and young adults (aka "advanced persistent teenagers") who use threats and violence to get what they need, including access to networks. It's also probably a consequence of having underfunded education systems that can't (or don't) intervene with kids at a time to harness their skills for good, though some are deemed too far gone. (via Cyberscoop)

Airlines sold your data to DHS: As if you could hate flying any more, but fresh new twist: Some U.S. (and European!) airlines sold your data to U.S. Homeland Security through a data broker, which obfuscated how your personal information, full flight itineraries, and financial details were originally obtained. Lever News and Papers, Please! also looked at this last month. Now, Ron Wyden wants answers from the airlines, so hoo boy, buckle up (pun intended). (via 404 Media ($), Wired ($))

Chinese telco hackers likely hit data centers: Last year, U.S. officials sounded the alarm on a group of Chinese hackers, aka Salt Typhoon, which were embedded in several telecoms across the United States. Now it seems that officials believe the intrusions were potentially broader than first thought and may've had access to data centers, like Digital Realty, which runs 300 colocation data centers used by cloud giants. Comcast was also named as a likely victim. (via Nextgov, @ddimolfetta)
David DiMolfetta post on Bluesky: "A breach into either could carry significant national security risks. Comcast facilitates internet access for millions of users + businesses, while Digital Realty hosts troves of physical infrastructure to route global web traffic."
Predator has a new African customer: New data on Predator, developed by the now-sanctioned spyware maker Intellexa, suggests Mozambique has signed on as a government customer. The research also links high-tier Predator infrastructure to a Czech entity. (via Recorded Future)

PowerSchool hack leaves questions unanswered: Veteran security blogger Dissent Doe has a really interesting analysis looking back at the PowerSchool hacks, one of the largest-ever education hacks that unfolded largely this year, affecting at least 60 million students, plus teachers. A 19-year-old student from Massachusetts pleaded guilty to the hack, and will now skip directly to sentencing. But Dissent Doe still has outstanding questions — and reads between the lines with solid analysis of what we still don't know about the hacks and subsequent extortion events. (via DataBreaches.net)
~ ~

THE HAPPY CORNER
There's just a little time left in this busy newsletter this week to dip our feet into the cool shallow waters of the happy corner.

If you ever wondered why loading screens always takes forever, here's why.

Caption contest this electrifying photo. (My favorite reply: "Just not for very long.")
Nanoraptor post, featuring a photo of an electrical substation with a sign: "DANGER: LIVE LAUGH LOVE"
And finally, this week. Icelandic grocery store Netto is reportedly looking for a thief who was caught on camera stealing from their store. I don't know about you, but all I see is a first-time pen-tester really trying their best. I will say, though, the full video (on Facebook) is *chef's kiss* hilarious. (h/t @hildur)
An animated GIF of a cat with a fish in its mouth running across the supermarket floor to the gated entrance.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet Yoshi, this week's cyber cat, once again proving the theory that "if they fit, they sit." What an absolutely glorious photo. Thanks so much to Matt S. for sending in!
Yoshi is a mostly-white cat with a black stream by her ear, sitting on a board game box and basking in the sunlight.
Keep sending in your cyber-cats! Drop me an email with a photo and name of your cyber-cat (or non-feline friend!) and they'll be featured in a future newsletter.
~ ~

SUGGESTION BOX
Aaaaannnddd I'm outta here! Thanks so much for reading and making it through this busy week of security news. Let's do this all over again next Sunday. I'll keep a close eye on the UNFI cyberattack aftermath, and we're likely to hear more on "Italian Watergate" (we need a better name, let's be honest; suggestions welcome!).

It's always lovely to hear from you, so if you have anything you want to share for the newsletter — including a cybercat (or a friend) — please get in touch.

And if you really like what you see, tell a friend or coworker about this newsletter or feel free to forward this email on! 
 
Have a wonderful week,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — june 8 edition

✇~this week in security~ Archive Feed
this week in security — june 8 edition
DOGE granted access to Social Security data, new cybersecurity executive order, hackers target Salesforce data, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 23
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Supreme Court allows DOGE to access Social Security Administration data
Bloomberg ($): Breaking news late on Friday night *record screeches*... the Supreme Court now says Elon Musk's DOGE team can access sensitive data on millions of Americans stored by the Social Security Administration. The U.S. top court lifted restrictions that a lower court judge said were necessary to protect the privacy of millions of people living in America. The U.S. solicitor general, in arguing the case, said DOGE can't eliminate fraud and waste if its personnel can't access the data they seek. That data includes highly sensitive personal, tax, marriage and employment information, including Social Security numbers, birth and marriage records, tax records and earnings data, employment histories and bank and credit card information, per Bloomberg. "With that, the Supreme Court's conservatives allowed DOGE access to any and every person's Social Security data," writes Lawdork's @chrisgeidner. The three liberal justices dissented, with Justice Jackson arguing the decision creates "grave privacy risks." On top of the horrendous security practices by DOGE, as newly detailed by the Washington Post ($), who knows where our Social Security data will end up? And it's not as if we can FOIA for DOGE's records, since that's something else the court also determined on Friday...
More: Supreme Court [PDF] | NPR | Associated Press | NBC News | @chrisgeidner

White House drops mixed bag cybersecurity executive order
Politico: Also Friday, the White House dropped a mixed-bag executive order, which made for light (lol) weekend reading. The order repeals a bunch of Obama- and Biden-era cyber initiatives aimed at making the U.S. cyber safer. All of this comes in the face of widespread staff cuts at CISA, aka much of the people who were making all this happen. The executive order also reverses a Biden effort that encouraged U.S. agencies to start issuing and accepting digital identity documents; now seen as a path for allegedly facilitating "entitlement fraud and other abuse," the Trump order states. FederalNewsNetwork breaks down the order in more detail, including the elimination of efforts to research secure AI systems and requiring federal vendors to attest to following security practices (following the 2019/2020 SolarWinds attack by Russia); while Politico notes the order makes efforts to beef up encryption requirements in preparation of the arrival of quantum computers, and highlights a weird provision that seems to excuse foreign meddlers of U.S. elections from sanctions, which… seems odd, no?
More: White House | BankInfoSecurity | FederalNewsNetwork | @ericgeller

U.K. tax office admits losing £47 million to criminals posing as taxpayers
HM Revenue & Customs: Skipping to my OG homeland of the United Kingdom… organized criminals managed to extract some £47 million of His Majesty's finest pounds (or $64 million in U.S. freedom units) from the country's tax office, HMRC. The criminals posed as taxpayers, setting up thousands of new online accounts using stolen identity information, and fraudulently claiming money from the government. HMRC wasn't hacked, per se, but clearly got caught short on spotting the dodgy activity. (This sort-of attack happens a fair bit during the U.S. tax season, too; it's also why it's important to file your taxes early!) HMRC's top tax boff said the £47 million stolen "was a lot of money, and it's very unacceptable," which… yeah, not great for taxpayers but also not ideal knowing organized criminals are now £47M better resourced.
More: Reuters ($) | BBC News

Phone cracker Cellebrite to acquire Corellium for $170 million
Cellebrite: Cellebrite — yes, that Cellebrite, the forensics giant that makes technology for cops that can hack into phones — is buying the phone virtualization startup Corellium, the company that until 2023 Apple was trying to shut down. The deal will go down for about $170 million; a sizable payday for Corellium's founder, Chris Wade, who was in 2020 secretly pardoned by Trump for what later transpired to be email spamming. Cellebrite, for its part, was recently in the news after cancelling its contract with Serbia after human rights investigators found the company's technology was being abused by local police to break into phones of citizens to plant spyware. The subtext with this new Corellium purchase is that Cellebrite now has its own pipeline for identifying new vulnerabilities, bean to cup.
More: Forbes ($) | TechCrunch | Cyberscoop
~ ~

THE STUFF YOU MIGHT'VE MISSED
Microsoft, CrowdStrike, others agree on common threat actor taxonomy
Microsoft: Tech giants Microsoft, CrowdStrike, Google and Palo Alto Networks are trying to fix a problem they themselves largely created by agreeing on a common taxonomy for threat actors, so now all finally agree that the companies are all talking about the same group of hackers behind a threat group's name. But, crucially, the companies didn't agree on calling them all by the same name. Or, as @maldr0id accurately put the whole situation:
Lukasz post on Bluesky: "Microsoft and Crowdstrike announced that they have created a shared spreadsheet"
OpenAI executive says ChatGPT 'ingests' cloud data
Exponential View: New nightmare IT scenario unlocked: Per OpenAI's top product officer, oft-errant chatbot ChatGPT can now ingest data from Google Workspace, Microsoft 365, Dropbox, Box and more. As noted by @mattjay, that's a potentially major data headache, as employees invariably allow AI tools access to their company's data without realizing (or knowing) it'll ultimately get used to "improve" (heavy quotes) the chatbot. Remember, companies; It's a good idea to limit third-party access to your data!

The secret history of Trump's personal phone
The Atlantic ($): The Atlantic takes an alarming look at the history of Trump's use of his personal cellphone, and its apparent (ostensible?) security. Apparently, despite his phone number being widely out there, Trump is "not walking around with a run-of-the-mill iPhone off the shelf,” an adviser told The Atlantic. (The White House declined to explain more.) It might not matter, if the underlying phone network is still a hot mess of flaws capable of eavesdropping on calls, number spoofing, and impersonation — and, of course — a president willing to simply pick up the phone to anyone. Who needs to hack his phone when you can easily catch his ear? Or, worse, both.

Vanta bug exposed customers' data to other customers
TechCrunch: Just what you don't want from a compliance startup that knows everything about your security posture... Vanta admitted that 4% of its customers (read: hundreds out of 10,000+ customers) had some of their private data shared with other customers. Vanta said it was a product code change that caused the data exposure flub, and not a cyberattack. The company has refused to specify what data was exposed, but an affected customer told me that this included names, roles, and information about some tools, such as whether MFA was in use. You know, the totally normal stuff that a malicious attacker might find useful. (Disclosure alert: I wrote this story!)
~ ~
DONATE TO SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
New details emerge in Coinbase breach: Reuters has a new, more complete timeline of how the recent breach at Coinbase went down. The incident was blamed on contractors at Indian outsourcing firm TaskUs, which led to a breach of $400 million in lost funds. Hundreds of TaskUs employees were later fired, sparking protests among employees, who accuse the company of mistreatment. Ultimately, who was to blame for the breach? Yes, Coinbase, the billion-dollar crypto giant for not locking down its customers' data enough. (via Reuters ($))

Indian startup servers wiped: Grocery startup KiranaPro said it was breached and its GitHub and AWS servers wiped in a rare destructive attack, in what the company blamed on an insider incident, specifically a former employee. But, not so fast! My TechCrunch colleague @jagmeets13 quizzed the company's co-founder and CTO, who both conceded that they couldn't rule out an external breach after all and described a litany of their own security failings, including not offboarding the former employee's account after they left. (via TechCrunch)

Meta, Yandex deanonymizing users: Legendary reporter @dangoodin has a belter of a story on how Meta and Yandex, whose pixel-sized trackers are embedded in millions of websites, are deanonymizing Android users and bypassing Android privacy sandboxing protections in the process. It's heavy reading and complex, but this is ultimately bad because it means these tech giants can link the web browsing habits of real identities across the internet. Meta halted the practice after it was, well, caught out before it got busted by Google. (via Ars Technica, The Register)

Apple gave thousands of users' push notifications to cops: In a new transparency report, Apple disclosed for the first time that it gave police around the world access to thousands of customers' push notifications, which can identify a target's device and in some cases reveal the unencrypted contents of a notification. Apple and Google were previously barred from disclosing that it gave police access to push notification data. (via 404 Media ($))
A chart showing push token requests by period, worldwide, showing the number of requests since H2 2022 (70 requests, with 54 responsive requests) rising each half-year to H1 2024 (277 requests with 164 responsive requests).
CISA top job nom dropped from hearing: Sean Plankey, the Trump administration's pick to oversee CISA, was dropped from a House hearing this week, per @timstarks. It's not an indication that Plankey isn't the nomination anymore, but apparently his FBI clearance isn't ready yet. Sen. Ron Wyden put an indefinite hold on Plankey's nomination in exchange for CISA publishing a report detailing long-running flaws in the phone networks. CISA is still without a permanent director, despite some support from the tech industry. (via @timstarks)

Italian lawmakers confirm Italy deployed spyware: Lawmakers in Italy confirmed the government there did in fact use Paragon's Graphite spyware to snoop on the phones of several activists who work to save immigrants at sea, but did not find evidence that an Italian journalist was hacked with the spyware. The very excellent @lorenzofb broke down the lawmakers' report and dished out new details on the spyware attacks. (via TechCrunch, Haaretz ($))

Hackers mass-stealing Salesforce data: Looks like financially motivated hackers (think hackers associated with the Com) are impersonating IT staff and tricking unsuspecting companies using Salesforce into stealing data from their instances using connector tools and extorting the companies. At least 20 companies have been breached across the U.S. and Europe so far, per Google's latest data. Expect to see a wave of extortion efforts, if not data breach disclosures, in the near future. (via Google Cloud, Bloomberg ($))
~ ~

THE HAPPY CORNER
You know what time it is? It's chill-o'clock in the happy corner.

This week, some great news from Censys, which found 400 exposed web-based interfaces of U.S. water facilities, and worked with the Environmental Protection Agency to secure them — including 40 of them that were entirely unauthenticated and controllable by anyone with a web browser. It shows the U.S. has a long way to go to secure its critical infrastructure, but we don't make progress unless we document and detail along the way so others can learn, too. Great work here, and a very detailed report for the geeks like me who love the nitty-gritty. (SecurityWeek has a tl;dr, too.)

In time for 🏳️‍🌈 Pride Month 🏳️‍🌈 the good folks at Privacy Guides have an incredibly detailed data privacy guide for the queer community, and has some helpful tips and things to think about in terms of protecting your privacy and securing your data.

Relatedly, a short story from @vxunderground:
Two tweets from vx-underground: The first says: "vx-underground has been banned from Telegram." The second reads: "The last post made was regarding the negative feedback on "being gay is cool and badass". We suspect someone abused the Telegram report feature to have us permanently banned. tldr being gay is cool and badass."
And finally, this week. Enjoy this chef's kiss moment of @mcnallyofficial bypassing a lock — right out of the box — after the lockmaker claimed it wasn't possible.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat therapy pup is Zayah, who just wants to hear how you are doing today. What a good pupper! Thanks so much to Thomas A. for sending in!
Zayah is a King Shepard mix who can be seen with her paws in front of her laying on a couch.
Keep sending in your cyber-cats! Drop me an email with a photo and name of your cyber-cat (or non-feline friend!) and they'll be featured in a future newsletter.
~ ~

SUGGESTION BOX
And we're done! That's it for your week in security; I'll be back as you'd expect next week with all of the news you need to know from the past seven days.

As always, please do get in touch by email any time! It's great to hear from you, and I'll never say no to an extra cyber-cat (or friend) if you want to send yours in!
 
Until next week,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — june 1 edition

✇~this week in security~ Archive Feed
this week in security — june 1 edition
Feds probe White House advisor's hacked phone, Commvault hack warning, ConnectWise breach, Australia ransom reporting law, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 22
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Feds probe effort to impersonate White House chief of staff
Wall Street Journal ($): Flip the counter back to zero, there's been another security incident at the White House. This time it's White House chief of staff Susie Wiles, reportedly Trump's closest adviser, who's been telling associates that her phone was "hacked" after some of her contacts were swiped from her personal, non-government issued phone. The WSJ broke the news and CBS News confirmed the reporting by and large. The White House said it's investigating how the contacts were taken from her phone and used to reach out to other top officials to impersonate her. It's bad enough that voice cloning is a thing now, but questions remain about how the data was stolen to begin with. Was it lacking security on her iCloud account (which wouldn't be great), or was she targeted by spyware (which would be very, very bad)? In any case, it's another example of the federal government seemingly not having a handle on its security scandal... and hoo boy, there's been a lot of it.
More: BBC News | TechCrunch | Associated Press | @kimzetter | @racheltobac

CISA sounds alarm after Commvault secrets theft
CISA: Back in February, Microsoft told data backup giant Commvault that hackers had accessed "a subset of app credentials that certain Commvault customers use to authenticate their [Microsoft 365] environments." Commvault says backups weren't accessed... but CISA said recently (and flagging here belatedly) that the attack on Commvault "may be part of a larger campaign targeting various SaaS companies’ cloud applications with default configurations and elevated permissions." That's to say, Commvault likely isn't alone in having their Azure clouds raided because of poor configuration. Commvault says CVE-2025-3928 was used in its breach, affecting "all supported versions" of its software, suggesting the hackers' use of zero-days to get access to the data they want. Sources familiar with the Commvault incident tell NextGov and (more recently) DataBreachToday that the incident was linked to Salt Typhoon, the Chinese-backed hacking group targeting tech and telco companies (and the Treasury, welp), which suggests that this could be part of a broader campaign. All to say, shields up, folks.
More: Commvault | SecurityWeek | SC World
Matthew J. Schwartz post on Mastodon: "China's Salt Typhoon believed to be behind Commvault data breach, with CISA advisory saying the threat actors stole app secrets from Azure-hosted backup platform"
ConnectWise admits cloud breach affects some customers
CRN: Remote access giant ConnectWise said it had a "security event" (read: we were breached). The company says a nation-state accessed a "small number" of ScreenConnect cloud customers, and the exploit was fixed on April 24. ConnectWise hasn't said much else about the incident, such as how many customers were actually affected or if customer data was accessed and stolen. Mandiant is investigating the breach, per the company's statement. Once again, it's another reminder that privileged access and remote access tools are frequently abused by bad actors because they can be super effective when compromised. Russia and China have been linked to similar attacks on ConnectWise instances
More: ConnectWise | Mandiant | The Record

Australian businesses subject to new ransom reporting rule
The Register: New rules for Australian businesses kick in this week, requiring some firms down under to report ransomware payments when they're paid. It's not illegal to pay a ransom (though many governments have for years warned not to pay ransoms as it helps criminals profit from, well, crime) but under the country's new Cyber Security Act 2024, any payment by a company making $3 million AUD or more has to be disclosed to the central Australian government within 72 hours. The information will help with visibility, helping the folks track payments and understand means to crack down on the file-encrypting malware. The law's provisions kick in after a rough year or two in cyber in Australia, from massive breaches of healthcare data, prescriptions and IVF records, to an enormous theft of data from one of Australia's largest phone companies. It's a step in the right direction, some will argue, given that efforts to ban (or hinder) ransomware (or payments) have largely fallen flat, except for slow progress in the United Kingdom. But hey, the cyber insurance industry is booming, funny that.
More: Australian Government [PDF] | ASPI | CyberDaily.au
~ ~

THE STUFF YOU MIGHT'VE MISSED
Many VPN apps linked to China, sparking privacy concerns
Tech Transparency Project: Millions of Americans have downloaded VPN apps that funnel their internet traffic through Chinese companies, putting that sensitive data at risk of interception by the Chinese government and military, per the latest Tech Transparency Project report. While there is an ongoing cyber threat from China, it doesn't necessarily matter which country a VPN is associated with; the larger problem is "trusting" (heavy air-quotes) any free or commercial VPN to funnel your internet traffic and not lose it or abuse it, which frequently happens. The best VPN is one that you set up, secure, and use yourself. Here's a valuable tl;dr from Bruce Schneier.

U.S. sanctions Funnull, a tech outfit connected to cyber scams
TechCrunch: Funnull, a little-known company that last year took over the Polyfill.io in a supply chain attack that redirected website visitors to scam sites, has been sanctioned by the U.S. Treasury. The money bods said Funnull was linked to pig-butchering scams and more than $200 million in losses for Americans, and that Funnull was a facilitator of major cyber scams. More from Krebs on Security, and more background on how the Funnull-Polyfill.io takeover went down.

Enterprise security is a hot mess of CVEs and flaws
32x33: I enjoyed this read from Murdoc about the state of enterprise security... and in case you didn't know, it's bad. With so many flaws in enterprise tech, from edge devices like firewalls and routers to databases and other tech riddled with flaws. Some of the top CVEs in recent years are... *drumroll please* from enterprise vendors! Clearly something has to change. Your organization might not be able to escape enterprise tech entirely, but it's worth briefing those with budgets on who the worst offenders are and consider vendors you can actually have a relationship with.
An animated GIF of someone throwing a path traversal bug (.../) at a Cybertruck, which is labeled "Infosec vendor of the day," and the window smashing. The caption is titled, "We take security very seriously."
China used Google Calendar as a malware command server
Google Threat Intelligence: The boffins at Google say they've found evidence that APT41 (aka China) is using malware that relies on Google Calendar to share commands from the malware's servers and the victims. Misuse of tech and cloud services isn't uncommon (think Telegram, Discord, and Dropbox, among others, since it looks like "regular" internet traffic that can blend in); anything with an internet connection can be a command-and-control server if you try hard enough.

Nobody knows how to deal with student-made AI CSAM
404 Media ($): A new report from the good folks at the Stanford Cyber Policy Center say that parents, schools, police and existing laws aren't prepared to deal with the growing problem of students and children using AI to generate child abuse imagery (aka CSAM). A good thread by @riana on the report's findings. This is a major problem — for privacy, safeguarding, and also policymaking — in part driven by the availability of generative AI-driven "nudify" apps, which the app store owners must do better at policing (rather than profiting from).
~ ~
THANKS FOR YOUR SUPPORT!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Another data broker got pwned: LexisNexis Risk Solutions, the data broker arm that uses personal data to help paying customers detect risk and fraud, had a breach of its GitHub account, affecting more than 364,000 people, per a filing with Maine's attorney general. Much of the data included Social Security numbers. (Sound the 'toot my own horn' alert: I wrote this story.) This breach was disclosed just a fortnight after White House advisor Russell Vought called a Biden-era rule reining in data brokers as "not necessary or appropriate." (via TechCrunch)

Japan 'net giant email pwned: Japanese internet giant IIJ had a breach dating back to August 2024, which saw hackers steal the email data of more than four million customers. A bug in the webmail software Active! was blamed for the hack. (via Piyolog, @campuscodi)

SentinelOne outage knocked services offline: Security giant SentinelOne had an hours-long outage this week, taking down its customers' ability to monitor and manage protections on their networks. Axios reports that network admins were effectively flying blind, unable to see what was being blocked or flagged during the outage. The company says the outage wasn't cyber-related but hasn't yet specified the cause yet. (via SentinelOne, )

Adidas breached, Victoria's Secret 'incident': Clothing maker Adidas confirmed customers' contact information (think names, addresses, etc.) was stolen in a recent cyberattack via a third-party provider. It's the latest in a series of retail giants to have been hacked in recent weeks. Victoria's Secret also offlined its site and email this week after an unspecified "security incident," per Bloomberg ($). Could it be another wave of Scattered Spider-linked hacks like what we saw in the U.K. of late? Maybe. The retail sector is always a prime target for thieves. (via The Verge, BBC News)

Five out of six CISA officials endorse... leaving: Most of U.S. cybersecurity agency CISA's top officials have departed the agency (or will soon), amid concerns of a growing void in expertise and leadership across the agency. Five out of six operational divisions have no leader, and six out of 10 regional officers don't either. This obviously comes in the wake of Trump's massive job cuts across the federal government, as the agency faces another 1,000 positions cut if the government's budget for 2026 goes ahead. (via Cybersecurity Dive, Federal News Network)

Pop, pop, open sesame: Researchers at Greynoise say now-patched vulnerabilities in Asus home and office routers are being abused by someone (clearly with skills, but beyond that attribution isn't known) using malware that can survive a reboot and firmware updates, granting persistent backdoor access with admin rights. It sounds like some kind of botnet in the making, so take the time to check if you're an Asus customer. (via Ars Technica, Greynoise)
~ ~

THE HAPPY CORNER
We made it, folks. We're here. The sun is shining, the birds are chirping, and this, of course, is the happy corner.

For those lucky enough to have been born after the early 2000s, aka youths, you have not had the joy of knowing what living through the golden age of mobile phone design was like. Like a walkie-talkie Bop It!, these brick-sized handhelds were at the time peak weird creations. You could twist them, slide them, hide the cameras, and more. Wonder and marvel at these bizarre creations of yesteryear (and yearn for a day where we can have phone camera privacy covers back!).
An animated GIF of two mobile phones from the early 2000s, the first has a rotating front-facing camera that hides, and a phone with a rear-facing camera with a privacy cover.
Some genuinely good news from Oregon, which has become the second state to ban the sale of precise geolocation data. The ban will take effect in October. It's a major move to combat the scourge of data brokers, which buy and sell huge amounts of our personal, financial, and location data to other companies, law enforcement, and the occasional military. Remember, the U.S. doesn't have a federal or nationwide data protection or privacy law for personal data, so any win, even at the state-level is... well, something.

In this week's Can It Run Doom?... and turns out it's a lot of things! Can It Run Doom? has its own website dedicated to the obscure, bizarre and downright odd installations of the legendary first-person shooter, Doom. From portable hotspots to the occasional lawnmower, Doom can be found on pretty much everything. Speaking of: Those crazy kids at 404 Media only went and put Doom on a tank top, for crying out loud. Consider buying one to support independent journalism while you're at it.

And finally... Bookmark this handy website: Terms of Service; Didn't Read, the website for parsing terms of service that you don't have to line-by-line yourself. It's a handy simple look-up site that explains what a company's terms of service means for you. And it's a great way to consider shifting towards other, better-run companies that won't faff with your data. (h/t @ClaudiaTranslates)
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet Loaf, this week's cyber cat loaf pupper, who can be seen here taking it easy after a busy day hacking. Cute face, but dangerous social engineering skills. Will use snuggles to steal passwords. Thanks so much to Katie B. for sending in!
Loaf is a very handsome frenchie pup, who's asleep on a blanket.
Keep sending in your cyber-cats! Drop me an email with a photo and name of your cyber-cat (or non-feline friend!) and they'll be featured in a future newsletter.
~ ~

SUGGESTION BOX
That was a busy one! Join me again next Sunday for your usual cyber roundup from the week that was. In the meantime, if you have anything you want to share with me for the newsletter (or just want to get in touch), please reach out any time!

If you like this newsletter, please spread the word to a friend or colleague, or forward along a copy of the newsletter if you've found something useful! If you're really a fan, I'd hugely appreciate a donation to keep the costs of running the newsletter down.

Thanks so much for tuning in. For now, I'm off to find a bagel and enjoy the glorious weather in the New York area.
 
Ta ta for now,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — may 25 edition

✇~this week in security~ Archive Feed
this week in security — may 25 edition
Justice Department's busy takedown week, PowerSchool hacker pleads guilty, U.K. breaches, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 21
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Feds disrupt Lumma malware, charge Qakbot and Danabot developers
Justice Department: The Department of Justice had a busy week taking on the cybercriminal world, disrupting the prolific Lumma password-stealing malware with the help of ESET and Microsoft, which seized domains to hamper the operation. Over a two month window alone, Microsoft found over 394,000 Lumma infections on Windows PCs, showing the scale of the malware. Then, a day later, the feds charged the developers of Qakbot and Databot, who are accused of hacking thousands of computers worldwide to facilitate fraud and ransomware. The Qakbot and Danabot charges and takedowns were part of the second wave of Operation Endgame, an international police operation aimed at taking down the cybercrime-as-a-service ecosystem. Proofpoint (via @selenalarson) digs into how Danabot rose to become a major botnet. Per Have I Been Pwned, some 15 million email addresses and over 43 million passwords were seized as part of the Qakbot and Danabot takedowns.
More: Europol | Microsoft | ESET | Bloomberg ($) | Cyberscoop | BankInfoSecurity
A heatmap of Lumma infections, with the most density around the U.S. east coast, Europe, and Brazil mostly.
Massachusetts student to plead guilty to PowerSchool hack
NBC News: Sticking with the feds for a hot second (I said it was busy one!) as prosecutors have charged and obtained a guilty plea agreement from Matthew Lane, 19, who is accused of being behind the largest education data breach in recent years, PowerSchool, which was hacked late last year and held to ransom. New details emerged with the plea agreement, including that the hacker demanded some $2.85 million in bitcoin from the company to delete the 60 million students' and 10 million teachers' data. PowerSchool paid the ransom, and... of course, the hacker didn't delete the data, as evidenced by directly extorting schools directly as recently as only a few weeks ago. As a refresher, Lane is accused of using a single stolen credential to access PowerSchool's backend of student data, because the company wasn't using multi-factor authentication.
More: Justice Department | Plea agreement (DocumentCloud) | TechCrunch | WRAL

Ransomware hits U.K. food supplier as retailer hack fallout lingers
The Record: Another U.K. company was hit by ransomware this week, logistics company Peter Green Chilled, which provides refrigerated and chilled goods to U.K. supermarkets and grocery stores. This comes not so long after Marks & Spencer and the Co-op had ransomware attacks and data breaches. (Ransomware targeting the food and agriculture industry have already doubled over the past year.) Unsurprisingly, the hack on Peter Green Chilled is having its own downstream effect: Lots of food and products without any details of where to go, potentially with massive amounts of food going to waste, per the BBC. Meanwhile: the knock-on effect from M&S' hack will see the company lose some £300m (~$406m) in profit, with some disruption expected until July. It's not like years of successive U.K. governments haven't had plenty of opportunity to do something — anything — about the ransomware problem...
More: BBC News | The Register | The Guardian
~ ~

THE STUFF YOU MIGHT'VE MISSED
British Legal Aid Agency hacked; stolen data may span years
U.K. Government: Staying with the U.K. for a moment, the U.K.'s Legal Aid Agency was hacked, per a government notice. The breach exposed sensitive data (including names, addresses, criminal history, financial information, and more) on individuals who sought legal aid under U.K. law. Some of the stolen data goes back to 2010. (Why that amount of data was held for so long is beyond belief...) The data includes survivors of domestic violence, family cases, and more, and may include as many as two million pieces of data.

Coinbase breach affects over 69,000 individuals
TechCrunch: The crypto giant, which last week revealed it had been compromised by an insider threat, said in a filing with Maine's attorney general that the breach affects at least 69,461 people. The company also confirmed the breach dates back to late December, which presumably would've been ample time to detect the data theft... (Disclosure alert: I wrote this story!) Seems like Binance and Kraken were also targeted by a similar insider thread scheme, but both firms reportedly fended off the attacks without losing data, per Bloomberg ($).

TeleMessage hacker took data from across U.S. government
Reuters ($): One of the hackers (yes, remember, there was more than one!) who stole data from TeleMessage, the company that created an Signal clone with archivable messages for government customers, took messages on a "broader swathe" of American officials than previously known. Reuters identified more than 60 unique government users in the cache of leaked data, which was made available to reporters and researchers by the good folks at DDoSecrets.

'Careto' hacking group was run by the Spanish government, per sources
TechCrunch: A mysterious hacking group dubbed 'Careto' (aka The Mask) discovered more than a decade ago was once described as the "most advanced threats" of its time, using stealthy spyware to steal data from a handful of governments. It was never publicly disclosed who was behind the hacking group, but Kaspersky researchers who discovered the attacks were convinced that Careto was run by the Spanish government. My TechCrunch colleague @lorenzofb has the inside scoop.
Lorenzo Franceschi-Bicchierai post on Bluesky: "NEW: More than a decade ago, Kaspersky discovered a mysterious "elite" hacking group it called Careto (aka “The Mask”), which then vanished and only resurfaced last year. We can now reveal that the researchers who investigated it were confident that the Spanish government was behind it."
Police secretly monitored New Orleans with facial recognition cameras
Washington Post ($): Incredibly good reporting here: For two years, police in New Orleans secretly relied on facial recognition to scan city streets for suspects, despite municipal rules limiting the technology's use. "Police at times arrested suspects based on AI matches without independent evidence connecting them to the crime, raising the chances of a false arrest." The fact that this was happening in secret is truly horrifying. Also: Police in the U.K. are using facial recognition more and more, some 4.7 million faces scanned in 2024, suggesting that these cameras may soon be "commonplace," per one police force in the country. That's despite the fact that the tech has long been panned for its inability to properly detect darker skin tones.
~ ~
DONATE TO SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Cuts clobbering CISA's defenses against China attacks: A senior U.S. National Security Council official wants the U.S. to fight back against China's aggressive pre-positioning of its hacking capabilities, such as U.S. critical infrastructure, likely to strike in the event of China invading Taiwan. The only trouble is that with sweeping cuts affecting CISA and other facets of U.S. cybersecurity, we might not have anyone left to defend against inevitable Chinese retaliation... security experts speaking to the Post said that the U.S. wasn't even well-defended right now... (via Washington Post ($))

Senators not alerted to surveillance demands: Sen. Ron Wyden, one of the few (only?) lawmakers in town focused on cyber, privacy, and national security, sounded the alarm among his own colleagues, after disclosing that phone giants, including AT&T, Verizon, and T-Mobile failed to develop systems for notifying lawmakers and their staff about government surveillance requests targeting Senate-owned devices... you know, surveillance requests from The White House. Despite having provisions in their Senate contracts, the phone giants never bothered to actually build the system they were required to. (via Politico ($), Ron Wyden)
A table of which wireless carriers notify customers about governmentn surveillance, with AT&T, Boost Charter, Comcast, T-Mobile and Verizon in the "no" camp, with Cape, Google Fi and U.S. Mobile in the "yes" camp.
Insider threat sees government contractor breached: Thoma Bravo-owned Opexus provides software for processing U.S. government records for nearly every agency, but was breached in February by two now-former employees who were previously convicted of hacking into the State Department, per reporting by the incredible @jasonleopold. The insider threat attack saw the two employees improperly access sensitive documents and compromise or delete dozens of databases from federal departments, including FOIA requests. (via Bloomberg ($))

Here's HOPE'ing for ticket sales: Hacker conference HOPE says it's expecting far fewer people at its event in New York this year following the Trump administration's border and immigration crackdown. The long-running conference says ticket sales are about 50% behind. Curious to see how the ongoing ICE raids and border detentions will affect international (and even domestic) Black Hat and Def Con attendance later this year... (via 404 Media ($))

UAE scouting for DOGE-displaced U.S. talent: A top United Arab Emirates military officer was allowed to reach out to departing staff of the Pentagon's Defense Digital Service to work on AI for the kingdom's armed forces. The recruitment effort comes in the wake of DOGE's cuts, but also a year after U.S. intelligence warned of UAE's ongoing ties to China. Let's also not forget, uhh, DarkMatter, an ostensible UAE cyber firm that developed spy tools for the Emiratis. (via Kim Zetter)

184 million logins exposed in data breach... breach: It's bad enough when infostealers and other malware steals passwords and creds from their victims' devices, but it's even worse when you leave those banks of stolen credentials in an exposed, internet-connected database with... ironically... no password. That's what happened when 184 million logins were found spilling to the web, including for some of the world's biggest tech platforms. (via Wired ($), Website Planet)
~ ~

THE HAPPY CORNER
The weather is warm... the sun is out... the birds are chirping. It's a good day to visit the happy corner.

Microsoft looks hellbent on rolling out Recall, its technology that constantly screenshots its users' screens, but seems like the smart folks at Signal aren't going to let Recall read Signal messages. There's more details from Signal's blog on how it's blocking access to the feature, and a little extra from @pwnallthethings on how to implement your own Recall screenshot-blocking feature.

Three words: parrot traffic cam.
A traffic camera in Brazil, with a parrot appearing in the camera shot from above.
It's that time of year again where folks are donating to send Women in Security and Privacy (WISP) scholars to DEF CON this August. If you can donate, please consider! It's more important than ever to get the most talented folks working in cyber, at a time when they are needed the most.

And... finally this week. Did you hear that story about that massive container ship that ran aground and got stuck just inches from someone's seafront house? Immediate alarms notwithstanding, we got some good memes out of it at least.
Kevin Beaumont post on Mastodon: "Siri show me a photo that represents the risk most enterprise VPN products represent to orgs who install them," followed by a photo of a container ship perilously close to someone's seafront house after running aground.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat box of light bulbs is Wilson, who is moonlighting as a physical pentester and can be seen here trying to sneak into a government complex in disguise. Trojan cat! Stay stealthy, Wilson. Thanks so much to Kyle B. for sending in!
Wilson is a ginger cyber cat who can be seen sitting inside a large box of light bulbs, and whose face can be seen through the transparent plastic on the box.
Send in your cyber-cats (or a non-feline friend!) Drop a photo and name of your cyber-cat or friend by email, and they will be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's it for this week's cyber news. I hope you have a splendid rest of your weekend (and Memorial Day, for those in the United States).

I just want to say again, thanks so much for reading. It's really a joy to write this newsletter every week, and a true honor and privilege to reach so many people.

I'll be back next week with your usual roundup. As always, please do reach out if you want to share anything or just want to get in touch.

Until next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — may 18 edition

✇~this week in security~ Archive Feed
this week in security — may 18 edition
Coinbase data breach, UK retailers confirm customer data stolen, SAP zero-days under attack, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 20
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Coinbase hit by 'insider' data breach, refuses to pay hacker's ransom
Coinbase: Let's start this week with crypto giant Coinbase, which confirmed on Thursday it was breached following an insider threat, whereby support staff were bribed to hand over customers' personal information. Around 1% of the company's monthly users are affected; said to be around 80-100k people or so. Yes, even the web3 crypto-focused giants are still facing much of the Web 2.0 problems of yesteryear. Through their bribes, the hacker stole customer names, addresses, phone numbers, government-issued IDs, balance data and transaction histories — including some big name customers, such as one of Sequoia's top partners. The hacker demanded a $20 million ransom, which Coinbase said it would not pay. While no funds were directly stolen through the breach, Coinbase said it expects to incur costs of around $180 million to $400 million to cover reimbursements of its customers' lost crypto.
More: SEC 8-K | Bloomberg ($) | Reuters ($) | Dark Reading | TechCrunch

Marks & Spencer, Co-op confirm customer data stolen in cyberattacks
BBC News: U.K.-based retail giants Marks & Spencer says customer data was stolen in its recent cyberattack (said to be costing the company some $57 million a week in lost sales, plus its CEO is also taking a pay hit, per the Financial Times ($)). Store shelves are starting to recover and getting restocked, per Reuters ($). The Co-op also had a similar breach, but reportedly hit the big red button on its network before the ransomware gang could activate its server-scrambling malware. There's lots still not publicly known about the hacks, but it sounds like the two retailers are bouncing back — finally — after weeks of disruption. Meanwhile: Mandiant's top cyber sleuth @JohnHultquist warned that the same Scattered Spider tactics of socially engineering access to victim networks then handing off access to ransomware gangs are now being used to target U.S. retailers.
More: BBC News | Retail Dive | Sherwood News | @GossiTheDog posts
John Hultquist tweet: "Shields up US retailers. They’re here," followed by a quoted tweet from Mandiant, saying: "UNC3944 (Scattered Spider) is a threat group known for its persistent and brazen social engineering tactics, including contacting help desks. Our latest blog post shares hardening and defensive recommendations to help stay ahead of UNC3944".
White House kills rule shielding Americans' private data from brokers
Wired ($): It's been [ 0 ] days hours since the U.S. government's last stuff-up... and it's all thanks to *checks notes* Russ in budgeting. Top White House official Russell Vought, the Project 2025 planner who now serves as both OMB director and acting head of the Consumer Finance Protection Bureau (you can see where this is going), said he's pulling the plug on a CFPB rule (granted, one of the final rule changes of the Biden administration) that actually would've done some good — specifically, preventing data brokers from selling Americans' personal and financial information, including Social Security numbers. Vought said in the Federal Register that the rule is "not necessary or appropriate." In short, the rule would have prevented data brokers from sharing people's private information by requiring these shady data-sellers to follow the rules of the Fair Credit Reporting Act (like credit agencies have to). It's not perfect, sure, but shy of a federal data protection law (which America still doesn't have), expect our data to keep getting sold. At least we'll know specifically who to blame when our data gets sold and stolen again.
More: Federal Register | Bloomberg Law ($) | TechCrunch | The Register | @dell

SAP zero-day bug used to compromise hundreds of servers
BankInfoSecurity: There's a new zero-day in town — two, in fact — and they're both being used to attack SAP customer servers. Onapsis has the details: The first, CVE-2025-31324, allows for unauthenticated remote code execution on NetWeaver Visual Composer servers, so this is a rare 10/10 vulnerability severity score. ReliaQuest found hackers exploiting the bug to upload webshells to affected systems, allowing for total server compromise. Meanwhile, CVE-2025-42999 is another high-severity zero-day under attack, which was found soon after the other bug. The Shadowserver Foundation said it's still tracking over 200 compromised SAP NetWeaver servers on the internet vulnerable to CVE-2025-31324, down from thousands last month, so these bugs are being exploited somewhat widely. The good news is that both bugs have been patched.
More: Bleeping Computer | SecurityWeek | The Register
~ ~

THE STUFF YOU MIGHT'VE MISSED
Rogue communication devices allegedly found in Chinese solar power inverters
Reuters ($): U.S. energy officials are said to be examining the risk posed by Chinese-made solar power inverters devices after "unexplained communication equipment" was allegedly discovered in some of them, per two sources. Reuters hasn't seen hard evidence, but claims — citing the two sources — that the undocumented communication channels can circumvent firewalls. Potentially one to watch and be aware of... but does anyone else get Bloomberg spy-chip story vibes?
Taggart post on Mastodon: "I don't know how you reasonably defend against this without dismantling every single piece of electronic equipment that comes from overseas."
VPN firm 'didn't know' customers had lifetime plans, cancels them
Ars Technica: VPNSecure has drawn ire from its customers after canceling their lifetime subscriptions, after the company's new owners said it wasn't aware of the lifetime plans when they bought the VPN provider. (Cue the sound of several facepalms all at once.) Customers are understandably furious, but worth noting that the best VPN is one you can control, operate, and encrypt yourself. (h/t Andrew Strutt, thanks for flagging!)

U.K. phone giant O2 leaks customer location data
Mast Database: Alarming news here from the U.K.: "Any O2 customer can be trivially located by an attacker," per David Wheatley, and there is "no way to prevent this attack." Wheatley found that the U.K. cell network's implementation of VoLTE is leaking raw cellular headers, including users' IMEI and IMSI numbers, as well as the last cell ID they were connected to. With that data, anyone can take someone's cell header data and identify roughly where they are within a cell tower's range. The issue is not fixed, as O2 doesn't have a reliable means for reporting security flaws.
A screenshot showing a tower ID lookup using public data but using an identifier leaked by the O2 mobile operator of a customer's location.
TeleMessage's knock-off Signal app hacked in 20 minutes
Micah Lee: Remember that insecure Signal-clone app, developed by TeleMessage and used by Trump officials, which got hacked a few weeks back? Turns out it took the person who discovered the bugs in TeleMessage's systems about 20 minutes to find a vulnerable endpoint capable of returning a 150MB heap dump of the backend server's memory. In that memory dump were user credentials and email addresses. The full story is on Wired ($).
~ ~
THANK YOU FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Scammers abuse government email system: At least two U.S. local governments confirmed that unknown scammers were misusing GovDelivery, an email system used by U.S. federal, state, and local governments to alert residents to news, information and emergencies. (Disclosure alert: I wrote this story!) The scammers used the email platform, maintained by govtech giant Granicus, to send "toll scam" emails that appeared to come from officials in Indiana, New Mexico, and others. Granicus said its systems weren't breached, but Indiana pointed its blame at Granicus for not disabling its accounts when its contract terminated at the end of last year. Whoops. (via TechCrunch)

CVE Foundation plans year-end launch: A last-minute reprieve for the CVE program earlier this year sparked the creation of the CVE Foundation, a new non-profit that aims to secure the future of the vulnerability reporting catalog. The foundation plans to launch by December, though not to the delight of everyone. (via Cyberscoop)

Indian health giant hacked, sent bullets: Last year, Indian health insurance giant Star Health was hacked and millions of patients' data was leaked online. Now, Reuters ($) reports that the hacker confirmed it sent bullets and death threats to the company's top executives. It's a marked escalation in the hacker's campaign, but not outside of the usual or norm for cybercriminals these days, who are increasingly relying on violence-as-a-service and so-called "wrench attacks." (via Reuters ($))

Deloitte missed Rhode Island hacker for five months: The hackers who broke into Rhode Island's benefits systems and stole citizens' data during 2024 had access for some five months before consulting giant Deloitte, which maintains the system, detected the breach. It wasn't until the hackers demanded a ransom that Deloitte became aware. Yes, this is a $67 billion revenue company, but wasn't properly monitoring its own systems. Looks like the state is readying a lawsuit following the breach of 644,000 people's data. (via Boston Globe ($), @metacurity)

Proton threatens Swiss quit over new law: A new Swiss surveillance law may see companies who operate there, like email provider Proton and others, potentially leave the country. Proton's boss Andy Yen said if the effort becomes law, "we would have no choice but to leave Switzerland." Seems fair, but probably a reminder that there are no perfect geographical safe havens, and a better time than any to remind you that there's no such thing as private email, either. (via RTS, en français)
~ ~

THE HAPPY CORNER
It's back and brighter than ever: This is the happy corner, and you've absolutely earned it this week.

First off, @kaito02 found where all the cloud storage hides out.
a closet behind a door with what would appear to be literal clouds. A "Cloud Storage" sign can be seen beside the door opening.
Move over, hooded coder stereotypes. Here's @munin on what the real Linux community looks like.

Here's your latest "admin/admin" example of how not to do security.

And finally, this week:
donni saphire post on Mastodon: "I have decided to have a nice day despite all current events and situations"
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Ravioli (amazing name) who can be seen here quite literally recharging after a long day of hacking. You've earned it, Ravioli. Thanks so much to Tristan for sending in!
Ravioli is a white and grey kitty who's fallen asleep on their human's closed laptop, with a wire behind Ravioli (it looks like Ravioli is plugged in, but isn't).
Send in your cyber-cats (or a non-feline friend!) Drop a photo and name of your cyber-cat or friend by email, and they will be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's all there is for this week — thanks for tuning in and reading! Feel free to get in touch the usual ways if you have anything to share for next week's newsletter. It's always lovely hearing from you.

Offlining for now,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — may 11 edition

✇~this week in security~ Archive Feed
this week in security — may 11 edition
Signal clone maker TeleMessage hacked, NSO must pay $167M after WhatsApp spyware attack, PowerSchool paid ransom but victims still extorted, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 19
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

The Signal clone app used by Trump officials was hacked
404 Media ($): "Can it get worse?" I wrote last week. Well buckle up, folks, because it really, really does. Remember how Trump officials were caught using a Signal-like clone app called TM SGNL, which was designed to archive and store messages sent through the app, defeating whatever veil of ostensible end-to-end encryption the company claimed it had... Well, the company behind it, TeleMessage, was hacked, and revealed that the company had access to its users' group chats and messages. You know, White House officials. But not just that, other federal departments were using the app, as well as Coinbase and other regulated industries. The reporting is significant: Clearly this app was trusted by some of the most senior government officials and it has proven to be a hot mess of security. Soon after, TeleMessage was hacked again, and the company suspended its service. Micah Lee did a ton of analysis here, analyzing the app's source code and finding that TeleMessage could, in fact, access plaintext messages of its users. Bad security all around.
More: NBC News | Micah Lee | Wired ($) | @josephcox thread | @gregotto
Kevin Collier post on Bluesky: "I try not to overhype this stuff, but this might be the biggest government opsec failure in history," followed by a superimposed red-stamp like image saying, "SO FAR!"
NSO Group must pay $167M following 2019 WhatsApp spyware hack
TechCrunch: Spyware maker NSO was ordered this week to pony up $167 million in total damages — a number that NSO will likely appeal — after a court ruled NSO liable for a 2019 hacking campaign targeting some 1,400 WhatsApp users. NSO broke U.S. computer hacking laws in abusing WhatsApp's servers to deliver spyware to the thousand-plus victims, and this ruling was to determine how much NSO should pay as a result. It's a sizable sum, even though WhatsApp asked for only $400k or so; it means spyware makers can't hide behind the notion that "oh, we're working for governments so we're immune from prosecution" and puts these surveillance vendors on notice. My TC colleague @lorenzofb dug through the court transcript and noted five interesting takeaways from the trial and docket.
More: Courthouse News | Platformer ($) | Ars Technica | Cyberscoop | @jsrailton posts | @davidakaye | @caseynewton

PowerSchool paid a ransom, but school districts are being extorted anyway
NBC News: Edtech software maker PowerSchool was hacked late last year and paid a ransom, but refused to say how much it paid or what evidence it supposedly had that the data was "deleted" (heavy air quotes). Now, school districts across North America — including Toronto's school district and schools in North Carolina, are being extorted. PowerSchool said it's the same data in play, so it's not another hack, but said it made the "difficult decision" to pay the ransom at the time, even though it knew the hacker's claims might be bunk. Paying a ransom doesn't guarantee anything, but makes you a target for revictimization — and we know ransomware gangs don't delete the data they steal. Good on the school districts coming forward, though, clearly they're in a tough spot here.
More: Toronto District School Board | DataBreaches.net | TechCrunch
~ ~

THE STUFF YOU MIGHT'VE MISSED
Where cybercriminals are hosting their badware
Vin01: You might wonder, "why would I care where cybercriminals are hosting their crimeware?" Because it could be on your domain, pinching your server space and bandwidth without your knowledge. Bad actors exploit bugs in websites — from governments to universities and schools — as these provide cover for malicious operations. Vin01's read on this can help you narrow down where to look.

Ransomware gangs caught abusing KickIdler monitoring software
Bleeping Computer: Varonis (strong meme game) and Synacktiv have observed ransomware gangs taking advantage of the KickIdler employee monitoring software (which captures user keystrokes) to conduct reconnaissance in malicious cyber campaigns and to steal credentials. It's a new twist on efforts to trick victims into installing remote access tools, as noted by CISA in 2023. Bleeping has your simple explainer on what to look out for if you're a network admin.
A meme of a person labeled IT admin smiling with a balloon that says, "Management tool," followed by the same image below with the IT admin sweating and being held by a scary-looking thing labeled as "SEO poisoning."
DOGE technologist's computer infected by password-stealing malware
Micah Lee: Lee is back with another belter. Area DOGE bro Kyle Schutt, whose work with DOGE as a technologist gained him access to databases at FEMA and more, had malware installed on his computer that stole his passwords, according to a review of his email address in Have I Been Pwned. If Schutt's personal computer had any link to a federal system, well that could obviously be a problem. In any case, this is what the state of federal government infosec looks like in the year of 2025.

Hundreds of e-commerce sites hacked in supply chain attack
Ars Technica: Researchers at Sansec (who've done some great research looking at Magecart and other card-stealing malware) say at least 500 e-commerce sites have been hacked by way of backdoored software, which Sansec lists as IOCs. It's problematic because the backdoored code can be used to skim credit card numbers and other information submitted by customers to websites for payments.

Inside the firmware of a Starlink terminal
Darknavy: Here's an interesting inside-look at a Starlink device, the satellite-powered internet terminal. Darknavy tore apart a terminal, and extracted and analyzed the firmware (because of course), and found — among other things — at least 41 SSH public keys within the code. "Having such a large number of unknown login keys on a user product certainly raises eyebrows." Not sure using anything connected to Elon Musk these days is a good idea...
~ ~
DONATE TO SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
CrowdStrike cuts 500 jobs for "efficiencies": Cybersecurity giant CrowdStrike will cut 5% of its workforce, or 500 people, so the company can "operate more efficiently," per CEO George Kurtz and an 8-K filing. For his part, Kurtz made $46 million in executive compensation during 2024, so that seems like very much part of the problem. (via WSJ ($), TechCrunch)

NSA downsizing by 2,000 snoops: The National Security Agency is also downsizing, and expected to cut as many as 2,000 roles at the U.S. spy agency. The CIA and other U.S. intelligence agencies are also facing cuts. The NSA still doesn't have a permanent director, more than a month after then-NSA head Timothy Haugh was fired by the president without warning. (via Washington Post ($), The Record)

Crime is bad, LockBit edition: The LockBit gang was hacked, and its dark web leak site defaced with a message, "Don't do crime CRIME IS BAD," a message first seen a few weeks ago with the fall of the Everest ransomware gang. This time around, LockBit's server innards — including chats containing ransomware negotiations — was published in place of its website. It's another blow for the former ransomware giant, which has been seized, indicted, doxed, and now hacked. (via Bleeping Computer, @reyxbf)
Rey tweet: "A basic analysis of the database indicates that the dump was created around April 29, suggesting that LockBit was compromised on or before that date and subsequently defaced on May 7," followed by a screenshot of a SQL dump showing the database generation time of April 29, 2025.
Deportation Airways hacked: GlobalX, an airline used by the Trump administration for deportations, was hacked. Per a regulatory filing, the company said the full scope of the hack isn't known. But, 404 Media ($) reports that the data includes flight records and manifests — including the name of at least one individual, who was disappeared by ICE and whose name wasn't on any government deportation lists, but now appears in the hacked files as someone flown to El Salvador. In short, that means a private company may have more accurate records of where people are than... *checks notes* the federal government. (via 404 Media ($), PBS)

South Korean telco giant apologizes for huge breach: As many as 25 million customers of SK Telecom, South Korea's largest phone company, may need new SIM cards after the telco was hacked and its central database of SIM data was compromised. The company hasn't handled its scandal well, with half of the country now at risk of SIM swap attacks and government surveillance, but finally spluttered out an apology. Here's a timeline of how the breach went down. (via Korea Times)

U.K. grocery store hacks affecting shelves: The cyberattacks targeting U.K. retail and grocery giants, including the Co-op and Marks & Spencer, are reporting ongoing disruption and shelf shortages. Some food stuffs are being rationed at some more remote locations. Orders are still paused following what's been reported as a ransomware attack, so expect this to affect a lot of people's personal information, as the disruption is expected to last for some time. (via Reuters ($))
A photo of a Co-op store with shelves largely empty from fresh produce.
~ ~

THE HAPPY CORNER
And not a moment too soon... It's time to leave your troubled week behind, for this is the happy corner.

A Florida bill that would have required social media companies to build an encryption backdoor for accessing their users' accounts has been "withdrawn from consideration" in the Florida House, not long after the Florida Senate passed the bill. The EFF called the bill "dangerous and dumb," which says it all, really.

Denver will stop using Flock cameras, much to the delight of some. Flock cameras are controversial due to privacy concerns and fears over cooperation with immigration authorities, and so the Denver council has voted to stop using them altogether.

Anyone fancy hacking some facial recognition cameras? I hear path traversal bugs are all the rage these days... (via @da_667)
@da_667 wearing an electronic mask with a scrolling LED display, which reads: "../.../.../etc/passwd" signifying a path traversal bug.
And finally, this week, keep this excuse in your back pocket when you're told you're not getting that new hire any time soon.
The Random Recruiter tweet: "If the Catholic Church can pick a new Pope in 24 hours, you can fill your software engineering role without dragging it out for three months."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet Lord Meow (the Rt. Hon.?), who rules over his human master and acreage. All hail Lord Meow, chief advocate of good security and passkey defender. Long live Lord Meow and MFA All The Things! Thanks so much to Tapas for sending in!
Lord Meow is a ginger cat who's seen relaxing with his paw out stretched on a blanket.
Keep sending in your cyber-cats (or a non-feline friend!) The reservoir of cyber-cats is refilling but we're still in a drought. Drop a photo and name of your cyber-cat or friend by email, and they will be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's it for this busy week in infosec! As always, please reach out by email if you have anything to share for the newsletter, like a cyber-cat, or if you just want to say hello.

On a personal note, I want to say thank you so much for taking the time to respond to my newsletter survey over the past few weeks. Your responses, feedback, and your hundreds of comments, above all, were incredibly kind and supportive; it really means a lot. I look forward to writing this newsletter every week, and I'm excited for what the future holds.

Off to surf some interwebs,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — may 4 edition

✇~this week in security~ Archive Feed
this week in security — may 4 edition
UK retail giants hacked, RSA Conference 2025, Signalgate gets so much worse, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 18
View this email in your browser | past issues | RSS

~ ~
BEFORE WE START...

Hello cyber friends! A personal appeal from me before we dive in this week. If you haven't yet, please take my reader survey, it only takes a minute or two.

I've been writing ~this week in security~ for almost seven years and it's a labor of love. I can't tell you how much I enjoy writing this newsletter each week, as much as I hope you enjoy reading, too. But the newsletter is increasingly costing more and more to run. Your responses will help to ensure that this newsletter is sustainable for the long term.

As a privacy-minded newsletter, I don't track email opens or link clicks, so your survey responses are the only way for me to understand how I'm doing, how I can serve you better, and to look ahead towards potential future offerings. Please take a minute to fill out my reader survey; I plan to close on May 10, but you can always reach out by email, too.

Thank you so much, really. Your support means the absolute world to me.

Right, let's get going!
~ ~

THIS WEEK, TL;DR

U.K. retail giants hacked by ransomware gang
BBC News: We start in the United Kingdom, aka my OG homeland, where retail giants Co-op and Marks & Spencer have reported intrusions and are trying to regain control of their networks. The situation is messy, but it looks like the DragonForce ransomware gang, potentially with the help of Scattered Spider — whose tactics involve initial access and social engineering — have taken credit for the attacks. The hacks are causing havoc and affecting grocery store shelves. News of the hacks started with M&S, which said it's experiencing ongoing internal disruption after it pulled much of its order systems offline. Then another major retailer, the Co-op, said everything was fine... until it wasn't, only confirming its cyberattack was in fact a data breach after the BBC reported that the DragonForce gang told its reporters that they stole customer data on some 20 million people. Harrods, another major U.K. store, was also targeted, but no word yet on any successful intrusions there. As @GossiTheDog writes in a blog post, while folks are at the RSA Conference thinking about "quantum AI cyber mega threats," big firms are ignoring the basics, and getting pwned by highly skilled and capable "advanced persistent teenagers."
More: Bloomberg ($) | Bleeping Computer | NPR | The Guardian | DoublePulsar ($) | @GossiTheDog posts
A screenshot from the BBC News article, which reads in part: "It also assured the public that there was 'no evidence that customer data was compromised.' The cyber criminals claim to have the private information of 20 million people who signed up to Co-op's membership scheme, but the firm would not confirm that number. The criminals, who are using the name DragonForce, say they are also responsible for the ongoing attack on M&S and an attempted hack of Harrods."
DHS' Noem at RSA: CISA needs to get back to 'core mission'
Cyberscoop: Speaking of the RSA Conference, that was a thing this week. U.S. Homeland Security Secretary Kristi Noem used her keynote at the industry-focused cyber-fest to urge Congress to reauthorize a law that encourages businesses to share cyber threats with the federal government. Not everyone is clearly thrilled about that, given DHS' role in rendering U.S. citizens to third-countries and huge cuts at cybersecurity agency CISA, which are still ongoing. This is in the same week that the Trump administration said it's planning to cut half a billion dollars from CISA's budget, weakening the agency even more than it's already has been, at a time when lawmakers' top committee officials aren't even sure that CISA can carry out its core mission in the face of so many layoffs. Noem faced a mild, tepid crowd, per @kevincollier and @gregotto, who live posted the keynote. As I posted this week, it's worth remembering that the cybersecurity industry is not the same as the cybersecurity community.
More: The Record | Fast Company | Cyberscoop

JPMorgan Chase CISO fires warning shot ahead of RSA Conference
SecurityWeek: It's worth noting this yarn from @ryanaraine, who blogged about JPMorgan Chase's top cyber chief basically calling out the horrid state of cybersecurity today ahead of the big annual RSA meet-up. A key line here: "Fierce competition among software providers has driven prioritization of rapid feature development over robust security." In short, cyber is moving at such a pace where profits are put ahead of quality control and security (a bit rich coming from JPMorgan, excuse the pun, but still), saying that the "pursuit of market share at the expense of security exposes entire customer ecosystems to significant risk and will result in an unsustainable situation" for the economy. All to say, AI-this and AI-that isn't going to save us from massive hacks, like the incidents we're seeing in the U.K. retail sector right now. Per Naraine, much of this fell on deaf ears at RSA where the "gravitational pull of AI-powered hype is unmistakable."
More: JPMorgan Chase | Risky.biz

TM SNGL, the obscure Signal knock-off used by Trump officials
Micah Lee: Let's check in real quick on the state of cybersecurity in the Trump adminis... oh no. Can it get worse? Yes, yes, it actually can. As a reminder, Michael Waltz and other senior cabinet-level officials were said to be using Signal to share classified war plans... which, granted, Signal isn't cleared for government use but at least it's still Signal, right? Well, not quite, because it turns out a Reuters photographer snapped a photo of Waltz using his phone during a cabinet meeting and — sorry, I don't shout very often but... IT'S NOT EVEN SIGNAL... *sound of muffled screaming into a pillow*. In short, TM SGNL is an Israeli-developed unlicensed Signal rip-off with eye-wateringly bad security (including hardcoded credentials). The whole point of the app is to allow its users to save a copy of their messages to a central server... which... yes, defeats the very point of Signal. At least (he says, while evidently holding on to my last shred of sanity) this solution appears to be an attempt by the government to follow federal records-keeping laws, alas, these ostensibly encrypted messages are then archived in something like a Gmail account. (I can't even anymore.) Not to stress you out too much, but Tulsi Gabbard, Marco Rubio, and JD Vance are also seen in Waltz's Signal chats, per Reuters.
More: 404 Media ($) | Electrospaces | New York Times ($) | @kevincollier
A photo from the White House cabinet room, which shows Michael Waltz using his phone, with a knock-off version of Signal on the screen,
~ ~

THE STUFF YOU MIGHT'VE MISSED
Can the U.S. government seize domain names?
Rob Ricci: Yes, in short, the U.S. can (and does) seize domain names on the semi-regular with court orders, especially for cybercrime operations. @ricci goes into how the process can work, albeit with caveats. It's worth thinking about from a threat model point-of-view, especially from a legal and jurisdictional perspective.

Microsoft: No plans to fix Windows bug allowing logins with revoked passwords
Ars Technica: Revoking a password is meant to be a surefire way of preventing access to a user's account when credentials are stolen. But a bug in how Windows handles remote desktop logins allows anyone to login using a since-revoked credential. Microsoft told Ars that it would "be in touch" if it had anything to share — so, no fix just yet. Instead, Microsoft updated its pages to caution, in red lettering, that if a user changes their password in the cloud and the cached verifier hasn't updated, this "means that they can still access their local machine using their old password." Cue area security buff @wdormann: "It doesn't make sense from a security perspective."
A screenshot from Microsoft's site, which reads: "Caution When a user performs a local logon, their credentials are verified locally against a cached copy before being authenticated with an identity provider over the network. If the cache verification is successful, the user gains access to the desktop even if the device is offline. However, if the user changes their password in the cloud, the cached verifier is not updated, which means that they can still access their local machine using their old password."
Developer leaked private API key for SpaceX, Tesla LLMs
KrebsOnSecurity: Huge facepalm here after an employee at Elon Musk's AI company, xAI, exposed a private key on GitHub that for the past two months could've allowed anyone to query private custom-made large-language models used for handling internal data at Musk's companies, including SpaceX, Tesla, and X. Researchers at GitGuardian found the exposed key and notified the employee and later xAI directly — but was told to report the exposure through HackerOne (yeah, that happened!). While many awe and ahh at AI, it's still unraveled by *checks notes* an exposed private key. This wouldn't be the worst breach in the world if Musk wasn't hellbent on feeding much of the U.S. government's stores of citizen data into his own AI systems.

How Riot Games is fighting the war against video game hackers
TechCrunch: Here's a really interesting long-read on how Riot Games, the company that makes Valorant and League of Legends, fights its war against cheaters and cheat developers. Video gaming is big business, and so is the game cheating industry that gives gamers an unfair advantage. Look, I'm no gamer, but I learned a ton in this @lorenzofb story about how cheaters actually hack games (including funneling in-game memory to an entirely separate computer) — but also how they can get caught.

Dating app Raw exposed users' location data and personal information
TechCrunch: Dating app Raw, which this week announced plans for a hardware wearable that claims (without evidence) to track a partner's emotions, claims to use end-to-end encryption. But when I ran the app through a network traffic analysis tool, there was no evidence of end-to-end encryption — but there was a leak exposing users' precise location data to the open web. The company fixed the bug soon after I contacted the company's co-founder. (Disclosure alert: I wrote this story.) My take is that if I could find this bug in less than 20 minutes and I'm a journalist for crying out loud, I dread to think who else could've found this before me.
A screenshot from TechCrunch, which shows a dummy account set up by me with its location data exposing to the web in the form of a public JSON API response.
Inside the efforts by North Korea to steal your job
Wired ($): An absolute belter of a story looking at how North Korean hackers and spies use AI and deepfakes to dupe unsuspecting companies into hiring them, thinking they're ordinary, non-sanctioned individuals. Although still crude for the most part, these techniques are getting better — and in any case, they're working now, even as the technology improves. This story gives a good fly-on-the-wall look at how the interview process works with some of these would-be North Korean hires. Remember: If you suspect a North Korean spy, ask them to say something rude or mean about Kim Jong Un... and see if you can count to three before they vanish and log off. Also: Sentinel Labs has a good report on what it's like to be targeted as a security company, and what to look out for.

Bots be warned of zip bombs
Ibrahim Diallo: Bots are everywhere, probing for flaws or scraping the internet and feeding them into AI systems. But Ibrahim Diallo has an idea: Zip-bombs, or highly compressed files that when opened can expand into a huge file that can overwhelm a bot's machine. When Diallo detects a bot, his website serves a small file that the bot is happy to accept and then... disappears off the web when the bot invariably crashes. Consider at your own risk, of course.
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Governments lead the zero-day way: Google said that out of the attributable zero-days it's seen during 2024 (that is, the exploits it can definitively link back to certain threat actors), most of them are in use by governments and commercial surveillance vendors (which sell almost exclusively to governments). It's worth noting a fair percentage of zero-days are also actively used by cybercrims (think ransomware and extortion attacks). (via Google, TechCrunch)

Salut, l'unité 20728 du GRU: The French government confirmed this week (en français) that the Russian GRU's noisy hacking unit APT28 (aka Fancy Bear) were behind a series of cyberattacks targeting France — including the 2024 Paris Olympics. The French also name-dropped a new Russian GRU unit, 20728, linked to APT28. Wired ($) notes the newly disclosed unit is based in the southern Russian city of Rostov-on-Don and operates out of an "information research center." (via French government, @johnhultquist)

FBI conducts dozen-plus operations: At RSA, an interesting tidbit (albeit light on details): the FBI and its partners carried out 17 "joint seamless operations" against nation state actors and cybercriminals globally of late. To put that into context, Microsoft said at RSA that it's tracking about 1,500 major threat actors worldwide, including around 600 linked to nation states, 300-plus criminal groups, and about 200 groups related to information operations. (via @martinmatishak)
Martin Matishak tweets: "Speaking at #RSAC, Microsoft's Tim Maurer says the company's threat intel team 'has tracked about 1500 threat actors.' Over 600 linked to nation state actors. 300-plus criminal groups. 200-plus IO groups, some of are being tracked where we don't have enough information yet..." followed by another tweet: "The @FBI 's Brett Leatherman: 'The FBI and our partners conducted what we call 17 joint seamless operations against nation state and criminal cyber actors globally'."
Car subscriptions raise your surveillance risk: Hands-free driving systems, heated seats, and car cameras: all of these technologies enable police to obtain gobs of information about you, where you go, and how you get there. Wired ($) found that cops are regularly tapping internet-connected cars that have subscription features, including through tower dumps. @dell has a handy chart that shows how much surveillance vs. what car. Remember, @kashhill also did some incredible reporting last year on how car makers are using and selling your vehicle data to raise your insurance rates. (via Wired ($), @couts)

Inside a credit card fraud ring: An investigation run by Norwegian outlet NRK, along with BR and Le Monde, included secretly monitoring a credit card fraud gang for a year to understand how they operate, including how the scammers stole more than 884,000 payment cards captured from unsuspecting people worldwide in a handful of months. This is a great story about sheer patience and incredible OSINT, and how they identified the scammer. (via NRK, @martingund tweets)
~ ~

THE HAPPY CORNER
Finally, we can leave all that hot mess of a week behind. This is the happy corner.

Firewall admin (aka "slayer of packets")? It's time to update your resume accordingly.
Dio9sys post: "Firewall admin? Oh, you mean edge lord?"
For those who're heading home after RSA, @wbm312 has your RSA buzzword bingo card ready to fill out.

And, lastly this week. Let's check in quickly with the good folks at the EFF, who have an open letter in support of former CISA director Chris Krebs, who faces a retaliatory federal investigation by the Trump administration. The letter was initially published with dozens of major names in security, and now has over 400 signatures.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cats are Charles and Ada, who can be seen here 'troubleshooting' the office printer... or hacking it, more like! Thanks so much to Becky for sending in!
I hate to ask even more of you but... ⚠️ please send in your cybercats ⚠️ or a non-feline friend! The bank of cybercats is running low! You can drop a photo and name of your cyber-cat or friend, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
This was... a very, very busy one! Thanks for reading all the way through. I'll be back next week as usual with everything you need to know.

Please do get in touch by email if you have anything to share with me for the newsletter, or just want to say hi. Also, please do drop your feedback in my survey if you can!

See you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — april 27 edition

✇~this week in security~ Archive Feed
this week in security — april 27 edition
Signalgate 2.0, Easterly warns politicizing cyber is 'dangerously degrading', Microsoft Recall returns, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 17
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Hegseth had unsecured internet line in Pentagon office to connect to Signal
Washington Post ($): We have to start here this week because, sigh... *pinches bridge of nose* ...folks, he only went and did it again. Several weeks after the U.S. Secretary of Defense Pete Hegseth shared sensitive war plans in a Signal group chat that mistakenly included a journalist, the Post and the AP found Hegseth was also sharing war plans over Signal that included his wife and brother, among others. He was also using a "dirty line" (aka a regular internet connection), but from his official office in the Pentagon in order to use Signal on its desktop app, leaving commenting cybersecurity and records-keeping experts aghast. Signal is great, don't get me wrong, but it's not cleared for government use, crucially because the devices that Signal runs on (you know, regular phones) are more susceptible to malware and spyware than the much-more hardened systems designed for classified use. What a mess... and this raises more questions about government security (or lack thereof) with sensitive information. If I had a nickel for every scandal involving the top U.S. defense official sharing war plans on Signal, I would have at least two nickels.
More: Emptywheel | New York Times ($) | NPR | TechCrunch
public health cat guy on Bluesky, which reads: "this is literally us now," with two screenshots from Veep, with an assistant saying, "Madam President, Chinese hackers breached the NSA firewall earlier this morning," and the president says, "Any chance they fixed the Wi-Fi?"
Ex-CISA chief: Trump actions risk 'dangerously degrading' U.S. cyber defenses
Jen Easterly / LinkedIn: Former CISA boss Chris Krebs has been in the news of late after Trump ordered a retaliatory federal investigation into him for publicly disputing Trump's false claims of electoral irregularities during the 2020 presidential campaign. Yet, we heard practically crickets from the cybersecurity industry, fearful that Trump will come after them as well. Now, Krebs' successor at CISA, Jen Easterly, has posted on LinkedIn with a pointed message but without naming names: Trump's actions are putting the nation's cyber defenses at risk of being "dangerously degraded." Easterly's comments are really worth the read as folks head to RSA this week; and I'd encourage you to take the time. "If we fail to stand up for leaders being punished for telling the truth, for doing their jobs with honor—then we're not leading; we're calculating." Easterly said that as folks head into RSA, now is the time to think about what brings us all together. (Psssts loudly: Easterly is talking about people!)
More: New York Times ($) | Reuters ($) | Cybersecurity Dive | All Rise News

Two major health-related breaches hit millions across the U.S.
TechCrunch: Two of the largest healthcare-related data breaches of the year (so far; we're still only in April!) have come forward. Blue Shield of California revealed that it had been sharing personal and some health-related information of more than 4.7 million patients with Google over a period of several years, thanks to misconfigured website trackers. A ton of healthcare firms got caught by this during the pandemic when telehealth rocketed, not that it excuses it. Google wouldn't say if it would delete the data, but was happy to use the information for advertising against affected patients. Meanwhile: Connecticut's Yale New Haven Health system, the state's largest, told me this week that it's not disputing that it was hit by ransomware (in other words, it was hit by ransomware) during a March cyberattack and that it's notifying 5.5 million people of the breach regardless. (Double disclosure: I wrote both of these stories!)
More: Yale News | The Register | San Francisco Chronicle
~ ~

THE STUFF YOU MIGHT'VE MISSED
Crypto scams and losses lead FBI's annual cybercrime report
NBC News: Scams involving cryptocurrency were top of the FBI's annual report [PDF] on cybercrime across 2024. The feds say scam victims were mostly folks who are 60 and older, which lost a collective $4.8 billion in crypto scams, including pigbutchering. It's pretty bleak reading, but probably a reminder to especially folks that unless you're actively involved with cryptocurrency right now, you're probably better off that way — at least for the sake of avoiding scams. More via @molly0xfff.
Google won't ditch third-party cookies after all
Ars Technica: Well there goes the best part of a half-decade's worth of work... Google has scrapped its long-standing plans to move away from third-party cookies. In 2019, the advertising giant (75% of Google's revenues comes from advertising) said it was going to pull the plug on third-party cookies by rolling out its Privacy Sandbox. In the end, making money off of all of our data seems far more important to Google than, well, anything else apparently. A good blog from Lukasz Olejnik, with a quick read on what this means.

Microsoft Recall is back: Slightly better, but not by much
DoublePulsar ($): Remember that time Microsoft rolled out a software update that would screenshot everything on a user's display, including passwords and credit card numbers, and allow them (or malware, naturally) to access all of that data at any point in time? Microsoft called it Recall, and it went down with customers as you'd expect — which is to say, not great. Now it's back, and at least Recall is opt-in, which is better than what it was, and while somewhat improved on the security front, it's not by much. The product still presents significant security risks. The good sir @GossiTheDog has a fun read on this. Meanwhile... this could be fun to watch:
Scott Wilson post on Mastodon: "Attention #infosec nerds! For a while now, I have owned the Domain name microsoftrecall.com. What should I do with it? Use it for good or for evil? Or just shenanigans?"
Yale student exposes data leak in college dating app
Alex Schapiro: Excellent research and findings from Alex Schapiro, who found that a student-founded dating app called Cerca is a hot mess of security bugs that exposes the private information of thousands of its users. Schapiro handled this like a pro and reached out to privately disclose the issue, but Cerca didn't alert its users. Schapiro's first line says it all: "Startups Need to Take Security Seriously." Yale News also wrote up. We need more students like Schapiro, and fewer who are focused on making a quick buck at the expense of their fellow students' privacy.

Hacking a smart bike to make it work again
Francisco Presencia: Here's a fun read on hacking a dead e-bike and reviving it back to life. Turns out in this case, the bike's lights wouldn't work without the app (me: 😑), so @FPresencia fixed it and posted the results. What would've otherwise been a hunk of wasted metal got a much-needed recycle.

North Koreans created U.S. firm to dupe crypto developers
Reuters ($): Regular readers know that stealing crypto to make nukes is the primary goal of the North Korean regime. Now, its cyber spies are getting even more brazen by setting up actual U.S. entities in violation of sanctions, with the aim of duping crypto developers into installing malware to steal their funds, per researchers. Three businesses were identified, and one of them's been seized by the FBI already. Due diligence is important here: North Koreans are everywhere these days — and they're getting really good at infiltrating companies. In related news: Okta's threat unit has a blog post on how North Koreans are using AI services, and Trend Micro looks at the overlaps with Russian infrastructure.
An FBI seizure notice, which reads: "This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant issued by the United States District Court for the Northern District of Texas as part of a law enforcement action against North Korean Cyber Actors who utilized this domain to deceive individuals with fake job postings and distribute malware."
~ ~
PSST! TAKE MY SURVEY!
 
Please take my short feedback survey! It takes only a minute or two.

As ~this week in security~ rapidly approaches its 7-year anniversary, I would love to hear from you about this newsletter, how it can help you, and to look ahead to potential future offerings. As a privacy-minded newsletter, I don't track email opens or link clicks, and so your feedback and responses are insightful for me to understand how I can better serve you. 
 
And, thanks to everyone who has left feedback so far; it's greatly appreciated.
...and... while I'm here humbly asking for a moment of your time...
DONATE TO SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Employee snooping tool spills millions of screenshots: Employee monitoring snooptech WorkComposer, which monitors and takes screenshots of what employees do on their computers, left an open Amazon S3 bucket exposed to the internet containing 21 million unredacted screenshots from over 200,000 unique users. (Hmmm, for some reason the 'Microsoft Recall buzzer' just went off.) Another reason not to use these horrendously invasive snooping tools, because now all of WorkComposer's corporate customers have to file data breach disclosures... (via Tom's Guide, Reddit thread)

Top African, Korean telcos hacked: Two major telcos revealed hacks this week. MTN Group in Africa said a hacker claimed to have access to some internal systems, although few details about the breach itself. Meanwhile, South Korean phone giant SK Telecom said some customer data was leaked due to malware but said it's replacing SIM cards to some 23 million users as a result. (via MTN Group, SK Telecom)

U.K. moves to block Global Titles abuse: Sticking with phone networks for a hot second, the U.K.'s comms regulator said it's put in place new measures to block the misuse of global titles, a critical technology used by phone companies for routing of messages and other data across the world. Global titles have been misused by malicious actors (think surveillance vendors) to intercept messages, calls and location data. Ofcom has more on what measures it's putting in place. (thanks to @campuscodi for spotting)

This is not just any 'cyber incident': U.K. retail giant Marks & Spencer says it's been hit by an unspecified cyberattack, which hit grocery order pickups and some contactless payments. Now, per a note with London's stock exchange, the retailer has stopped customers picking up orders amid ongoing delays and outages. M&S reported 32 million customers last year, so... welp? (via BBC News)

BreachForums is seized ...back again offline: The notorious cybercriminal forum BreachForums mysteriously dropped offline, but appeared to have been revived on a Finnish domain, alleging that the previous domain had been seized by the FBI (which, if true, would be at least the third time in BreachForum's history) and that the forum had to start again. But not everyone's convinced. Could the new site be a police honeypot? BreachForums' new domain didn't last long, presumably thanks to Finnish authorities. (via OSINT Team ($), @cR0w)

Alleged Scattered Spider hacker extradited: Tyler Buchanan, a not-so-wee lad from Scotland, was extradited from Spain to the U.S. this week to face justice for alleged involvement in the Scattered Spider hacking group, which ripped through dozens of major tech giants (and the occasional casino) during a year-long hacking spree. We may end up hearing more specifics about the hacks themselves when the case goes to trial — assuming it does, of course, and that Buchanan isn't either pardoned or disappeared, which seems largely the two judicial outcomes in America these days. (via Bloomberg ($))

TP-Link faces natsec probe: And lastly, also from Bloomberg ($), router maker TP-Link is under the national security spotlight as it faces an apparent criminal antitrust probe in the United States. The scrutiny began during Biden's term, and is said to focus on its tech and national security risks to large tech companies. For reference, it kinda sounds like the government is trying to "pull a Huawei," of sorts. (via Bloomberg ($), @Kate_OKeeffe)
~ ~

THE HAPPY CORNER
Welcome, welcome, welcome. This is the happy corner, and the vibes are zen. Now that the weather is getting a little warmer here on the east coast, it's a lot easier to wind down and touch gra...
Hacker Memes post on Mastodon: "people keep telling me to touch grass but my computer says that file already exists," followed by a photo of Maurice Moss (The IT Crowd) holding back laughter sitting behind a computer desk.
Oh, never mind then.

It's been awhile, but here's the latest update to What Can Doom Run On? and this week it turns out it's... own custom operating system? And it's called... TacOS?! This is just brilliant and what looks like an incredible amount of work. Truly amazing stuff.
A screenshot of Doom running on a custom operating system called TacOS.
Moving on... this is probably the worst kind of printer jam.

And lastly, this week. You wouldn't pirate a font... or... would you? It turns out the now-infamous anti-piracy campaign may have itself used a pirated font. Absolutely no notes here, this is chef's kiss perfect.
A photo in the style of a "You wouldn't steal a car," that reads, "You wouldn't pirate a font."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Murphy, who looks absolutely exhausted after a long-day convincing executives to switch on MFA. Not 98%, not 99%, but 100% across the board. Keep up the good work, Murphy. Thanks so much to Matt S. for the update!
Murphy is a light and dark brown tabby kitty asleep and stretched out on a blanket.
Please send in your cybercats or non-feline friends! You can email at any time with a photo and name of your cyber cat (or friend) and they'll be featured in an upcoming newsletter. If you've sent in before, you're welcome to send in an update!
~ ~

SUGGESTION BOX
And that's about as much as there is in the news. Let's see if we can avoid another national security leak from within this week? What a mess...

As always, thanks so much for reading. It's a joy to bring this newsletter to you every week. Feel free to get in touch by email, it's good to hear from you, and please do let me know what you think about the newsletter in the survey if you haven't already.

Catch you later,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — april 20 edition

✇~this week in security~ Archive Feed
this week in security — april 20 edition
Whistleblower warns of NLRB data exfiltration, Chris Krebs vows to fight federal probe, CVE funding secured (for now), and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 16
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Whistleblower describes how DOGE may've taken sensitive federal data
NPR: We start this week with absolutely belter reporting from NPR's @jennamclaughlin on a whistleblower's report from within the IT department of the National Labor Relations Board (NLRB), who provided revelations about DOGE's activity at the agency to federal and congressional investigators. My blurb here just isn't going to do the story justice; you have to read it through (or however you want to consume). This is ultimately a story about DOGE as an insider threat, not just at an agency that has gobs of data capable of holding powerful billionaires accountable for their oft-terrible actions. A big charge is that DOGE exfiltrated sensitive data from the agency (for reasons as yet unclear), while disabling logs, designing backdoors, and potentially exposing attempts by a Russian-based IP address to login to the NLRB's systems. It's not clear where the exfiltrated data went in the end or who has access to it, but from a workers' rights perspective, the threat is "immediate and existential." Meanwhile: remaining staff at the U.S. Defense Digital Service, which built fast tech fixes from inside the Pentagon, plan to resign this month en masse, effectively shutting down the decade-long program.
More: NPR | NBC News | Reuters ($) | @jennamclaughlin
A screenshot from the NPR story, which reads: "The new revelations about DOGE's activities at the labor agency come from a whistleblower in the IT department of the NLRB, who disclosed his concerns to Congress and the U.S. Office of Special Counsel in a detailed report that was then provided to NPR. Meanwhile, his attempts to raise concerns internally within the NLRB preceded someone "physically taping a threatening note" to his door that included sensitive personal information and overhead photos of him walking his dog that appeared to be taken with a drone, according to a cover letter attached to his disclosure filed by his attorney, Andrew Bakaj of the nonprofit Whistleblower Aid."
Chris Krebs vows to fight Trump's federal investigation
Wall Street Journal ($): Former CISA director Chris Krebs is leaving SentinelOne to fight back against the Trump administration's federal investigation into him (and others), amid the ongoing use of the executive branch to retaliate against Trump's critics and opponents. The WSJ had the scoop; SentinelOne confirmed in an updated statement, which didn't exactly (or explicitly) throw its support behind him. The response from the cyber industry (read: wants to make money) was largely silence vs. the cyber community (read: wants to make the world better) which was far more vocal, and journalist Brian Krebs (no relation) does a grand job of breaking down what's happening. But as some are noting, if not to speak up now, then when? The massive chilling effect on cyber at very least has the potential to be huge — then, who's going to be targeted after Krebs?
More: Chris Krebs LinkedIn post | Luta Security | KrebsOnSecurity | Rud.is | Cyberscoop | Forbes ($)

CISA funding chaos threatens future of vulnerability database
Wired ($): Moving on from governme....oh come on. OK, let's keep this brief. Hours before the all important CVE Program's federal funding was about to expire, CISA jumped in at the last minute to save the day with a funding reprieve... sort of... not before a somewhat organized panic scramble resulted in offshoot efforts to save the all important CVE database of disclosed security vulnerabilities. One of those that popped up includes the new CVE Foundation, which aims to "secure the future" of the program. The whole "will it/won't it shut down" this week was a reminder of how important tracking vulnerabilities is for its relatively small cost (of about ~$30 million), but that these days the federal government won't necessarily help for the long term. Thousands of security bugs are discovered every year and noted in the CVE database, but a long-term and stable funding solution still hasn't been found.
More: Nextgov | The Register | Reuters ($) | Bleeping Computer | @k8em0 | @jgamblin | @ddimolfetta posts

CISA warns of security fallout from Oracle Cloud breach
CISA: Just kidding, because whoever is still left at CISA (amid further reported cuts) put out an alert this week seemingly to handle Oracle's scandal (since the company is doing a two-thumbs up fantastic job of it /sarcasm) warning that companies who rely on Oracle's Cloud should take action because Oracle clearly isn't. Oracle has steadfastly denied a breach of its cloud... until it couldn't any longer... but even then is more interested in protecting its own reputation (which, I know, I wrote that and laughed) than helping its customers remediate from downstream bad-times. "The nature of the reported [Oracle] activity presents potential risk to organizations and individuals," writes CISA. If you haven't taken action, now would be a really good time. CISA has some advice for both organizations and end-users.
More: Cybersecurity Dive | The Register
~ ~

THE STUFF YOU MIGHT'VE MISSED
TLS/SSL certificates will be limited to 47 days in 2029
Digicert: CA/Browser Forum, a body of web browser makers and TLS/SSL certificate providers, have voted to cut the maximum lifespan of newly issued TLS/SSL certificates to just 47 days by mid-March 2029. The argument was that shorter lifespans will limit the abuse of stolen certificates, which can be used to impersonate websites and online services. The Register has some extra yarn for context.

Silicon Valley crosswalk buttons hacked to imitate Musk, Zuckerberg, Bezos
TechCrunch: A handful of those audio-enabled traffic crosswalk buttons across Silicon Valley were hacked to include AI generated voices to sound like billionaire bosses Elon Musk, Mark Zuckerberg, and Jeff Bezos. All signs point to hacktivism, and default passwords — yes, in the year of 2025. (Disclosure: I wrote this story!) More also from Palo Alto Online, plus @deviantollam explainer.

Android devices will self-restart for security
Android: Per Google's latest release notes, Android devices will receive a security update that will self-restart devices after three consecutive days of non-use. The idea goes that phones locked from boot-up are more difficult to crack into than phones that have been unlocked by the user at least once. Apple rolled out a similar feature for iPhones and iPads some months ago. 9to5Google explains a little about how this feature works.

23andMe bankruptcy draws congressional probe over data fears
The Record: U.S. House Oversight lawmakers are looking into the bankruptcy proceedings of 23andMe, the failed genetics testing firm that lost control of literal gobs of data in 2023 during a massive breach. The fears include a sale of genetic and DNA data to China, or other adversarial nations, and may ultimately prompt a national security review, per Bloomberg ($). As for what the lawmakers plan to actually do (if anything) remains to be seen.
~ ~

OTHER NEWSY NUGGETS
Internet's dumpster fire hacked: 4chan, one of the grossest corners of the internet, was hacked and much of the online forum remains offline. Internal data was leaked, including IP addresses about ostensibly anonymous users and email addresses of moderators and "janitors." Predictably, the hack itself became a meme. One janitor confirmed to TechCrunch that the data appears real. (via Wired ($) | Daily Dot)

New Apple zero day under attack: The fruit-themed tech giant rolled out fixes for two zero-day bugs, which Apple says may've been "exploited in an extremely sophisticated attack against specific targeted individuals on iOS." But because the bug is in CoreAudio, an audio component used across various Apple platforms, a bunch of other products are affected — including Macs, Apple TVs and Vision Pro headsets. No idea who's behind this particular campaign, except to note that Google's researchers focused on investigating government-backed threats discovered the bug... so, go figure. (via Apple)

Google subpoena? Nope, sneaky phish: Here's @nicksdjohnson disclosing what looks like a very smart, advanced phish that relies on tricking an unsuspecting victim into thinking Google was notifying them about being subpoenaed for account information. Even though the email was cryptographically signed as coming from Google itself, it's actually an attempt to steal Google account credentials. Good threat thread here. Google reportedly plans to fix the issue on its end at least. Be careful out there! (via @nicksdjohnsom, EasyDMARC)
Nick.eth tweet: "The first thing to note is that this is a valid, signed email - it really was sent from no-reply@google.com. It passes the DKIM signature check, and GMail displays it without any warnings - it even puts it in the same conversation as other, legitimate security alerts," followed by a screenshot of a Google-looking security alert in Gmail that appears to look like Google alerting the user that they received a subpoena for their information.
EFF blasts Florida anti-encryption bill: Florida state senators voted 21-0 to advance an anti-encryption bill for a Senate floor vote, which — if passed — would allow law enforcement in Florida to demand access to a user's social media account with a subpoena (which are issued by police and usually aren't signed by a judge, unlike warrants). The bill was presented under the guise of child safety, but the EFF blasted the bill as "dangerous and dumb." Personally, I think any lawmaker who advocates for encryption backdoors should first be required to open up their own devices and online accounts for inspection. (via TechCrunch, Florida Politics)

Bags o' breaches: Round up, round up, we've got breaches to blast through. Govtech giant Conduent finally confirmed hackers exfiltrated data from its systems during a January cyberattack. Car rental firm Hertz also reported a breach that included customers' personal information, driver's license data, and payment card information, affecting at least 100,000 people (but allegedly not millions, per a spokesperson). Insurance firm Lemonade confirmed that a bug on its website exposed driver's license numbers. And, live events company Legends International said thousands of employees and customers had personal data stolen, including Social Security numbers and more. (via StateScoop, The Record, SecurityWeek)
~ ~
🚗 HOW'S MY DRIVING? 🚗
 
~this week in security~ will soon mark its 7-year anniversary and I'd love to hear from you to get feedback about what you like about this newsletter, how it can help you, and to look ahead to potential future offerings.

Please take this short survey! It can take as little as a minute or two.

As a privacy-minded newsletter, I don't track email opens or link clicks, so your feedback is incredibly helpful for me to understand how I can serve you better.

Thank you for reading ~this week in security~!
~ ~

THE HAPPY CORNER
Rejoice! It's the happy corner. Only good vibes here on out.

That moment when you realize you actually have quite a lot in common with the Linux kernel.
void priestess doll post: "yeah same, linux kernel," followed by a screenshot from the Linux kernel code, which reads: "Dazed and confused, but try."
A much-needed bonus cybercat after a stressful week in the world.

And lastly, this week, some wise words from Skeletor.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's two-for-one cyber-cat-kitten special is Westley (gray) and Princess Buttercup (white and gray), who are incredibly cute but you might not think that when you realize they swiped your passwords and your Social Security number... oh, and your car keys for good measure. That's some effective cyber-catting! Thanks so much to Sean K. for sending in!
Westley (gray) and Princess Buttercup (white and gray) are two very cute fluffy kittens cuddling with each other on a couch.
Send in your cybercats or non-feline friends! You can email at any time with a photo and name of your cyber cat (or friend) and they'll be featured in an upcoming newsletter. If you've sent in before, you're welcome to send in an update!
~ ~

SUGGESTION BOX
That's it for a busy week in... well, pretty much every direction. A very happy Sunday to you, and hope you have a great rest of your week.

Please drop me a note by email if you have anything you want including in next week's edition. And if you missed the survey, I'd love any feedback you can share!

Diving back into cyber land,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — april 13 edition

✇~this week in security~ Archive Feed
this week in security — april 13 edition
Trump orders federal investigation into Chris Krebs, Apple backdoor case can be public, China acknowledges Volt Typhoon link, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 15
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Trump orders federal investigation into former CISA director Chris Krebs
Nextgov: Trump this week signed an executive order initiating a federal investigation into Chris Krebs, the first and former director of cybersecurity agency CISA. Trump also revoked Krebs' security clearance. Trump fired Krebs in 2020 when Krebs, a Republican, publicly debunked Trump's false claims of election irregularities, and apparently never got over it. News of the president retaliating against a former government official was in itself alarming (a separate executive order targets a former DHS whistleblower). But the reaction of the cybersecurity industry's top companies was, suffice to say, lackluster and disappointing. The response from SentinelOne, where Krebs currently works, was to release a statement shilling its AI product and saying it'll "actively cooperate" with the government inquiry that also stripped some of its other employees of their security clearances. Meanwhile, Reuters ($) did a great service by asking around and found absolute crickets from the wider cybersecurity industry. Out of more than 30 firms contacted, not a single company provided comment. One cyber executive was clear: "If they are willing to crush Krebs, what do you think they'll do to me or others like me?" Only the Cyber Threat Alliance denounced the move to investigate Krebs and pointed to numerous falsities in the executive order. As the folks at the EFF say, it's "critically important for us to speak up" — and the window is narrowly closing.
More: White House | CSO Online | Reuters ($) | TechCrunch | @briankrebs | @ddimolfetta | @razhael thread
Chris Krebs tweet: an emoji of a finger pointing down towards an earlier tweet, which reads: "Honored to serve. We did it right. Defend Today, Secure Tomrorow. #Protect2020"
Hackers intercepted bank regulators' emails for over a year
Bloomberg ($): From one government fustercluck to another, now we've got our umpteenth U.S. government breach of the year. This time it's the little-known Office of the Comptroller of the Currency, which oversees compliance and regulations with national banks. Hackers intercepted over a hundred bank regulators' emails for over a year (though the number is said to be higher, perhaps as many as 150,000 emails), including "highly sensitive financial information" of the financial condition of regulated financial institutions. The OCC notified Congress of a "major" cybersecurity incident. Per the letter seen by Bloomberg, the contents of the emails are likely to "result in demonstrable harm to public confidence." Wooof. Let's not forget the Treasury was hacked by China quite substantially earlier this year.
More: OCC | Reuters ($) | SecurityWeek | The Straits Times

U.K. court says Apple backdoor case cannot be heard in absolute secret
BBC News: A little early nugget of good news: A ruling by the U.K.'s surveillance court (known as the Investigatory Powers Tribunal) ruled that the U.K. government's efforts to demand a backdoor in Apple's cloud (allowing U.K. officials to access any users' encrypted data anywhere in the world) can be held at least in part in public. The U.K. government demanded secrecy over the order, but Apple appealed, and details of the case — though not all of them — will be heard in an open court. Probably for the best, since efforts to keep the demand a secret failed, and in the process prompted widespread criticism and anger at the move. The court (which by nature handles highly secretive cases) itself pointed out, "we do not accept that the revelation of the bare details of the case would be damaging to the public interest or prejudicial to national security."
More: UK Justice | Press Gazette | Open Rights Group | @AdamWagner1
~ ~

THE STUFF YOU MIGHT'VE MISSED
Oracle's annotated data breach notice
The Register: Oracle's hack (the cloud hack, not the separate healthcare hack) gets The Register treatment, which annotated and marked up Oracle's poorly written "we weren't hacked!" statement but then goes on to state just what the hacker stole.

Canadian cops say they are not safe from spyware
CBC: A pair of Canadian cops said they were targeted, per an ongoing court case, while they were serving officers amid an investigation into a high-ranking Canadian police official. The cops say that not even police are safe from spyware — which, weird flex, but sure — but this also raises the wider point about there not being any laws in Canada regulating the use of spyware by authorities, despite ample evidence pointing to Canada itself being a spyware customer. (via @tek)

Europol report looks at ways scammers skirt biometrics
Europol: European cop shop Europol has a report out this week detailing all the weird and wonderful ways that hackers and scammers are trying to bypass facial recognition and other biometric checks, featuring — yes — an array of grumpy-looking 3D-printed faces — see below. (Anyone else grow up during the '90s and get extreme GoldenEye N64 vibes?) This report looks at the tradeoffs of what you have (biometric) vs. what you know (password). This report reminds me of that time @iblametom 3D-printed his own head for Forbes ($) to defeat a facial recognition system. Chef's kiss, no notes. (via @campuscodi)
A selection of 10 3D-printed plastic but realistic-looking faces of people, who've been used in biometric tech-fooling attacks. Image sources from Europol report.
Why diversity, equity and inclusion is key for a cyber safe future
CSO Online: The folks behind #ShareTheMicInCyber explore in this new op-ed the growing risk of blind spots in cybersecurity and weaker national security because of a shrinking talent pool (and a wider industry unwilling to stand up for its workers). Cyber threats come from all over the world, so having a worldly team (think diversity) can help see things that homogeneous teams can miss.

Password spraying attacks exploiting lax MFA
Rapid7: Speaking of passwords... of course, they're not perfect, but passwords are still a major target for bad actors because all too often these passwords aren't protected with another layer of security (aka MFA/2FA). Passwords on their own simply are not enough to protect a system. Case in point: Rapid7 looks at one particular high-volume brute-force password campaign, and stresses the need for MFA.
~ ~

OTHER NEWSY NUGGETS
Five Four Eyes? Politico looks at the degrading Five Eyes alliance, the five nations (Australian, Canada, New Zealand, the U.K. and the U.S.) that share intelligence with each other — given, uhh, things don't look so hot in the U.S. right now. (Just last week saw the firing of the director of its top wiretapping agency, the NSA.) Can the remaining intelligence-sharing alliance, including the U.K., survive the increasingly unpredictable U.S.? For what it's worth, @metacurity asked around and the general response wasn't great! (via Politico EU)
Cynthia Brumfield post: "FWIW I asked around about the durability of the Five Eyes alliance after Haugh’s firing. The mostly “no comment” answers were not reassuring."
Chinese spyware found in Android apps: A coalition of global governments, including the U.K., sounded the alarm with two new advisories detailing dozens of Android apps bundled with BadBazaar and Moonshine spyware, which have been linked to China's ongoing targeting of Tibetans, Uyghurs, and others. Lookout has been on these two spywares for years. (via TechCrunch)

China acknowledges Volt Typhoon link: Belter reporting by @dustinvolz this week, who confirmed with U.S. officials that China acknowledged its role in the Volt Typhoon affair (read: hacking U.S. infrastructure). The Chinese official's remarks in December with the then-Biden administration were "indirect and somewhat ambiguous," but referred to the U.S. support for Taiwan, which China claims as its own. (via Wall Street Journal ($))
Lorenzo Franceschi-Bicchierai tweet: "See, sometimes attribution isn't that hard," quote tweeting Dustin Volz's tweet: "Scoop: In a secret summit in Geneva last December, Chinese officials tacitly acknowledged being responsible for the Volt Typhoon intrusions on U.S. critical infrastructure systems and linked the attacks to U.S. support for Taiwan."
CISA director's nomination on hold: Sen. Ron Wyden put an indefinite hold on Trump's nomination for CISA director, Sean Plankey, until CISA agrees to release an unclassified report detailing security vulnerabilities in U.S. telco systems. Wyden called the withholding of the report a "multi-year cover-up." (Disclosure: I wrote this story.) Wyden sits on the Senate Intelligence Committee and knows more than most about what's actually going on in intelligence and cybersecurity circles, so when he says the report "contains important factual information that the public has a right to see," I'm inclined to believe the guy. (via Reuters ($), TechCrunch)

Looking inside a prolific SMS phishing group: If you've had a toll road or shipping-related SMS phishing message in recent weeks, then you can probably blame the Smishing Triad, which in part relies on literal walls of iPhones and Android devices to support their cybercrime infrastructure. Here's an interesting inside look at the group's operations and how it works. (via Krebs on Security)

Microsoft flags zero-day: In this month's Patch Tuesday roundup of security fixes, Microsoft has disclosed one zero-day bug under active exploitation. This particular bug (aka CVE-2025-29824) is found in the Windows Common Log File System that can grant system-level privileges across affected Windows devices. Bleeping Computer reports the RansomEXX ransomware gang is exploiting the bug. (via Bleeping Computer, Microsoft)

Screenshotting hell back in Windows: Sticking with Windows, it looks like Microsoft's screenshot-capturing "feature" Recall will be rolled out more broadly this year. Recall came under heavy fire last year after it was initially announced because it was caught capturing credit cards, passwords, and other highly sensitive data from apps like Signal and others. Cue the sound of exasperated users. (via Ars Technica)
~ ~
THANKS FOR YOUR SUPPORT!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Welcome to the happy corner! Especially to whoever happened to hijack the Everest ransomware gang's dark web site this week with the most delightful message.
The Everest ransomware gang's dark web leak site in Tor, which reads: "Don’t do crime CRIME IS BAD xoxo from Prague."
This Reddit /r/cybersecurity thread on cybersecurity myths is worth a read. Some will make you laugh; some might even sound eerily familiar...

I took time this week to watch @deviantollam and @tarah do their first security con talk together and it's absolute fire. You'll learn, you'll definitely laugh, and I think you'll love it. This talk is the perfect pairing of a physical pentester who breaks into places and a compliance executive who translates how and why, titled, "He is The One Who Knocks. I'm The One Who Makes You Comply." This talk doesn't disappoint!
And finally, this week. CatGPT.
An open PC case, circuits, fans and wires with four small kittens playing inside
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Stevie, aka keeper of secrets and seeker of kitty treats. Thanks so much to Jen K. for sending in!
Steve is a very handsome ginger kitty asleep on a red velvet blanket on aa sofa. (How comfy!)
Please keep sending in your cybercats or non-feline friends! You can email at any time with a photo and name of your cyber cat (or friend) and they'll be featured in an upcoming newsletter. Sent in before? Send an update!
~ ~

SUGGESTION BOX
And that's it for a bumpy, mixed bag week in cyber, *breathes into paper bag*. Let's do this all over again next week and see what we have in store.

As always, please do get in touch by email. It's always nice to hear from you! Especially if there's a cyber cat attached. (Go on, it really makes my day!)

Ta ta for now,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — april 6 edition

✇~this week in security~ Archive Feed
this week in security — april 6 edition
NSA director ousted, Oracle tells clients their login data was stolen, another Ivanti zero-day exploited, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 14
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

NSA director ousted at urging of far-right activist
Washington Post ($): Timothy Haugh, a career military official who was appointed to head the National Security Agency and its offensive counterpart Cyber Command a little over a year ago, has been ousted by the Trump administration. Details remain unclear exactly why, but the Post and others report that the removal of the NSA head — who oversees the powerful wiretapping and spy agency — was made at the request of far-right conspiracy theorist Laura Loomer during an Oval Office meeting this week. The firing caught many in Washington by surprise, including lawmakers tasked with intelligence oversight. Not even the DOD had any immediate comment, which seemed to learn about the firing through media reports. Lawmakers stressed this isn't exactly the greatest time to do this amid Chinese hacks and widespread targeting. Meanwhile: CISA continues to brace for further cuts, per Axios and CBS News, as many as 1,300 agency employees, despite the urging of House lawmakers of CISA to take on more cyber, not less.
More: New York Times ($) | Wired ($) | Cyberscoop | CNN | @samsabin
Mark Warner post on Bluesky: "General Haugh has served our country in uniform, with honor and distinction, for more than 30 years. At a time when the United States is facing unprecedented cyber threats, as the Salt Typhoon cyberattack from China has so clearly underscored, how does firing him make Americans any safer?"
China hackers exploiting fresh Ivanti zero-day
Mandiant: Fresh Ivanti zero-day, served up hot — and already in use by China-nexus hackers targeting customers who run Ivanti's VPN appliance, Connect Secure (another victim of terrible product naming). Mandiant said it found exploitation of the buffer overflow bug (aka CVE-2025-22457) used to drop backdoors and other malware. Exploitation dates back to at least mid-March, per Mandiant, and attributed to an as-yet-unknown China espionage group. It's not clear how many companies were exploited but one to patch regardless. This looks like Ivanti's second zero-day of the year (at least) after a January bug was also found to be under attack.
More: Ivanti | Bleeping Computer | Cybersecurity Dive

Oracle alerts clients to second breach, says login data stolen
Bloomberg ($): Oracle has alerted its customers to a data breach — its second incident in the last month. Per Bloomberg, Oracle told customers that hackers stole usernames, passkeys and encrypted passwords — with some credentials as recent as 2024 — and that the FBI was investigating. Oracle has remained defiantly silent about the breach, which is separate from its Oracle Health/Cerner hack incident — even if both incidents reportedly involve extortion. Bleeping Computer has done some great reporting on this. This will continue to spiral and get worse, because Oracle can't seem to ever handle its scandals.
More: DoublePulsar ($) | CSO Online
~ ~

THE STUFF YOU MIGHT'VE MISSED
How the feds tracked Caesars' $15 million ransom
Court Watch: Court documents reveal how the FBI tracked down and seized millions of the $15 million ransom that Caesars paid to hackers in 2023 following a ransomware attack. Caesars paid the $15 million ransom (negotiated down), but per the court document [PDF], the feds used the ransom payment transaction to follow the money flow — and seize much of the funds as it was transferred from one company-hosted wallet to another. (via 404 Media ($))

Open genetics site openSNP will shutter, fearing authoritarianism
Bastian Greshake Tzovaras: One of the founders of open source genetics sharing site openSNP said in a blog post this week that they're shutting down the site. Greshake Tzovaras said the site will close and all its data will be deleted on April 30, amid concerns of data privacy (amid the 23andMe sale) and "a rise in far-right and other authoritarian governments" that could put the data at risk. I chatted with him for TechCrunch (disclosure alert), as did the good folks at 404 Media ($).
Bastian Greshake Tzovaras post on Mastodon: "We have decided to sunset openSNP at the end of April. While triggered by the sale of #23andme, @PhilippBayer @i_dabble & I had been thinking about this for a while. Ultimately, we think that it's the most responsible act of data stewardship given the state of the world. I've written a retrospective of the last 14 years of the project."
Some companies appear to ignore opt-out privacy requests
Consumer Reports: Companies are required (under more than a dozen U.S. state laws that cover about half of the American population) to offer opt-out mechanisms for users and customers that prevent the companies from selling or sharing a person's personal data for targeted advertising. It turns out that many companies aren't honoring those requests — or flat out ignoring them. Check out the findings [PDF] and learn which companies don't seem to care about your privacy. Better yet, use an ad-blocker!

DPRK IT workers now targeting companies in Europe
Google Threat Intelligence: Google's threat intel boffins say hackers working for the North Korean regime, whose task it is to pretend to be prospective employees applying for jobs at big Western firms in order to gain employment, earn a wage, but then also steal gobs of corporate data (aka the "triple threat" of making money, extortion and IP theft), are now actively working across Europe. While the U.S. was a big focus for DPRK IT workers, Google says the DOJ indicting the heck out of some of these hackers has resulted in a shift towards targeting companies in Europe. Here's where Mandiant says the North Korean hackers are targeting:
A world map by Mandiant, showing North Korean hackers targeting a range of countries — including North America, much of Brazil and South America, parts of the Middle East, Australia and Asia, a couple of countries in Africa, and now broad swathes of Europe.
~ ~

OTHER NEWSY NUGGETS
T-Mobile bug exposed kids' locations: Fresh new nightmare scenario unlocked. A bug in T-Mobile's SyncUP mobile tracker (which can be used in place of a phone app) resulted in some parents logging in and being able to access the names, photos and precise location data of other children. "I would log in and I couldn’t see my children but I could see a kid in California," said one parent to 404 Media. (me: wheezing exhale) (via 404 Media ($), @jasonkoebler)

Verizon app bug exposed call records: Incredible research and findings by @Evan_Connelly, who found that Verizon's call filter app had a bug that allowed anyone to punch in someone's phone number and retrieve their list of incoming calls — with timestamps — in large part thanks to a lack of server-side validation of requesting phone numbers. Here's a short but good post explaining the bug, which Verizon has since fixed. (via Evan Connelly, SecurityWeek)
A screenshot from Burp Suite, showing a Verizon endpoint returning call logs, with some parts of the screenshot redacted.
Europcar breach affects 200,000 customers: A breach of Europcar's GitLab repository has exposed the personal information of around 200,000 customers, including names and email addresses. The breached data also includes SQL files and source code. (via Bleeping Computer)

API testing firm exposed customer data: APIsec, a company that provides API security testing to companies, confirmed it secured an exposed internal database containing customer data — including detailed scans of its customers' API endpoints, which researchers at UpGuard found connected to the internet without a password. I spoke with APIsec's founder, who initially said the data in the database was "not usable," but backtracked when I presented him with evidence of exposed customer data. (Disclosure: I wrote this story.) (via UpGuard, TechCrunch)

Move over, Signalgate. It's Gmailgate time: Several members of the White House's National Security Council used their consumer Gmail accounts for government business, including one staffer who shared "sensitive military positions and powerful weapons systems relating to an ongoing conflict," per emails seen by The Post. As for the top national security advisor Michael Waltz, who a couple of weeks ago made (a lot of) headlines by accidentally inviting a journalist to a Signal group chat to discuss bombing targets in Yemen, used his own Gmail account to share "less sensitive, but potentially exploitable information." 🫠 (via Washington Post ($), @John_Hudson)

Seattle airport hack hits thousands: Some 90,000 people will receive notice that their personal information was stolen in a ransomware attack that knocked out much of the Port of Seattle and Seattle-Tacoma International Airport for several weeks during August 2024. The data included government-issued ID numbers, which — you know, for an airport, that's not great. (via KOMO News Seattle)
~ ~
THANKS FOR YOUR SUPPORT!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A selection of cyber cat and security-themed stickers, and a this week in security mug (each in both black and white mug colors).
~ ~

THE HAPPY CORNER
A happy Sunday to you! Welcome back to the happy corner. Only good vibes from here on out.

First up; from @micahflee: clean OPSEC advertised, clean OPSEC achieved.
Micah Lee in a park holding a sign that says, “We are currently clean on OPSEC”
I don't know who needs to hear this, but iPhones and iPads now have an HTTPS certificate viewer in Safari. More from the WebKit blog. In related stats, TIL that more than 87% of all internet connections use HTTPS. The more you know!

Skeezy job alert: Are you willing to hack and take control of Chinese websites for a random person for up to $100,000 a month? This hapless hacker keeps pinging security researchers claiming to have this sketchy job for them, even if nobody can figure out quite what the actual deal is.

And finally this week. Bonus cybercat, plus heartwarming thread.
A black and mostly-white cat called Bridget, whose owner painted his perceived adventures of his cat while she was missing for a few weeks.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet this week's cyber-cats-dogs, who are seen here looking absolutely shattered after a long day hacking. Many thanks to Keegan P. for sending in!
Two very cute brown dogs asleep on the carpet, surrounded by blankets, the dogs are called humperdink (top) and Fezzick (bottom).
Ding dong, it's the cyber-cat gong. Send in your cybercats or non-feline friends! You can email at any time with a photo and name of your cyber cat (or friend) and they'll be featured in an upcoming newsletter. Sent in before? Send an update!
~ ~

SUGGESTION BOX
That's all for this week. Feel free to get in touch if you have anything for the newsletter. I'll never say no to a cyber cat (or friend). This newsletter is run on coffee, your generosity and donations, and cybercats.

Enjoy your week and I'll catch you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — march 30 edition

✇~this week in security~ Archive Feed
this week in security — march 30 edition
US officials texted war plans over Signal, 23andMe sale sparks data fears, Oracle's very bad security week, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 13
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Senior Trump officials accidentally texted war plans to reporter over Signal
The Atlantic ($): Ever woken up one morning, poured a cup of coffee, made a bowl of cereal, and texted highly classified war plans to a journalist? I guess that's where we're starting this week. What were they thinking?! In what is both a huge breach of national security (and also inadvertently pretty good free advertising for Signal), several senior Trump cabinet-level officials group-texted The Atlantic's editor-in-chief (mistakenly) specific plans to launch air strikes on Houthi targets over Signal ahead of the attack. Mind-bending reporting and frankly there's just too much to discuss. It's a huge breach of security, not least because they weren't in a SCIF and Signal isn't approved for classified use. (Signal is excellent, sure, but it's the underlying consumer phones that Signal runs on that are the problem — think spyware!). We got some excellent memes out of it, though. But all this points to an incredible apathy towards security and a lack of documentation (such as records keeping) by some of the most senior people in government. At least on a classified line, you can't accidentally dial in a journalist.
More: Spiegel [DE] | Lawdork | MalwareTech | BBC News | Foreign Policy
An "is this" meme posted by Yael Grauer, which reads: "Is this a SCIF?' with a person holding a hand up to a butterfly, with the label, "Signal."
23andMe files for bankruptcy, sparking data privacy fears
BBC News: DNA testing giant 23andMe looks like it's going under, and filed for bankruptcy protection this week. CEO Anne Wojcicki stepped down on the news after leading the company's slow decline for more than two decades. A court will later this year oversee the sale of the company and its assets, including millions of people's DNA records (and much of their family members — as is the way that DNA works). U.K. authorities sounded the alarm, as did several U.S. states (including California and New York), warning that the data could be sold to, well, anyone. You can delete your data, but 23andMe may hold onto some of it for as long as it wants. If only someone had been warning about this for years...
More: TechCrunch | 404 Media ($) | DocumentCloud | Salon

Oracle denies breach, despite mounting evidence of breach
Bleeping Computer: When is a breach not a breach? When Oracle claims it's not a breach. But where there's smoke, there's usually fire. A threat actor claims to have breached Oracle Cloud and sold authentication data and encrypted passwords of more than 6 million users, as well as 140,000 domains used by companies and governments allegedly affected. The threat actor also planted a text file on an login.us2.oraclecloud[.]com subdomain. Strange, right, especially if there's "no breach"? Now, customers are reporting that data samples shared by the threat actor are in fact real. Security firms investigating are sure there's something funky going on. CloudSEK has deep-level analysis, as does Kela. If the data is genuine, it could be a major breach of Oracle's systems. Keep a close eye on this one, and maybe don't take Oracle's word for it just yet.
More: The Register | SecurityWeek | Dark Reading
~ ~

THE STUFF YOU MIGHT'VE MISSED
Oracle Health breach compromises patient data at U.S. hospitals
Bleeping Computer: Sticking with Oracle for a second... It looks like Oracle might have a second incident on its hands, courtesy of Cerner, the health giant that Oracle acquired back in 2022 for $28 billion. Now known as Oracle Health, the unit allows hospitals and healthcare practices to access electronic health records and more. Per a notice sent to affected customers, Oracle became aware of a breach of its servers on February 20. Some of the data "may" have included patient data, according to Bleeping's sources. Bloomberg ($) also has more reporting.

NSA's email about Signal 'vulnerability' was way off
Kevin Collier: Earlier this week, the good folks at NPR wrote a story about the NSA sending around a Pentagon-wide email about a supposed flaw in Signal. The actual NSA email, though, seemed to get things quite muddled. The issue at hand was reported last month when Google found that Russian threat actors were abusing Signal's in-built "linked devices" feature (which lets you run Signal as a desktop app) by crafting malicious QR codes. It's not a vulnerability, but good to be aware of, especially if you're on the battlefield right now. @kevincollier debunks this one so you can keep using Signal (but not for war chat discussions, please).
Kevin Collier post on Bluesky: "It's really crucial to understand how badly framed this is. There is no Signal vulnerability. The Pentagon email did a bad job explaining a Google report from a month ago and NPR repeated it. This is like saying because you got a phishing email at your Gmail address, there's a Google vulnerability."
PSA: Not every household appliance needs an internet connection
Jeff Geerling: In what shouldn't be a controversial opinion in this day and age: Not everything needs to be connected to the internet. A household dishwasher is almost certainly going to be in that category. And yet, here is Jeff Geerling, in the year of 2025, unable to run certain dishwasher cycles because of an inexplicable requirement for an internet connection. Please, can there be a company that specifically makes "dumb" devices?

Over 3 million applicants' data leaked on NYU's website
Washington Square News: New York University's website was hacked and taken over for at least two hours last weekend, exposing over 3 million applicants' names, test scores, majors and ZIP codes, including other financial aid information dating back to 1989(!) The defacement, which was littered with racist epithets, was taken down after a couple of hours. Not clear why NYU was storing data for this long, or had the data so easily accessible. Hats-off to the student reporters who covered this story so well.
~ ~

OTHER NEWSY NUGGETS
Ukraine railway bounces back after attack: Ukrzaliznytsia, the state railway of Ukraine, is back in action after online ticket sales were knocked offline this week during a cyberattack. Train schedules weren't affected, but few could buy tickets online for several days. Details of the attack weren't released (yet) but that there was no breach of sensitive data, per @darynant reporting from Kyiv. (via The Record)
A photo from Kyiv's central railway station, showing a digital departure board (in Ukrainian) with green departures and red text for delays.
A not-very-Advanced hack settled for £3m: U.K.-based NHS vendor Advanced will pony up £3 million (around $3.8M) in a settlement to the U.K.'s data protection watchdog after a not-so-advanced ransomware attack in 2022 knocked much of the company offline and resulted in the breach of tens of thousands of people's private health information. The breach was caused by a lack of MFA at the company, per the regulator. (via ICO, TechCrunch)

Chrome, Firefox zero-days under attack fixed: Not one, but two zero-days this week were patched after Google and Mozilla released fixes for their Chrome and Firefox browsers for Windows. The bugs appear to be linked to the same hacking campaign targeting Russian journalists, government employees and education staff, per Kaspersky, which found the bugs. (via Kaspersky, @cR0w)

Fake China network trying to lure federal workers: A researcher uncovered a network of companies operated by a secretive Chinese tech firm that's trying to recruit recently laid-off U.S. government workers. Reuters found that the network of companies appeared to be fake, and potentially a front for Beijing, likely as a way to exploit former workers who were let go in recent weeks. (via Reuters ($))
~ ~
THANKS FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A selection of cyber cat and security-themedn stickers, and a this week in security mug (each in both black and white mug colors).
~ ~

THE HAPPY CORNER
Deep breaths, it's the happy corner. Welcome in! You've earned it.

The perfect garden doesn't exi... oh it does.
Mastodon post by Cedric Delalande: "Had a little concrete left and some yellow paint," followed by an image of a garden path with several circular concrete steps, followed by one that's painted yellow and looks like Pac-Man.
Meanwhile, the mood this week lifetime:
Shauna GM post: "Having to do an 'I am not a robot' exercise while reporting AI spam on github is peak 2025"
In a little bright spark of good news, The Journal Times in Wisconsin announced it's back to full strength after a cyberattack at its parent company Lee Enterprises knocked dozens of news outlets offline and unable to print for some time. This is good to see! (via @PogoWasRight)

And finally, this week. A much needed moment of clarity. (Use an ad-blocker!)
Security Writer post: "A website guiding users to disable their adblocker is no different than a phishing email asking users to disable their security software. Both intend to do you harm."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Whisper, who can be seen here absolutely kicking their humans' asses at poker (which is really saying something), in between her regular daily activity of shoulder-surfing their passwords. Genius kitty! Many thanks to Tarah and Deviant for sending in!
Whisper is a jet-black void floof who is performing an excellent 'mlem' with their tongue, and seen sat on a chair at a poker table with poker chips nearby.
This newsletter runs on cybercats (seriously!). Please keep sending them in! Feel free to drop an email any time with a photo of your cyber cat (or non-feline friend) along with their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's it for this week in security, let's hope for some slightly better cybers this week. I'll be back with the usual round-up of everything you need to know from the week (plus more) next Sunday.

As always, please do get in touch if you have anything from the week, or for the newsletter, or just to say hi. I'm only an email away.

Gotta dash, my secret war Signal chat is blowing up,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — march 23 edition

✇~this week in security~ Archive Feed
this week in security — march 23 edition
Paragon spyware customers and victims revealed, CISA scrambles to contact fired staff, Wiz to join Google Cloud, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 12
View this email in your browser | past issues | RSS

~ ~

THIS WEEK, TL;DR

Paragon spyware used by at least six countries to snoop on civil society
Citizen Lab: The boffins at Citizen Lab are back with a new report into Paragon's spyware, dubbed Graphite, which breaks into phones and specifically targets their messaging apps, like WhatsApp (rather than the whole device) to access a target's private messages. The report focuses on at least six governments that likely have access to Graphite (based on its technical analysis via a tip from a "collaborator"), including Canada and Australia; as well as the victims, some of which include a cluster of Italians and those working as human rights defenders in Italy (which is also a Paragon customer). Paragon claims it only pitches its tech to the U.S. and its allies (both a large list and one that's increasingly narrowing), but clearly even ostensibly "responsible" spyware makers are a myth — if anything a paradox, no such thing really exists. The report helped Meta fix a zero-click flaw in WhatsApp, which notified over 90 people that they were targeted by the spyware.
More: Washington Post ($) | TechCrunch | Amnesty | Dark Reading | @billmarczak

CISA scrambles to contact fired staff after court rules layoffs 'unlawful'
TechCrunch: A message posted to the top of CISA's homepage on Tuesday asked probationary staff that had been previously fired by DOGE to get in contact with the agency, after a court ruled the firings were "unlawful" and that staff must be reinstated. CISA said in the message it's seeking to contact the since-fired employees, implying the federal agency doesn't know who got fired or has everyone's contact information. CISA also asked staff to send a "password protected attachment" containing personal information to prove its them — but didn't specify how (remember: email is largely unencrypted as it travels the web). Meanwhile: USAID staffers say they've been stranded with laptops full of highly sensitive (albeit unclassified) information after their firings, amid fears that the data could get lost or fall into the wrong hands.
More: Krebs On Security | The Verge | @skiles posts
A screenshot from CISA's website on March 18, which reads, in part: "The Court issued a Temporary Restraining Order in Maryland, et al v. United States Dep’t of Agriculture. CISA is making every effort to individually contact all impacted individuals. However, to the extent that you have been terminated by CISA since January 20, 2025, were in a probationary status at the time of your termination, you have not already been contacted by CISA in relation to this matter, and believe that you fall within the Court’s order please reach out to SayCISA@cisa.dhs.gov."
Trump administration begins shifting cyberattack response to states
WSJ Pro ($): An executive order out this week directs the White House to draw up a national resilience plan that shifts responsibilities for cybersecurity to the states and local level. That's... certainly a choice. MS-ISAC (which helps to share threat intelligence at the local level) says the cuts will leave state governments exposed to nation-state threats, given that states are very much on the "front lines" of protecting critical infrastructure. Experts say losing federal resources could result in lost visibility, from known exploited flaws to other vulnerabilities. This order also comes in the same week that the New York Times ($) had a great read on /r/fednews, the Reddit subreddit dedicated to helping feds, which has been a source of truth and support with government layoffs over recent weeks.
More: White House | BankInfoSecurity | The Guardian
~ ~

THE STUFF YOU MIGHT'VE MISSED
Enterprises scramble after open source code hit by supply chain attack
Ars Technica: Open source software used by at least 23,000 orgs called tj-actions/changed-files was hit by a supply chain attack, allowing malicious hackers to takeover the maintainer's account (around 4pm UTC on March 14). tj-actions/changed-files is widely used in the continuous development process. The compromised package was corrupted to include credential-stealing code. More from Step Security, which first discovered the attack, and Palo Alto, which says one of the initial attacks targeted Coinbase. (via @campuscodi)
A screenshot graphic from Wiz's blog describing the supply chain attack in detail.
North Korea launches new cyber unit with AI-focus
Daily NK: Yes, now even the North Koreans are going all-in on AI (not that they weren't already), according to a source close to the regime telling Daily NK, a news outlet that focuses on North Korea. Much of the unit, known as Research Center 227 (a name that just rolls off the tongue), will focus on information theft and the regime's efforts to steal "digital assets," aka crypto. You know what I'm going to say... North Korea literally only wants one thing and, well, you know the rest.

Nakivo backup unauthenticated bug under attack
watchTowr Labs: A bug in Nakvio's backup and replication software has an absolute path traversal flaw, tracked as CVE-2024-48248, which is being exploited in attacks to steal backups and other sensitive internal corporate data, per watchTowr, the security research firm with A+ meme game. Bleeping Computer has a tl;dr. CISA (or whoever's left) put out a note adding the bug to its Known Exploited Vulnerabilities database, which means federal agencies have to patch the bug on their own systems ASAP.

Oracle's data breach denial leaves questions unanswered
Bleeping Computer: Back with Bleeping, as it reports that Oracle is denying a data breach following a claim on a hacker forum claiming a breach of 6 million data records allegedly relating to Oracle's Cloud single sign-on servers. As evidence, the threat actor published data including LDAP files and the list of companies that had data allegedly stolen from the Oracle SSO platform. Oracle said there has been "no breach" and the published credentials are "not for Oracle Cloud." But Oracle couldn't (and still hasn't) explained how the threat actor was able to plant their email address on an Oracle SSO server's endpoint (since offlined). Hmmm! A curious one indeed, and Oracle still has explaining to do.
~ ~

OTHER NEWSY NUGGETS
Apple nukes exposed SpyX stalkerware creds: New day, new spyware breach. SpyX has become the 25th (by TechCrunch's count) phone surveillance operation since 2017 to have been hacked or otherwise lost or spilled their users' and victims' data. SpyX, aka "stalkerware," was breached in mid-2024 and had some 2 million phones under its control, including 17,000 Apple users' plaintext credentials, which the surveillance operation uses to tap into the victims' iCloud-stored data. Apple was given the credentials, and told me that it took action to protect around 250 Apple customers. (Disclosure alert: I wrote this story!) (via TechCrunch)
A Bluesky post from me, which reads: "In a statement, Apple told me that it took action against fewer than 250 iCloud users that were affected by the breach at SpyX. Apple said when data breaches at other companies pose a risk to its customers, its security teams investigate & take action," and my post was quoted by Troy Hunt, posting: "It’s only 250, but that’s 250 more than before this data appeared 😊"
Wiz's $32bn payday: Wiz will become part of Google Cloud, subject to regulatory review, in a deal worth $32 billion. The cloud security giant exploded onto the scene in January 2020 and has become one of the most valuable startups going. SecurityWeek breaks down the deal more. Google + Wiz = G-Wiz? (via Wiz, Google)

Treasury lifts Tornado sanctions: The U.S. Treasury has lifted sanctions (OFAC listing) on Tornado Cash, a cryptocurrency mixing service used by state-sponsored hackers to launder their stolen crypto. The move comes amid warnings that the move will embolden and fund North Korean hackers, which remains dedicated to stealing the world's crypto, including the $1.4bn heist at ByBit in February. The Treasury didn't give a good reason, to be clear, except for exercising its "discretion." (via Treasury, @briankrebs)

Xbox 360 hackers, assemble! Xbox 360 modders have a new way to install homebrew apps and games on their console. Using a software exploit dubbed BadUpdate allows users to use a USB key to hack the console's hypervisor protections. The exploit is non-persistent so requires exploiting every time, but doesn't require physical tampering. You will need some time and patience, though. (via The Verge)
A glitchy graphic showing an Xbox 360 update in progress, followed by a screen that shows "Exploitation complete."
~ ~
THANK YOU FOR YOUR SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Happy Sunday to all those who observe. This is the happy corner.

First up: it's a bonus cyber-cat, OSINT edition. The fantastic folks at Bellingcat have a "pet the cat" challenge that involves using open-source intelligence and mapping to discover the exact location of this cat. This is a fun, explanatory read.
Dam Coffee post on Bluesky: "Hello! I'm back with another write up, this time for the "Pet the Cat" challenge from Bellingcat. If you'd like to get started with open-source intelligence, the Bellingcat challenges is a great place to start!"
Félicitations à la France! The French National Assembly rejected a piece of legislation that would have gutted end-to-end encryption across the country, per the EFF — not that it should've gotten this far anyway. But good to see French lawmakers have a much-needed moment of clarity. For all the good encryption does, it's not the enemy!

And finally this week, from me: My heartfelt thanks to you for reading. It has been, admittedly (and continues to be), a very political time in tech, and this newsletter, by nature, reflects what's in the news that week (otherwise it would be ~this week in only good news security~). Tech has always been political. (Everything is political in some way.) I've received a few messages from folks unsubscribing of late, accusing me of having "Trump derangement syndrome" and calling this newsletter "too biased" and "too political." Sorry to see you go. My goal is to give you the news from the week that you need to know, even if it's not always the best news in the world. (That is also why we've had the happy corner from the very start.)

I love writing this newsletter every week. This newsletter is free, and written entirely in my spare time, and usually with a cat by my side for company. I deeply appreciate you for trusting me to inform you of what's happening in the world as best as I can in this weekly email. And, I also really appreciate the messages from readers who've gotten in touch recently just to say hello, to share a cybercat, or to share a message of warmth and kindness. It really means a lot.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Marlowe, whose human tells me he is a dogged investigator kitty and can be often found fuzzing web applications with random keyboard inputs. (I've heard that the more paws on the keyboard the better!) Thanks so much to Don H. for sending in!
Keep sending in your cyber-cats! You can drop an email any time with a photo of your cyber cat (or non-feline friend) along with their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
Thanks so much again for reading. Let's do this all over again, same time next week. If you want to get in touch, please drop me a line. I always appreciate a cybercat update if you have one!

Touching grass,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — march 16 edition

✇~this week in security~ Archive Feed
this week in security — march 16 edition
New CISA director nominated, Apple backdoor appeal held in secret, Gaggle AI monitoring kids sparks security fears, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 11
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

New CISA director nominated amid layoffs and uncertainty
Cyberscoop: Former DOD, NSC and DOE official Sean Plankey will likely be the next director of the U.S. federal cybersecurity agency CISA, following his nomination by the White House this week. Plankey's nomination goes to the Senate for consideration. His appointment comes at a time of considerable flux at CISA (to say the least) amid even more layoffs, including red teamers. Wired ($) estimates between 300 and 400 staffers have been lost so far, or about 10% of its workforce, as remaining staff at the cyber agency say they are "scared" as cuts make it more difficult to protect the integrity of elections, AI and open-source security. The White House ended up instructing agencies to keep cyber staff, per Reuters ($), as DOGE continues to slim down the size of government at any cost (or consequence). Next up, DOGE has its eyes set on the National Security Agency, per the WSJ ($).
More: Congress.gov | Federal News Network | Reuters ($) | Cyberscoop | StateScoop | LinkedIn | @GossiTheDog

Apple encrypted data row hearing begins in secret
BBC News: Let's jump to the U.K. real quick, where the encryption "debate" (the only debate is with the people trying to break it) is hotting up again. With Apple-backdoor-gate: U.K. Edition, we now have Apple reportedly appealing the U.K. government's secret decision to issue the company with a backdoor order, known as a technical capability notice, so British cyber bobbies can access encrypted Apple customers' data anywhere in the world. Apple pulled its encryption feature, ADP, rather than capitulate (though the debate is still going on that one). Appealing the decision isn't easy and requires going through the U.K. spy court, known as the Investigatory Powers Tribunal, which hears cases in secret. U.S. lawmakers and plenty of others, including media outlets, are calling on the hearing to be public, since it's in the public interest. (I agree, but good luck with that one.)
More: Ron Wyden | Bloomberg ($) | The Guardian

Schools use AI to monitor kids. Reporters found security risks
AP, Seattle Times: Do you know what your kids are doing at school? This AI monitoring software called Gaggle does, and it screams of major security issues. The AP and the Seattle Times inadvertently received(!) close to 3,500 sensitive student documents through a public records request. The data was not redacted (was it ever encrypted?) and contained student names and other sensitive data. The documents were also public, since neither firewalls or passwords protected the files, the reporters said. The heart of the story gets even worse — the level of surveillance that these kids experience (and in some cases have no idea the monitoring was going on) is really jaw-dropping. Many of the issues that the system, called Gaggle, are false positives. Throwing AI at teenagers isn't going to make them safer or protect them. And as the report notes, LGBTQ+ kids and students experiencing gender dysphoria are the most affected. AP has a breakdown in a sidebar piece.
More: Seattle Times | The Verge ($)
~ ~

THE STUFF YOU MIGHT'VE MISSED
North Korea caught planting malicious npm packages and spyware
The Register, TechCrunch: Research via open source security firm Socket shows North Korean hackers managed to sneak backdoor code in at least six packages on npm (an open source package manager), which are designed to steal passwords and crypto, and deploy backdoors. It comes in the same week that North Korean hackers were caught dropping a spyware app in Google Play, per Lookout, in what appears to be a highly targeted espionage campaign. You know the drill by now: North Korea's all about stealing as much crypto as it can to fund its nukes.
A screenshot showing a 'File Manager' listed app in Google Play, but the app is actually North Korean spyware.
ICE surveillance contractor monitoring 200+ popular sites
404 Media ($): A surveillance company called ShadowDragon that contracts with ICE is monitoring more than 200 popular websites — from Apple to Amazon and Meta, Microsoft, and TikTok, according to a leaked list provided to 404 Media. By scraping this data (against many of the firms' terms of service — not that it's stopped surveillance vendors in the past) it allows government analysts to more easily pull public data from a wide array of websites.

Undisclosed hacker behind crypto wallet cracking firm Unciphered revealed
Washington Post ($): (⚠️ CW: Story references sexual violence) An important story in the Post this week revealing that one of the undisclosed founders behind the crypto wallet cracking firm Unciphered is Morgan Marquis-Boire, a hacker who is accused of multiple sexual assaults (and has admitted to rape). His role was masked by a pseudonym, and protected by co-founder Eric Michaud. Neither work at the company any more. Never forget the awful people; but always remember the people who speak up.

Apple will soon support E2EE messaging with Android
GSA Association: Soon, Apple devices will be able to send and receive end-to-end encrypted messages to and from Android devices using the newer RCS messaging standard. No clear date on when the E2EE fun will begin, but nevertheless good news. Ars Technica has a tl;dr.

Who does your CISO report to?
Reddit: An interesting thread on /r/cybersecurity this week pooling answers on who CISOs report to in their corporate hierarchy. It's an interesting look at the senior cyber role; ostensibly C-suite but rarely actually is, and often beset with personal risk and liability. A lot of folks say their CISOs roll up to the technology (CTO) or information heads (CIO), but some report to finance or legal. (Although, I did chuckle — then suddenly not — when I read: "What CISO?")
~ ~

OTHER NEWSY NUGGETS
Mo' medical breaches: More than half a million people had personal (and in some cases medical) data stolen in a series of sizable breaches at healthcare organizations across the United States. SecurityWeek has your list. Apparently the easiest way to avoid having your medical data breached is to have never existed to begin with. (via SecurityWeek)

Knock, knock, you've been hacked by Volt Typhoon: "Go f-yourself," one general manager of a power and water facility in Massachusetts told an FBI agent who called him one Friday night to tell him his facility had been hacked by the China-backed hacking group Volt Typhoon. Well, in fairness, the feds were trying to get the guy to click on a link to diagnose the severity of the issue. The general manager took the claim more seriously when the feds turned up the following Monday. A pretty interesting inside look of how the feds notified private industry of the threat from Volt Typhoon, per a case study from ICS security firm Dragos. (via DarkReading)

Amazon still hosting spyware data weeks on: Amazon refused to take action against three spyware operations that are hosting gobs of people's phone data stolen via Cocospy, Spyic and Spyzie spyware/stalkerware apps, which have collectively compromised more than 3 million people. TechCrunch (read: me) notified Amazon on February 20 that it was hosting the spyware victims' data and told representatives exactly where to look, but Amazon wouldn't take action because... we didn't fill out a web form? Ultimately, Amazon chose not to act on the information we provided.(Disclosure alert: I wrote this!) (via TechCrunch)
A screenshot of a photo, hosted on Amazon Web Services, which was uploaded via a virtual Android device deliberately compromised with Cocospy stalkerware during a TechCrunch investigation, showing definitive proof that spyware data is uploaded and hosted on AWS.
New month, new zero-days: Microsoft is reporting six new zero-days under active attack in this month's Patch Tuesday round-up of security fixes, including three bugs in the NTFS file system. Meanwhile, Apple fixed a fresh zero-day that has reportedly been exploited in an "extremely sophisticated attack" — whatever that means. (via KrebsOnSecurity, TechCrunch)

X DDoS? WTF?: A DDoS attack that briefly knocked the site formerly known as Twiter offline this week was real, data shows, but X owner Elon Musk attributed the blame on IP addresses "originating in the Ukraine area," without providing evidence or specifics. Security experts say that's not how DDoS attacks work. One expert monitoring the situation says botnet traffic in Ukraine's digital space didn't even break the top 20 countries by origin. Thankfully, Wired ($) breaks down what Musk seemingly can't understand. (via Wired ($))

AT&T technician turned whistleblower passes: Mark Klein, who blew the whistle on secret NSA wiretapping in a San Francisco AT&T hub where he worked, has passed on at 79. In 2006, Klein walked into the SF headquarters of the EFF with a question: “Do you folks care about privacy?” Turns out they really, really do. Klein presented them with evidence of wiretapping behind the now-infamous Room 641A, and that set in motion a major milestone in uncovering secret NSA surveillance authorized by laws passed in the wake of the 9/11 attacks in 2001. (via PBS, Washington Post ($))
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Welcome back to the happy corner. It's 20% happier than last week.

Are sharks the squirrels of the sea? I howled with laughter at this post this week.

As usual, Philomena Cunk is asking the right questions:
A still photo from Cunk on Earth, with the subtitle: "If the USA is so great, then why did they make a USB?"
The EFF continues its daily thread highlighting some of the amazing women in tech, cyber and privacy throughout Women's History Month.

And take a moment of zen while your bus receives a software update. (Wait, can Doom run on this bus?)
Garry post on Mastodon: "do not turn off the bus," featuring a photo of the digital display screen inside a bus, showing a software update in progress
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet Shiner, this week's cybercat, who can be seen here studying for his CCNA certification. After all, you can't be an effective white-fur-hat hacker without learning the basics. Thanks so much to Sam M. for sending in!
Shiner is a beautiful white cat with slightly blackened eyes, and sitting with their paws on the keyboard looking into the camera.
Keep sending in your cyber-cats! Drop me an email at any time with a photo of your cyber cat (or non-feline friend) along with their name, and they'll be featured in an upcoming newsletter. Please send in updates, too; always love to receive them!
~ ~

SUGGESTION BOX
And that's it for a busy week of ~this week in security~, will you join me next? Expect another firehose of news from the past week.

I love hearing from you so please do get in touch if you have anything to share, especially if it's a cybercat, friend, or update.

Off in search for breakfast,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — march 9 edition

✇~this week in security~ Archive Feed
this week in security — march 9 edition
VMware hypervisor escape bugs exploited, Apple appeals UK backdoor order, NTT Com hack hits thousands of orgs, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 10
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

'Emergency' VMware bugs allow hypervisor escape; under attack
DoublePulsar ($): If you're an organization that runs VMware, listen up. There's a new trio of bugs dubbed "ESXicape" that allows malicious hackers to escape the protective sandbox of a VMware virtual machine and compromise the underlying hypervisor, ergo every other virtual machine on that server. It's particularly nasty as the bugs, chained together, can allow an attacker to escalate "a small amount of access at an org to full access at potentially multiple orgs," according to @GossiTheDog, who's had some of the best insights into this bug thus far. Patches are out, as are exploits — these bugs are being actively exploited as zero-days — so fix ASAP, and don't let this one go by.
More: Broadcom | VMware (GitHub) | TechCrunch | CSO Online | @GossiTheDog

Apple takes legal action in U.K. amid encryption backdoor row
BBC News: Interesting development from the U.K.! A couple of weeks ago, Apple said it was nuking its Advanced Data Protection feature (which encrypts iCloud data so nobody else can access it) in the United Kingdom. What Apple isn't legally allowed to say is that it's because the British government secretly demanded access to any iCloud customer's data anywhere in the world. Now, Apple is launching unspecified legal action at the U.K.'s Investigatory Powers Tribunal, which hears surveillance cases in secret, in an effort to overturn the demand. The case could be heard in the next few weeks, per the Beeb. Maybe folks in the U.K. will get reprieve in the end? Meanwhile: Looks like the U.K. government scrubbed much of its encryption advice from its web pages, per @alecmuffett, which isn't a particularly good look for U.K. cyber officials.
More: Financial Times ($) | Cryptography Engineering | @privacymatters

New details of Bybit's hack of $1.4B emerge
The New York Times ($): Much, much more detail here on how the hack at Bybit, the world's second largest crypto exchange, went down. Per the Times, North Korean hackers (which have been blamed by the FBI [PDF] for the heist) exploited a bug in Bybit's security by hacking into the laptop of a developer who works at Safe, a crypto storage firm that Bybit relies on, per Safe's incident report. The North Koreans planted malicious code capable of manipulating transactions. The Wall Street Journal ($) reports that when Bybit's CEO Ben Zhou went to approve a "routine" transfer of about $80 million, Zhou's CFO would later say that the entire contents of the cold wallet — around $1.4-ish billion in crypto — was stolen. $1.4B is the largest heist in history, and so far, most of it's been successfully laundered.
More: Chainalysis | Elliptic | TechCrunch | CryptoSlate
~ ~

THE STUFF YOU MIGHT'VE MISSED
Was Cyber Command and CISA ordered to stand down on Russia?
Zero Day: So, what did happen last week when the Department of Defense reportedly (key word here!) ordered Cyber Command (which launches offensive cyber campaigns) and CISA (which works on cyber defense and intel sharing) to effectively "stand down" on Russian offensive cyber operations and threat tracking? And why did CISA and DOD deny the story as strenuously as they did? If any story warrants careful post-match analysis, it's this one, and @kimzetter, as usual, breaks this one down with absolute precision.

Former NSA official: 'Grave concerns' over U.S. cyber cuts
Rob Joyce: Former NSA cybersecurity director @rgblights testified to Congress this week on the threats faced by the U.S. from China, primarily, including Salt Typhoon (which hacked the hell out of U.S. telcos last year). But Joyce also, as an aside, warned of "grave concerns" to U.S. government cuts of probationary employees (with less than a year on the job) across the cyber domain. Around 130 probationary employees cut from CISA alone, per CBS News. "Eliminating probationary employees will destroy a pipeline of top talent, essential for hunting and eradicating [China-nexus] threats," said Joyce. His remarks can be read here, and the full hearing is online via the House committee page.
A photo of Rob Joyce (former NSA cyber director), then Emma M. Stewart (Idaho National Lab) and Laura Galante (former Office of the DNI) pose for a photo in front of the House chamber for the Committee on the CCP that they're about to testify to.
HCRG sent journalist legal demand to take down reporting on data breach
DataBreaches.net: U.K. health giant HCRG was hit by a ransomware attack last month; we know as such because the company admitted it in a legal demand that it sent to DataBreaches.net for reporting on its breach. HCRG, which said in the letter (I've seen it!) that it was hit by a "ransomware cyber-attack," threatened prison time and fines, citing a secret U.K. court injunction that the company obtained, demanding DataBreaches.net remove its posts. Given DataBreaches.net is run out of the United States and protected by the First Amendment, its operator Dissent Doe declined and instead posted about the legal threat. HCRG, meanwhile, hasn't put anything on its website about the hack. Slapping journalists with legal threats is the worst; so I wrote some words, too. (Disclosure alert!)

Scammers targeting U.S. execs with fake ransom notes
TechCrunch: Ransomware is going retro: The FBI is warning that scammers are impersonating the BianLian ransomware gang by mailing fake ransom demands to U.S. corporate executives. The letters claim access, then demand payment via a QR code to not publish the data. But, per the FBI's latest IC3 [PDF] warning, it's a scam, not that anyone should be paying the ransom (the FBI has long urged). GuidePoint has a copy of the letter and what to watch out for. @briankrebs has a snap of one of the ransom notes.
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Rubrik confirms log server hack: Cybersecurity firm Rubrik confirms that... cybersecurity is difficult(!) after reporting a breach of one server containing log files, "most of which" contained non-sensitive information (so there was some sensitive data)... prompting the company to rotate its internal keys. The company said it had no evidence of unauthorized access to customer data... well maybe it can check its logs serv... oh. (via Rubrik, Bleeping Computer)

Silk Typhoon still hackin': The hacking group known as Silk Typhoon (of the wider Typhoon family of China-backed hackers) are still hacking, per Microsoft, and now targeting flaws in enterprise tech products, such as Ivanti's latest zero-day that was discovered as recently as January. This follows the gang's use of a stolen BeyondTrust key to breach the Treasury in December. Relatedly: The DOJ charged a dozen hackers that it claims are directly involved in Silk Typhoon (remember I-Soon?) and APT27, which hack on behalf of the Chinese government. (via DOJ, TechCrunch, Microsoft)

NTT Com says 18,000 orgs had data stolen: You know it's a rough week when you have to notify 18,000 customers — no, no, not people — companies — that their employees' data was stolen in a recent breach, but that's what NTT Com, one of Japan's largest enterprise networking tech giants, had to 'fess up to this week. In a statement, the company said phone numbers, email and postal addresses were taken from a service order database — but no word yet on how many individuals had data stolen. (Read: it'll probably be a lot.) (via NTT Com)

Feds link crypto breach to LastPass hack: For years now, Brian Krebs has been warning that hackers have been cracking the master passwords of customers' LastPass vaults stolen following the company's massive hack in 2022, with the goal of gaining access to the passwords of crypto wallets and draining them of their funds. LastPass has consistently said it's seen no evidence between the theft of its customers' password vaults and several major crypto hacks. But in new court filings, the U.S. feds have reached the same conclusion as Krebs and others — that crooks are cracking customers' stolen vaults and using them to steal huge gobs of crypto. If you haven't changed your ostensibly protected passwords since 2022, now would be a good time. (via Krebs on Security)

Intel partners weigh sharing less intel: Several major intelligence partners to the U.S., including the Five Eyes (think U.K., Canada, Australia and NZ) as well as others, like Saudi and Israel, are considering sharing less intelligence with the U.S. government amid the Trump administration's "warming relations with Russia," according to sources speaking with NBC. Remember, plenty of countries still distrust Russia and Putin (and for good reason). (via NBC News)
~ ~

THE HAPPY CORNER
Welcome to the happy corner, some say the Calmest Place™ on the internet.

First off, hats off to this kid, who is clearly onto a good idea.
Dr. Amy, Psy.D post on Mastodon: "I met a child today (not a client) who meowed when I said hi. The parent said, 'that’s what she does when she doesn’t want to talk to someone.' I’ll be adopting this practice."
Here's a fun weekend project: the EFF have open-sourced and published their Rayhunter cell-site simulator detector, which can detect some cellular spying from law enforcement devices. It's pretty easy to get started, and you only need a $20 hotspot as hardware. The project is on GitHub, too. (I can't wait to try it out for myself like the folks at Wired ($) did at the DNC last year.) Also, @neurovagrant has some posts, too; apparently it can take as little as 10 minutes to get started.
Meanwhile... this post made me chuckle. Keep a pair in your "in case of cyberattack" break-glass box.
Alissa post on Mastodon: "Scissors: the ultimate firewall ✂️"
And finally, this week. A final moment of zen from Inspirational Skeletor, who always has your best interests at heart (plus: technically bonus cybercat!).
Inspirational Skeletor post, showing Skeletor in a onesie blanket with a glass of wine, on a couch with a cat(!) and a fireplace in the background, featuring the words: "mastering being detached from everything yet being connected to everything at the same time… is the secret to life"
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cybercat-friend is Gabby, who can be seen here snoozing while waiting for their human to finish VR'ing for the day! Thanks so much to Karma for sending in; and a special shout-out to Mr. Pudalof who was the catalyst to getting Karma into VR gaming and software development — that's so awesome to hear!
Gabby is a geriatric dachshund, who is brown and very cute and sleeping, waiting for her human to get off of VR to play.
Keep sending in your cyber-cats! Drop me an email at any time with a photo of your cyber cat (or non-feline friend) along with their name, and they'll be featured in an upcoming newsletter. Feel free to send in updates, too; always welcome!
~ ~

SUGGESTION BOX
Thanks so much for reading this week's newsletter! It was yet another busy week from, well, ~gestures wildly in every direction~ and as usual, I'll be back next with all you need to know from the past seven days in cyber-land.

Please do get in touch to share anything for the newsletter. For now, I'm off to get a bagel and enjoy the first day of daylight saving... a very near-7pm sunset today here in the New York City area, and I am absolutely here for it.

Meow for now, I guess?
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — march 2 edition

✇~this week in security~ Archive Feed
this week in security — march 2 edition
North Korea's $1.4B crypto heist, US soldier tried to sell hacked telco data, Cellebrite cuts off Serbia, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 9
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

How North Korea pulled off a billion-dollar crypto heist
Ars Technica: The North Koreans pulled off the biggest heist in history, some $1.4 billion, according to the FBI's official attribution and security researchers who traced the funds. The FBI said [PDF] the rogue state was "responsible" for the theft at Bybit, and blamed the hack specifically on the group known as TraderTraitor (aka Lazarus), which typically targets crypto thefts to fund its sanctioned nuclear weapons program. The hackers stole the funds from Bybit's cold multi-sig wallet (which is supposably offline and requires multiple authorized users to withdraw funds) that relied on manipulating the "signing interface" used to access the cold wallet, suggesting a broad and pretty deep hack of multiple Bybit systems. Details of the attack remain vague but clearly capable of pulling off an unprecedented billion-dollar hack.
More: Bybit | FBI IC3 [PDF] | Trail of Bits | TechCrunch

U.K.'s HCRG breach affects thousands of patients and employees
SuspectFile: A week after U.K. private healthcare giant HCRG (formerly Virgin Care) said it was hacked, the Medusa ransomware gang has taken credit for the breach, saying it has more than 50 terabytes of stolen data — including employees' personal information and patients' private medical records and financial data. Some of the internal data appears to contain references to HCRG's internal Windows network, showing proof of access. HCRG has more than half a million patients across the U.K. so expect this to be a potentially sizable breach. The ransomware gang has threatened to release the data if a ransom of $2 million isn't paid. HCRG still has nothing on its website for individuals affected by the incident.
More: The Register | DataBreaches.net | BBC News

U.S. soldier tried to sell hacked AT&T, Verizon data to foreign government
404 Media ($): From a massive breach of U.K. health data to the missing reams of billions of AT&T and Verizon phone logs... we're back in the U.S. with a filing from federal prosecutors asking that former U.S. Army soldier and telco hacker Cameron Wagenius, who has pleaded guilty, is kept in custody arguing that he presents a flight risk. Per the filing this week, the former soldier apparently searched the web for how to defect to Russia (very bad opsec here) and wanted to sell the information to an unspecified country's intelligence service (we can only guess...). Wagenius made off with most of AT&T's customer phone records for a year, and thousands of Verizon logs as well, proving to be one of the largest breaches of 2024.
More: Bloomberg ($) | Krebs on Security | Cyberscoop
~ ~

THE STUFF YOU MIGHT'VE MISSED
The 'worst' year in internet shutdowns
Access Now: New data from rights group Access Now shows there were at least 296 internet shutdowns across 54 countries throughout 2024, which the group says affected many countries across Africa. Internet shutdowns have been weaponized to prevent information-sharing on the ground (such as documenting abuses) amid war, conflict and authoritarian rule. Axios has some brief yarn.

Qilin ransomware gang takes credit for Lee Enterprises hack
Bleeping Computer: Prolific ransomware gang Qilin has taken responsibility for the hack at Lee Enterprises, the newspaper publishing giant that owns more than 70 media outlets. Lee said some of its critical systems were encrypted (read: ransomware). Qilin posted some of the stolen files on its dark web leak site in an attempt to extort the company. To date, much of the company's internal systems for newsgathering and printing have been knocked offline by the cyberattack.

23 billion credentials stolen by infostealer malware
Troy Hunt: Absolute monster of a leak here: some 23 billion rows of credentials stolen from the ALIEN TXTBASE stealer logs, containing around 493 million unique website and email address pairs of credentials, are now in data breach notification site Have I Been Pwned. (And yet incredibly, this breach still isn't in the site's top 10 data breaches by size.) Malware and infostealer logs are increasingly popular with bad actors; with stolen credentials (and no MFA!), hackers have gained access to customers' data stored on Snowflake, Change Healthcare, and so many mega data stores. All too often folks download dodgy or pirated software that contain password-stealing malware.

Cellebrite cuts off Serbia after further spyware abuses
Amnesty International: Weeks after Serbian cops were caught red-handed using Cellebrite's phone unlocking tech to break into the phones of arrested individuals to plant spyware, security researchers at Amnesty International caught the cops by doing it again against two further individuals. Cellebrite — which is shocked, shocked to learn that its technology was used for human rights abuses, cut off Serbia, per a statement. In the process, Google fixed three zero-day bugs in Android that Cellebrite's equipment was used to unlock affected phones. (via @tek)
Rory post on Mastodon: "In our new report today, we detail the exploit chains in Linux kernel USB drivers that forensic traces show were likely used by Cellebrite to unlock Android phones in Serbia. We collaborated with Benoît Sevens @ Google TAG, who found and patched 3 kernel vulnerabilities. This highlights the large attack surface presented by rogue USB devices to Android and other Linux devices. Some of the vulnerable code paths were introduced almost 15 years ago!"
Belgium probing intelligence service email hack linked to China
TechCrunch: The Belgian prosecutor's office is investigating (en français) a breach of the state intelligence agency VSSE by Chinese hackers, who were able to exfiltrate something like 10% of the organization's incoming unclassified emails by way of a bug in Barracuda's email technology.

New Zealand firm blames researcher for company's own leak
JayeLTee: Teammate App, a NZ-based firm, claims a security researcher criminally hacked its database... Just one big problem: The researcher has the receipts, and showed the company had a huge self-owning data exposure from one of its internet-connected databases that wasn't protected with a password. Instead of taking the L, Teammate App's CEO blamed the researcher — wrongly. More words from @GossiTheDog on this latest example of gross corporate behavior.
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Four out of Five Eyes don't recommend Kaspersky: Australia has become the latest of the Five Eyes intelligence alliance of countries — though notably not New Zealand (yet — afaik!) — to ban Kaspersky products at the government level. The Aussie government said it was due to the "unacceptable security risk" that the software poses, in large part for its connections to Russia. Kaspersky said it was disappointed with the decision. (via Australian Government)

Ransomware gang hits Aussie IVF giant: Sticking with Australia for a minute; one of its largest IVF providers Genea was hacked and experienced a huge data breach amounting to almost a terabyte of data, claimed by a ransomware gang called Termite by publishing some of the stolen files on its dark web leak site. Genea says the hackers compromised its patient management system, so expect a lot of highly sensitive information to have been stolen. (via Genea, The Guardian)

Building access control systems exposed to the 'net: Dozens of apartment buildings across the U.S. and Canada are running a Hirsch-made door access control system connected to the internet but are still using the default password that shipped with it, per Eric Daigle. Yes, default credentials are still a thing — and allowed anyone access to building door locks and elevator access controls. In this case, the company will soon fix the bug. (Disclosure alert: I wrote this story!) This is the same week that security researchers at Modat found thousands of access management systems exposed to the internet — including resident and owners' personal information. (via TechCrunch)
A screenshot showing an exposed Hirsch building access control panel, with access to its control systems, such as locks and elevators.
Tower dumps ruling a rare win for privacy: A federal judge in Mississippi says the law enforcement use of "tower dumps," where large swathes of data from cell towers are grabbed and analyzed for criminal activity, is unconstitutional (under the Fourth Amendment). Details of the case remain under seal, but the outcome is particularly good for privacy as cell tower data, much like other bulk collections of data, can include entirely innocent people's data who aren't connected to a crime. Expect appeals, but this is a good sign. An exclusive story via Court Watch, so definitely throw them a subscription if you can. (via Court Watch ($), @campuscodi)

24 reasons not to use stalkerware: Another day, another buggy stalkerware. This time it's Spyzie, the third variant of Cocospy, which shares a common bug that allowed a security researcher to access half a million email addresses of Spyzie customers who use the service to snoop on the phone of someone else (often spouses and romantic partners). These email addresses of abusers are now in Have I Been Pwned. Spyzie was found on both Android devices and iPhones. The stalkerware is now the 24th phone monitoring app since 2017 to have been hacked or exposed its users' data. (Disclosure: I also wrote this!) (via TechCrunch, HIBP)
Have I Been Pwned tweet: "New sensitive breach: Spyware service Spyzie had almost 519k email addresses breached this month. The exploited vulnerability also granted access to captured messages, photos, call logs, and more. 48% were already in @haveibeenpwned."
U.S. halts offensive cyber ops against Russia: The U.S. government has ordered U.S. Cyber Command to "halt offensive cyber and information operations against Russia" amid ongoing negotiations to end the war in Ukraine, which started after Russia launched its full-scale invasion of Ukraine in 2022. The Post cited officials as saying the move was a concession to bring Russia's President Putin to the negotiating table. Espionage continues, per one former official. "The reason you don’t stop espionage is you want to know if they’re lying to you," the former official said. (via Washington Post ($), The Record)
~ ~

THE HAPPY CORNER
A warm, fuzzy welcome to the happy corner... but please, shhh...
An animated GIF of a cat, asleep with its head on a keyboard, and the camera panning to and from the display, which is a text document that's filled with a million Z's.
This digital sign is an absolute mood.
An orange LED digital sign that reads: "cmd.exe" (for a Windows command prompt, followed by the words, "The system cannot"... and the rest of the sentence is cut off.
A lot of folks who work in government have been affected by layoffs and workforce reductions, including cyber and digital folks at CISA, 18F, and GSA among others. Former CISA director Jen Easterly posted on LinkedIn setting up a site matching CISA alumni with hiring employers. The Google Form is here.

And lastly, pour one out for Skype, which Microsoft is retiring on May 5 after more than two decades in operation. Skype was an early pioneer of end-to-end encryption. Skype was... buggy a lot of the time to say the least. Still, I have fond memories of using it almost every day for at least a decade.
Fochti post on Bluesky: "me, not having used skype in over a decade: oh no, skype is shutting down ☹️ sad"
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Forest, who as you can see... clearly needs all of my passwords, and my Social Security number.... and I see no reason why Forest can't take my credit card, too... you know, for good measure, obviously. With those hypnotic eyes, Forest is a purr-fect social engineer, so here are my car keys, too. Thanks to Irene for sending in!
Forest is a jet black cybercat with hypnotically beautiful eyes, sat with their paws in front of them. Perfect kitty.
Keep sending in your cyber-cats! Drop me an email at any time with a photo of your cyber cat (or non-feline friend) along with their name, and they'll be featured in an upcoming newsletter. (Updates are welcome!)
~ ~

SUGGESTION BOX
And that's it for this week's busy update! Thanks so much for reading, it's a joy to write and bring this newsletter every week from the U.S. east coast to you, wherever you are in the world.

By the way... if you like this newsletter, please tell a friend or feel free to forward this email along. I don't do any advertising for this newsletter beyond the occasional Mastodon post, but always keen to reach news readers.

I'll be back next week with everything you need to know from the week. Get in touch if you have anything to share; including any good news and your cyber cats!

Until next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — february 24 edition

✇~this week in security~ Archive Feed
this week in security — february 24 edition
Apple drops ADP for UK users, DOGE at CISA, Lee Enterprises hit by ransomware, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 8
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Apple pulls iCloud encryption feature after U.K. government 'backdoor' row
BBC News: Apple has pulled Advanced Data Protection, its opt-in security feature that adds a lot more E2EE to customer's data stored in Apple's iCloud, following a demand from the U.K. government to add a secret backdoor. Apple had the option to open up the backdoor, or get out. Apple chose to do neither and pulled the feature altogether, effectively weakening the security of every U.K. customer as a result, but also internationally (since now that the U.K. got its demand, now any authoritarian country can demand the same). ADP protects things like photos, notes, and other data in iCloud, which can now be accessed pursuant to a court order. Apple, a company worth more than $3 trillion, chose to take one that weakened the security of its U.K. users while allowing the company to continue profiting from its customers. Apple has long called privacy a "fundamental human right," but clearly up to a point of its own choosing.
More: Washington Post ($) | Bloomberg ($) | Associated Press | TechCrunch | EFF | @matthewdgreen | @davidtpegg
A screenshot from an iPhone showing Advanced Data Protection in the settings menu, with a message that reads: "Apple can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users."
DOGE at CISA as federal cyber workers brace for firings
Wired ($): @KimZetter reports that DOGE, the team of government cost-cutters working for the world's richest man, Elon Musk, is now at CISA. The 19-year-old DOGE staffer Edward Coristine, aka "BigBalls" (per his since-private LinkedIn) is at the federal government's cyber agency, along with DOGE technologist Kyle Schutt, who're listed in the staff directory. (@marisakabas and @kevincollier also confirmed.) It's not clear what they're up to or after, but CISA has already seen its staff drastically cut, with fears that several hundred employees could also go at NIST, which sets the U.S. government's standards and benchmarks (including cyber and the National Vulnerability Database).
More: Wired ($) | NextGov/FCW | TechCrunch

Lee Enterprises hit by ransomware; newspapers face ongoing disruption
TechCrunch: Newspaper publishing giant Lee Enterprises is still hobbled after suspected ransomware (per the company's 8-K filing this week), which said the cyberattack on February 3 "encrypted critical applications, and exfiltrated certain files." (Disclosure: I wrote this story!) Lee publishes dozens of newspapers, many of which still can't access files or systems on Lee's network. Several news outlets across the U.S. continue to face disruption and can't print all of their papers on time. The Freedom of the Press Foundation has a running list of affected outlets.
More: SEC EDGAR | The Daily Progress | The Register

Google's ad-tech can target natsec 'decision makers' and the chronically ill
Wired ($): Fascinating reporting by Wired, citing data obtained from Ireland's oldest independent human rights body, looking into how Google's ad-tech platform can be used to target ads at specific banned audiences, including people with chronic illnesses, financial distress, and those who work in the field of national security as "decision makers." The data is from DV360, Google's ads platform for high-end paying customers, which currently hosts as many as thousands of restricted "audience segments" that can target practically anyone — and very helpful to foreign adversaries (or hell, even potentially those here in the United States).
More: @jshermcyber | @doctorow tweets
~ ~

THE STUFF YOU MIGHT'VE MISSED
VC giant Insight Partners says it was hacked
Calcalist: Venture capital firm Insight Partners, which has invested in Wiz, Wix, Optibus, and more, confirmed this week it had been hacked, following a report from Calcalist. Insight said very little in its statement, but added that it had notified "stakeholders connected to Insight" (read: founders and investors) "irrespective of having shared data compromised." Ah, so some data was compromised... gotcha.

Inside one of NSA's hacks, according to China
@inversecos: Really interesting research looking at an alleged hack of one of China's top universities that China blamed on the U.S. National Security Agency. While the allegations can't be verified (yet), the research looks from China's lens about the attacks and how the attribution to the NSA went down. (We don't hear often about U.S. or Western-led cyberattacks, so this was worth flagging.)
A screenshot showing how the hack of the university allegedly went down, showing how the NSA allegedly used a FoxAcid server to redirect web traffic data to NSA-controlled servers.
Google researchers warn of Russian attacks targeting Signal users
Google: Security researchers at Google's threat intel unit found evidence that several Russia-backed hacking groups are compromising Signal Messenger accounts using the built-in "linked devices" feature (for connecting the Signal mobile app to the desktop app). Targets are sent QR codes that, if scanned, will also deliver future messages to the threat actors, allowing for stealthy surveillance. Google said it's seen the notorious "Sandworm" hackers use this technique, often for targeting Ukrainian military units.

Network edge devices fueled hacking sprees in 2024
Cyberscoop: Turns out that 2024 was an absolute fustercluck for enterprise edge devices — the firewalls, VPNs and other access control systems that sit on the perimeter of your company's network. New research (Darktrace has its full report behind a sign-up form — ugh) found bugs in a range of Ivanti, Fortinet and Palo Alto devices, which put those companies' customers at risk from hackers breaking in. Some of the bugs were widely exploited during 2024, thanks to shoddy vendor coding and in the face of layoffs at some of these vendors. This comes in the same week as a new zero-day in Palo Alto Networks' firewall software (🫠) that is currently being exploited.

Microsoft patches Power Pages zero-day bug
MSRC: Microsoft has patched a zero-day bug under attack in its Power Pages website builder that allows malicious hackers to create new accounts with high-privileges on a customer's website. Microsoft said "affected customers have been notified." Let's just hope Microsoft hasn't emailed customers to an account that some never check, like it has in the past! (via @campuscodi)

Huge trove of Black Basta ransomware gang chat logs leak
TechCrunch: Notorious ransomware gang Black Basta (which has been largely quiet since the start of this year) had a year's worth of internal chat logs leaked online, thanks to security researchers at Prodaft. TechCrunch obtained the logs (which have since been made public) and pored over them; they include some interesting details about attacks, exploits, unreported targets, and some new victims. One of the hackers says they're only 17-years-old, while others discussed their concerns about getting vanned by the U.S. (and Russian!) governments. (Disclosure: I co-wrote this story!) @GossiTheDog has a good toot-thread on the highlights.
~ ~

OTHER NEWSY NUGGETS
Feds fine Warby Parker: The healthcare feds say eye-glass startup Warby Parker is on the hook for a $1.5 million fine after the company was found to have made security failings prior to a credential stuffing attack in 2018. The compromised data affected some 200,000 people, and hundreds of folks whose protected health information was also accessed. (via HHS [PDF], The Record)

Australia's Genea IVF reports breach: Some five days after its phone lines went kaput, Australian IVF giant Genea confirmed a cyberattack that "accessed Genea data." Whether that's customer or employee data, it isn't known just yet. But at least it was enough time to call in the crisis comms PR firm Porter Novelli to handle the company's scandal instead of responding to the Australian reporters who first reached out about the breach. (via Genea)

Record breaking crypto heist: Bybit, the world's second largest cryptocurrency exchange, was hacked. One of its cold (read: allegedly offline) wallets was compromised and some $1.4 billion worth of crypto stolen, tanking the price of Ethereum with it. Crypto investigator @ZachXBT linked the heist to North Korea, which wouldn't be a huge surprise given it's need for crypto to make nuclear weapons. If we start seeing bedazzled nukes, we know the North Korean regime was for sure behind the hack. (via TechCrunch)

$500k stolen from NioCorp in redirected payments: Someone broke into mineral discovery firm NioCorp's network and redirected $500,000 in vendor payments, likely to an account held by the hacker. The company disclosed the hack and theft in an 8-K filing with the SEC. (via SEC EDGAR)

Cocospy, Spyic exposed as stalkerware operations: Enter the (at least) 22nd and 23rd stalkerware security incident since 2017, Cocospy and Spyic, two near-identical "stalkerware" mobile apps that can steal data from a victim's phone in real-time. A bug exposed millions of victims' data, as well as the email addresses of the bad people who signed up to spy in the first place. Those abusers' email addresses are now in Have I Been Pwned. I wrote about the breach, and also have some guidance on how to find and remove the spyware apps (if it's safe to do so). (Disclosure: I also wrote this story; busy week!) (via TechCrunch)
Evacide post on Mastodon: "With Cocospy and Spyic, you can usually enter ✱✱001✱✱ on your Android phone app’s keypad and then press the “call” button to make the stalkerware apps appear on-screen — if they are installed. This is a feature built into Cocospy and Spyic to allow the person who planted the app on the victim’s device to regain access. In this case, the feature can also be used by the victim to determine if the app is installed."
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Welcome back to the happy corner. There's not much this week, aside from a couple of bonus cybercats.

In pretty funny (but also somewhat alarming) research, the folks at Truffle Security found a popular temperature controlled Eight Sleep bed exposed SSH access to any customer's bed by way of a backdoor update function. But, on the bright side, nothing an aquarium chiller couldn't fix. More from Bloomberg ($).
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cybercat-pup is Kenobi, whose human tells me that he protects the house from all the delivery drivers and suspicious people who have the audacity to pass by. That's some next-level perimeter threat detection, Kenobi. Who's the best pup? Thanks so much to Aly for sending in!
Kenobi is a very handsome grey and brown pup waiting to eat a cookie from his human's hand.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
And that's it for now — join me next week for the usual gamut of all the cyber news you need to know. Thanks for reading! As always, please get in touch if you have anything you want to share for the newsletter.

Catch you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — february 16 edition

✇~this week in security~ Archive Feed
this week in security — february 16 edition
CISA layoffs, Patch Tuesday fixes zero-days, Phobos ransomware gang arrested, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 7
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Bruce Schneier: 'DOGE is hacking America'; as CISA hit by layoffs
Foreign Policy: We start this week with the federal government (again). (Sigh; I know, but don't get cross at me, I'm not the one doing the things.) To wit: legendary security pro Bruce Schneier described the ongoing DOGE takeover of government as the "most consequential security breach" in its history as court battles go on to rein in DOGE's access to, well, practically everything the government has — including classified data, some of which DOGE posted online. The EFF has arrived and is here to help, chiefly by suing to block the ransacking of (our!) data. As things pertain to cyber, the folks at CISA got hit hard by layoffs, with some 130 staffers laid off and its election security staffers placed on leave — but sure, the security of DOGE's own website is jusssst great... (it's not). There are more and ongoing layoffs across government, including infosec folks at the U.S. Digital Service, leaving few — if anyone — able to defend these systems from attacks.
More: Bloomberg ($) | SecurityWeek | Foreign Policy | Zero Day | Cyberscoop | Popular Information | NPR | @w7voa | @metacurity
Elizabeth Landers tweet: "A DHS statement to @scrippsnews confirms that some CISA employees who worked on "mis-, dis-, and malinformation, as well as foreign influence operations and disinformation" have been put on admin leave," followed by a screenshot with a statement that reads: "Statement attributable to DHS Assistant Secretary Tricia McLaughlin:As Secretary Noem stated during her confirmation hearing, CISA needs to refocus on its mission, and we are starting with election security. The agency is undertaking an evaluation of how it has executed its election security mission with a particular focus on any work related to mis-, dis-, and malinformation. While the agency conducts the assessment, personnel who worked on mis, dis-, and malinformation, as well as foreign influence operations and disinformation, have been placed on administrative leave."
Microsoft fixes two zero-days in February's Patch Tuesday
Krebs on Security: Roll up, roll up, it's patch-yo'-systems o'clock — and this month's round of security fixes includes patches for two low-complexity zero-days, which are being exploited in the wild. One of the bugs (CVE-2024-38193) is under attack by North Korean hackers to maintain persistence to a compromised system, meanwhile Rapid7 added that another bug, CVE-2025-21418, should be prioritized as this bug has "no requirement for user interaction" to be exploited. Separately, Apple fixed a zero-day bug in iPhones and iPads that may have been exploited (heavy wink) in what it calls an "extremely sophisticated attack" to disable USB Restricted Mode on a locked device.
More: Sophos | Cyberscoop | TechCrunch

DOJ arrest two Russians accused of running Phobos/8Base ransomware gangs
Justice Department: The U.S. feds have nabbed two Russian nationals, Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, accused of running the Phobos ransomware crew (which also went by 8Base), effectively shutting the operation down. Europol also participated in the operation. After the arrests and server seizures, the feds alerted some 400 companies that they were compromised. In the end, the gang targeted over a thousand victims during its time, and netted some $16 million in ransoms. Security researchers noticed the site was seized a whole day before the feds announced its action. Relatedly, U.S. and U.K. governments have sanctioned the Russian "bulletproof" (aka, hosts anything) hosting service zServers, which the feds claim supported LockBit attacks. The Dutch dismantled much of zServers' infrastructure.
More: State Department | The Register | TechCrunch
A website seizure notice for the 8Base ransomware gang's website, featuring logos of various international law enforcement agencies, including Germany, the FBI, the U.K. and Europol.
~ ~

THE STUFF YOU MIGHT'VE MISSED
Russian spies caught using 'device code' phishing attacks
Volexity: Multiple groups of Russian hackers are using a 'device code' phishing attack, which takes advantage of a device flow weakness that Volexity warns that users "may not recognize it as phishing." The compromise targets Microsoft 365 accounts, and the hackers have been seen sending legit-looking emails as if they came from government departments and others. More from Ars Technica.

Bug leaked email address of any YouTube user
Brutecat: Interesting finding by @brutecat, who found it was possible to obtain the email address of any YouTube user. The bug was exploitable thanks to a forgotten Google product that allowed the conversion of a YouTube user's obfuscated unique ID (called Gaia, which Google uses across products) into an email address. Ta da! The bug netted the researcher $10,000 in a bug bounty payout and got the bug fixed. Never forget your legacy endpoints!
An animated GIF showing the copying of a public YouTube channel ID and pasting it into a terminal window, which after a brief moment returns the YouTube user's private email address.
Security experts denounce U.K. iCloud backdoor demand
Global Encryption Coalition: The U.K. unilaterally decided last month [correction: last edition I mistakenly wrote last year, apologies!] that British officials can demand Apple open up its iCloud cloud service to allow access to data on any Apple user anywhere in the world. A lot of very smart people — specifically 193 (at the time of this newsletter) — think this is a very bad idea, and wrote an open letter to the U.K. government to that effect. The letter is pretty much a who's who of incredible security people — Callas, Grossman, Landau, Mill, Pfefferkorn, and White, to name a few as signatories. Let's hope someone over there in the U.K. listens. (via @josephhall)
~ ~

OTHER NEWSY NUGGETS
Media outlet outages after Lee cyberattack: Dozens of newspapers and media outlets that rely on publisher Lee Enterprises reported outages and disruption after Lee was hit by a cyberattack last week. (Disclosure: I wrote this story!) One of its datacenters was hit, per an email I obtained from Lee notifying customers of the incident. Lee said it was working to "fully restore our systems," while newspapers are still locked out of some of their most important technologies and systems. (via TechCrunch, St. Louis Post-Dispatch ($))

Sandworm's initial access broker revealed: Meet BadPilot, said to be a subgroup within the notorious Russian intelligence unit dubbed Sandworm. Microsoft dropped new details of the subgroup, thought to be an initial access broker that breaks into networks and then hands off that access to Sandworm proper for conducting data theft or causing destructive cyberattacks. Microsoft says BadPilot takes a "spray and pay" approach to hacks — seemingly picking indiscriminately, then coming back to see what they like, per @sherrod — but has been focusing on Five Eyes countries (UK, Canada, the U.S., etc.) of late. (via Wired ($))

Gotta catch 'em all, spyware makers: Italian spyware maker SIO was caught making and distributing Android spyware for years, per @lorenzofb, who obtained samples that were masquerading as WhatsApp and other popular apps. The spyware is called Spyrtacus, and was traced back to the Italian company (which also sells its services to the Italian government), thanks to the awesome researchers at Lookout who analyzed the samples. (via TechCrunch)

Bye, bye, Variston, you won't be missed: Now there's one less spyware maker in the world, thanks to the shuttering of Barcelona-based Variston, which was outed by Google in 2022 as a secret spyware developer, and later lost a ton of staff following Google's report. Now it has fully "liquidated," per business records. Don't forget to switch the lights off... (via Intelligence Online ($), TechCrunch))
 
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
The happy corner isn't just a quiet oasis on the burning hellscape of the internet, it's very much a state of mind. Ahhhhhh, and breathe.

The Watergate Hotel had a data breach... (yes, that Watergate Hotel). And the jokes pretty much just write themselves at this point.
Lucky225 post on Bluesky: "Someone broke into Watergate again lol"
And, since it's a happy corner on the lighter side this week (have you seen what's happening outside?!) — please enjoy this bonus cybercat from the Rare Personal Collection™. I call this particular piece, Theo aka Long Cat.
Theo is my youngest cat, who can be seen here stretched out on the rug, with his belly fuzz exposed, half asleep.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber-cat is Tabasco, who can be seen here checking his human's code... don't let me disturb you, Tabasco, you're doing important work. (He's the lead developer, you know.) Thank you so much to Adwayan for sending in!
Tabasco is an orange and white kitty who is sat on his human's desk, with one of his paws on the keyboard, looking in the direction of the computers screen, which has a bunch of code on it. Very, very cute kitty.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
That's it for this week's.... well, whatever that was. Thank you for taking the time to read, and I hope that you enjoy the rest of your weekend. If you want to reach out with anything for the newsletter — a cyber cat (or friend), or some good news that you've come across, please do get in touch.

As for me, I'm off to make another pot of coffee, grab some breakfast, and then go outside and touch grass snow. (Yes, still.)

Dreaming of a warm beach somewhere...
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — february 9 edition

✇~this week in security~ Archive Feed
this week in security — february 9 edition
Musk's DOGE takeover of the U.S. goverment, Paragon spyware victims come forward, U.K. demands Apple cloud backdoor, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 6
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Elon Musk's takeover of the U.S. government exposes millions of people's data
Wired ($): We start this week with a five-alarm fire across Washington DC as Elon Musk and his band of teenagers lackeys are well and truly in government, literally, plugging into sensitive systems across the U.S. federal government despite their highly questionable clearances. It's hard to keep up with the pace at which Musk's so-called DOGE took control of Treasury payments systems that disburse $6 trillion in federal payments and obtained access to HR records of federal workers at the OPM, in what is essentially the biggest compromise of U.S. government data in, well, ever. (For the "well, actually" crowd, their clearance is temporary but vast, and their vetting nonexistent; it's still a breach.) A federal judge blocked DOGE from its access following a multi-state led lawsuit, but way too late and the damage is already done. Wired's reporting has been incredible as new details about how Musk — the world's richest man — is taking over government to cut spending and headcount seemingly at any cost and regardless of fallout or consequence. Well, yet — all in good time.
More: The Atlantic ($) | Techdirt | TechCrunch | Associated Press | Cyberscoop | NPR | Krebs On Security
A strip of three screenshots from The Simpsons of Moe ("US federal sys admins") throwing out Barney ("DOGE staff with domain admin") from the bar, then Barney reappearing behind Moe.
U.S. intelligence, cyber agency staffers offered deferred resignations
NPR: As part of the ongoing efforts by Musk to shrink the U.S. government, federal workers at U.S. intelligence and cyber agencies — including NSA, CIA and CISA — have all been offered deferred resignations and retirements, leading to concerns about U.S. cyber defenses... yeah, not great! Federal national security workers were largely exempt from the OPM's offer to let federal employees leave the workforce, but that seems to be changing. This is the same week that the new CIA director John Ratcliffe sent an unclassified email containing partial CIA employee names to the White House — which left former officials aghast at the security lapse. Will the last federal worker turn the lights and, for the sake of the federal enterprise, also power down the routers?
More: The New York Times ($) | NPR | The Record

Italy says dozens of EU citizens targeted with Paragon's spyware
TechCrunch: Let's switch gears to something a little ligh...oh come on! ...OK, here we go: it's nation state spyware time. It looks like Italy is in hot water after several people — all of whom are in some way critics or under the watch of the Italian government — were identified as having been targeted by the Israeli spyware Paragon. WhatsApp disclosed the campaign last week, revealing that Paragon's spyware (known as Graphite) was used to target around 90 people, including journalists. Paragon later cut off Italy from its spyware after the Italian government said it absolutely wasn't them who did the spying and instead alluded to the dozen or so other countries whose citizens were spied on, including Austria, Denmark, Germany, Greece and Spain, essentially pointing the blame at one of them (some of which are known customers of spyware makers). Who was it? Who knows — but we do know that Paragon confirmed this week the U.S. government is a customer. We'll see what comes of this; all eyes are on Paragon.
More: Reuters ($) | Haaretz ($) | The Guardian | Euractiv | BBC News | @sophieintveld

U.K. orders Apple to let it spy on users’ encrypted accounts
Washington Post ($): Sorry... but it looks like we're dusting off another iteration of Crypto Wars, this time, it's the British Edition. (I'm taking this one personally.) Last year, the U.K. government essentially secretly ordered Apple — by way of its Snoopers' Charter surveillance law — to grant U.K. authorities access to protected cloud backups around the world — regardless of which country they're in — setting a really, really dangerous precedent. It's not likely that Apple will allow access (since Apple's cloud backups are encrypted and only the user can unlock them) and would more than likely stop offering the service in the country, known as Advanced Data Protection. This is really not a good look from the (relatively new) U.K. government — the Labour Party has been hellbent on surveillance for years and clearly this is no different. And now China or any other authoritarian country can demand the same access by saying, "well, the U.K. did it — why can't we?"
More: @matthewdgreen posts | @mattburgess1 | The Register
Matthew Green post on Bluesky: "The insane thing about the U.K. law is that it does not only apply to U.K. customers. It can potentially be used to go after non-UK customers as well. Say, people here in the US."
~ ~

THE STUFF YOU MIGHT'VE MISSED
Meet the hired guns who make sure school cyberattacks stay hidden
The 74: A really deep dive story into the strategies — think, lawyers and crisis comms PR — that schools and districts use to hide cyberattacks that expose the personal information of students, parents and teachers. @mkeierleber also goes behind the scenes with how he investigated the story. Remember: the goal should be transparency, not "CYA." Plus, incredibly, bonus cybercat, and sprinkling of additional context from @douglevin.

Law enforcement hammered cybercrime in 2024, with ransom payments down
Intel471: New data and analyses this week shows how the cybercrime industry was hit by several law enforcement actions over the past year, including LockBit's takedown, arrests in the Com (aka where cybercrime meets physical violence), and several other cybercrime forums, hobbling the biggest criminal operators of recent years. Plus, per Chainalysis, data shows that while more victims were targeted by ransomware, fewer corporate victims actually paid (though some did, like Cencora's $75 million to hackers). On the government side, Bloomberg ($) reports that DHS' cyber cops stopped at least 500 ransomware attacks last year.

Android bugs fixed, including an actively exploited flaw
Cyberscoop: Google has fixed dozens of flaws in Android, including CVE-2024-53104, which Google says is under active exploitation. Specific details weren't given about how, exactly, but Google said the bug could result in a "physical" escalation of privilege. Based on that, it's likely the bug was used by a law enforcement-capable mobile forensics device, such as Cellebrite or the like, which can unlock some phones protected by a passcode.
~ ~

OTHER NEWSY NUGGETS
GrubHub delivers fresh hot data breach: U.S. food delivery giant Grubhub said hackers accessed the personal data of its customers and drivers after breaching internal systems, which it traced to one of its third-party vendors. No word on the number of affected individuals, although the data includes names, email addresses, phone numbers, and last four digits of the card number. (via TechCrunch)

Former Polish justice minister nabbed: Polish police arrested the country's former justice minister, alleging he allowed government funds to pay for spyware that was used to snoop on the country's then-opposition leaders, per local news. Poland's new-ish left-leaning government has been cleaning up from its past administration. See? Sometimes there can be consequences for bad actions. (via The Record)

Zyxel says replace routers hit by zero-days: In extremely bad form, router maker Zyxel told customers that they should replace routers affected by two zero-day bugs under active exploitation because the company says the affected devices are end-of-life. But... Zyxel appears to be selling affected models through Amazon, and there's no mention of the allegedly ended product on its end-of-life pages. Censys says there are 1,500 vulnerable devices on the internet (at least). Let's hope none of them are being actively ensnared by a Mirai botnet.. (via GreyNoise, Zyxel)
da_667 post: "mirai doesn't care if you made that router EOL."
HPE alerts victims of Russian cyberattack: Hewlett Packard Enterprise alerted victims of its Russian government hack (back in 2023) that allowed the hackers access to mailbox data and other internal company data. Microsoft, whose cloud hosted HPE's mailbox data, was hacked at around the same time. (Disclosure: I wrote this story!) (via TechCrunch, DocumentCloud)

PowerSchool hack affects thousands of U.K. kids: The PowerSchool hack goes international. As North Carolina's attorney general investigates PowerSchool's massive breach, the school tech company confirmed that at least 16,000 school kids in the U.K. had their personal data stolen. That's on top of the likely millions of kids across North America who had their personal data stolen, too. PowerSchool still won't provide a number of affected folks — in what is likely one of the biggest breaches of school data of the year, despite the company continuing to say very little. (via TechCrunch)
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
And not a moment too soon... here's this week's happy corner. Let's see how Hello Kitty is doing; if anyone's a barometer for the state of the world, it's h... oh no.
A person in a full Hello Kitty body suit wearing a pink dress, and holding a chainsaw in what appears to be an office.
Definitely a mood.

Incredibly, it's been ten years since this incredible tweet by @thegrugq. Nowadays we have phishing, smishing, quishing, vishing... or, as some call it... still phishing.
The Grugq tweet from 2015: "Give a man an 0day and he'll have access for a day, teach a man to phish and he'll have access for life."
There is some actual good news... What Will Doom Run On? is back! Turns out you can run Doom on an Apple Lightning to HDMI adapter... because of course you can, thanks to its embedded Samsung-made chip. Very impressive. (Video at source.)
A photo of Doom running on a computer monitor connected to a Mac; the chip on the dongle is running the game.
The world may be on fire, but one thing we can all do is lend our support to those who need it, especially the kids out there (since the adults have absolutely wrecked the place). With that, it's Girl Scout Cookie Season, and there are so many troops out there to support. If you can, buy from your local community troop! Erin Reed also has her annual list of trans Girl Scouts troops to buy from and meet their goals, as well as Troop 6000, New York's dedicated troop for kids in the shelter system. (He writes, while submitting a new online order for another metric ton of cookies...)

And finally, this week. Shout out to Signal's president Meredith Whittaker (no relation), for this reminder. In times like these, Signal is more important than ever — and remember to donate to help it help us!
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber-cat friend is Maple, whose human tells me that she is very cat-like but unfortunately doesn't like cats because she was once bullied by some bodega cats. Aww, Maple! Bodega cats can be super territorial but also very friendly when they get to know you! A+ rain boot game. Many thanks to Gabby R. for sending in!
Maple is a black dog with a raincoat and the cutest yellow rain-booties, holding a stuffed toy in her mouth. Absolutely adorable.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
On that much needed lighter note — (honestly, a real highlight of my week) — I bid you good health and good day. Have a wonderful Sunday and week, and catch you next. Feel free to drop me an email with anything for the newsletter, including any good news you see, your cyber cats, and anything else you want to share.

Signing off from a snowy east coast,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — february 2 edition

✇~this week in security~ Archive Feed
this week in security — february 2 edition
Musk has 'full access' to sensitive Treasury systems, DeepSeek exposed database, WhatsApp says Paragon spyware hacked dozens, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 5
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Musk's DOGE team now has access to Treasury's payments system
The New York Times ($): Elon Musk's team of Department of Government Efficiency (DOGE) representatives has swept across government over the past week, locking out career civil servants at the Office of Personnel Management (the federal government's HR department) from their critical computer systems, and taking over the General Services Administration. Now, Musk and his team has "full access" to the Treasury's highly sensitive payments systems after the Treasury Secretary Scott Bessent granted the approval in the same week as ousting the department's top career official, who resisted the access. These payment systems are used for disbursing $6 billion or so to Americans, like tax rebates and Social Security checks, and contain highly personal information about the people who receive them, amid fears that Musk could selectively switch off payments to individuals. Ron Wyden said Musk's access was a national security risk, given his conflicts over his extensive business in China (which, let's not forget, has hacked the heck out of America of late). One former Republican strategist called Musk's access "the most significant data leak in cyber history... Private individuals in the data business now have access to your Social Security information." State AGs — well, some of them — will have a field day with this.
More: Reuters ($) | Wired ($) | TechCrunch | Associated Press | New Republic | @gregsargent | @stuartpstevens

FBI seizes Cracked, Nulled hacking forums in Operation Talent
Bleeping Computer: The FBI* (*what's left of the FBI) have seized the websites of two prolific hacking forums Cracked and Nulled, which prosecutors said allowed more than 10 million users between them to trade in hacking tools and stolen personal data. The FBI began seizing the domains on Jan. 29, which we saw thanks to public DNS changes. Two more sites were seized, too. The takedown operation, dubbed Operation Talent, saw two people arrested. A ton of countries were behind the takedown operation, including Australia, Germany, Greece and Spain. Bad news for anyone of the 10 million users between them, your data is in the hands of the feds. Per the DOJ, Cracked had stolen data on some 17 million Americans.
More: Reuters ($) | Cyberscoop | TechCrunch

DeepSeek exposed database spilling chat histories
Wiz: DeepSeek, the Chinese AI company, has become all the rage in recent weeks, allegedly outperforming some Western models. But one thing it wasn't doing so well was keeping its backend databases secured from the open internet. Wiz discovered one of its exposed databases without any authentication, containing a million logs — including chat histories (of what was entered into the prompts and what came back) and other sensitive information, like API keys. (These exposures are almost always due to human error.) DeepSeek secured the database after Wiz reached out — and later confirmed the fix in a note to the Wiz researcher, @galnagli. Wired ($) had a very good write-up.
More: Reuters ($) | Cyberscoop | @vxunderground
vx-underground tweet, with a meme of a man looking visibly upset by "China having your chat logs," but seems fine with "Everyone having your chat logs."
WhatsApp disrupts hacking campaign targeting journalists with Paragon spyware
TechCrunch: And here we are again. Meta's WhatsApp unit said it disrupted an attack that saw 90 users — including journalists and members of civil society — have their phones hacked with zero-click spyware developed by Paragon by way of malicious PDFs. (Lockdown Mode ftw!) No need to update your devices this time as WhatsApp fixed the bug at the server side. It's not clear which Paragon customer (read: government) ordered the spying, but at least one Italian journalist was notified of the hacking. Paragon is Israeli-made spyware but was just recently agreed to be acquired by AE Industrial, a U.S. private equity giant — so that's going to complicate things... Paragon is classic spyware, it punches into your phone without you knowing. U.S. ICE signed a contract with Paragon's U.S. subsidiary last year, but apparently comes with safeguards to prevent customers overseas from targeting U.S. citizens (but not the U.S. government...)
More: The Guardian | NBC News | The Record
~ ~

THE STUFF YOU MIGHT'VE MISSED
All Apple devices get security updates after zero-day exploited
Apple: Every Apple device got updates this week — from iPhones to iPads, Macs, Apple Watches and TVs, and its Vision Pro headset — thanks to a zero-day bug under attack in CoreMedia, the media engine shared across various Apple platforms. This is Apple's first zero-day of the year. (Phhrrbbt.... 🥳 — no, not this time!) Details of the bug weren't disclosed — but have occasionally been related to spyware compromises. Devices running software older than iOS 17.2 were actively hacked, whereas other devices were just vulnerable (or that no exploitation was detected). Update all of your devices!

Meet the 23-year-old who infiltrated a North Korean laptop farm
Sasha Ingber: Fascinating story of threat intelligence CEO Aidan Raney, who told the story of how he infiltrated a North Korean IT worker operation aimed at exploiting U.S. businesses. This story goes behind the scenes and offers rare insights into how the North Korean operation works — to gain employment, earn money, then steal and extort corporate data — the so-called "triple threat" — all to fund the regime's nuke program.

SonicWall reports new zero-day under attack
TechCrunch: It's update-your-tech o'clock again. This time it's SonicWall warning of a new unauthenticated bug in its widely used SMA1000 software used to remotely manage a range of its corporate firewalls. The bug, tracked as CVE-2025-23006 was flagged by Microsoft but details of exploitation remain slim. SonicWall is the latest in a long string of enterprise tech makers that've been hit by device hacks in recent years — thanks to their buggy tech products. It's a little ironic, given these devices are meant to protect from outside threats and intruders, but given their position on the network as digital gatekeepers, the simplest bug can undermine the entire product's security, rendering it moot and the network it's protecting compromised. Hundreds of companies are affected by this latest bug, per @nekono_naha.

Almost one-in-10 people use the same four-digit PIN
ABC (Australia): Fascinating research from Have I Been Pwned's database of "pwned passwords," or passwords that have been previously breached and therefore no longer unique (read: unsafe). Aussie news outlet ABC took 29 million four-digit PIN codes from the database and discovered the most popular reused PIN codes. Of course, there are some predictable ones — 1234, 0000, and the like — though some might surprise you — but the analysis is pretty smart and worth reading. And, if you're using a more predictable code (since there are only 10,000 of them), this might make you rethink your choices. (via @troyhunt)
A graph showing the popularity of 4-digit passcodes. In this example. it shows 2580 "might seem like a strange one to be in the top 40" popular passcodes, but that it's four vertical digits on a phone keypad.
ExtensionHound analyzes DNS queries from Chrome extensions
Amram Englander: Since Chrome extensions (and other browser plugins) have come under the spotlight of late, including "sync-jacking" attempts and just plain-old hacking into developer accounts, analyzing potentially problematic extensions for shady code or network connections can be tricky. ExtensionHound is a new open-source project that can identify DNS queries made by browser extensions for suspicious traffic. (via @campuscodi and @df1r633k)
~ ~

OTHER NEWSY NUGGETS
PowerSchool begins disclosure after huge hack: School management software maker PowerSchool has begun formally notifying affected individuals of its breach. So far, the company has disclosed to state AGs that well over a million people had information stolen in the hack — which was so far blamed on a stolen credential with no MFA. PowerSchool says it "cannot confirm" (or won't — take your pick) a precise number of affected individuals yet. The number is likely to extend into the tens of millions, per Bleeping's report. (via TechCrunch, PowerSchool )

Gemini AI, help me hack: Hackers linked to China, Iran and other not-so-friendly nations are using AI to beef up their cyberattacks against U.S. and global targets, per U.S. officials and new research from Google's threat intel folks. Google's own Gemini was used to help write malicious code and hunt for vulnerabilities (flex much?). AI use by adversarial nations isn't new, but clearly it's becoming an increasing part of the hackers' research capabilities. (via Google, WSJ ($))

MGM hacks hit 37 million people... twice: What's worse than a massive hack of 37 million people? A hack of 37 million people, twice. That appears to have been the case after a historical hack in 2019 saw millions of MGM customer records posted online, then a ransomware attack in 2023 that saw much of MGM's Las Vegas properties hit by extensive outages and disruption. Following the breaches, customers sued in a bunch of class action suits. Now consolidated into one mega-class action, MGM has agreed to pay $45 million to settle the breaches — though, 30% of the payout goes straight to the lawyers. (via The Record, WSJ ($))

AngelSense spilled customers' location data: AngelSense, a GPS tracking company for people with disabilities, left an exposed logging database to the internet without a password, which contained reams of sensitive and personal information from AngelSense systems — including real-time precise location data of individuals being tracked. The data was accessible from the web browser, and viewable in plaintext. (Disclosure alert: I wrote this story.) UpGuard found the database and alerted the company — which took a week and a follow-up phone call to offline the database. (via UpGuard, TechCrunch)
~ ~
THANK YOU FOR YOUR SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Welcome back to the happy corner, where everyone is welcome. Remember, it's not a controversial opinion to care about other people.

Cue a much-needed Inspirational Skeletor, since it's all we have this week.
An Inspirational Skeletor meme, which reads: "Owning our story and loving ourselves through that process is the bravest thing we'll ever do."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Franklin is this week's cybercat, who... *whispers*... can be seen here ready to report this week's top cybersecurity news. Don't want to interrupt your recording, Franklin... oh — psst! — thanks to Ingrid S. for sending in!
Franklin is a brown fluffy kitty sitting on their human's desk in front of a microphone.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
That's it for this week's... messy news situation. As always, please do drop me an email if you want to get in touch with anything about or for the newsletter. It's really lovely hearing from you — and your cybercats (or friends).

Your cyber friend,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — january 26 edition

✇~this week in security~ Archive Feed
this week in security — january 26 edition
Trump's DHS guts cyber committees, PowerSchool hack hits 62M students, Change Healthcare hack affects most Americans, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 4
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Trump cyber team disbands CISA advisory committees investigating big hacks
Wired ($): We're now week one into Trump term two and it's "all change" in government. Wired's @lhn scored the big exit interview with former CISA head @CISAJen, who spoke of her time in government, the agency's successes, her concerns for the future, and more. It's a brilliant interview, plus video. Just as Easterly and the rest of the Biden cyber crew were emptying their desks and departing government service, the new administration has already brought in new people, changed the locks, and fired the cyber committees investigating major breaches — including the China-backed Salt Typhoon hacks targeting major U.S. telcos and internet giants. Members of those committees, such as the Cyber Safety Review Board (CSRB), called the shutdowns "horribly shortsighted." For its rationale, DHS said it would no longer tolerate committees that "push agendas that attempt to undermine its national security mission." Uhh....(??) ...so, not a great start, since getting to the bottom of what's been described as the biggest (and most serious) set of security breaches in recent history seems like it should be a priority, no? And that's not even getting into the ordered resignations of the members of PCLOB, the civil liberties board tasked with oversight of the intelligence agencies and a key data transfer agreement with Europe... all to say, there's been a lot of change this week and not all of it particularly welcome.
More: TechCrunch | Techdirt | Reuters ($) | @ericgeller | @kevincollier | @k8em0

PowerSchool hacker claims theft of 62 million students' data
Bleeping Computer: U.S. edtech software giant PowerSchool, whose school information system tech is used by thousands of school districts across North America, was breached, and the hacker claims to have stolen data on 62 million students and more than 9 million teachers. PowerSchool, for its part, has said very little about the breach (gotta put those crisis comms dollars to work!) but schools are reporting breaches going back in some cases decades. Cue Toronto's school district, which says data added to its system includes information on students dating back to 1985. We're still waiting on the final incident report from CrowdStrike — but so far, all signs point to a single stolen credential and no MFA that allowed access to reams of people's private data. If that sounds familiar, that's exactly how hackers broke into Change Healthcare last year.
More: The Register | TechCrunch | K-12 Dive | Ars Technica | @zackwhittaker
Tarah Wheeler post on Bsky: "I say this as a CEO: From now on, when children’s health data is compromised because multi factor authentication was not enforced, fire the CEO, not the CISO. I mean, sure, fire the CISO as well, but the CEO bears the responsibility," followed by a link to an Ars Technica story.
UnitedHealth confirms 190M Americans affected by Change Healthcare data breach
TechCrunch: ...speaking of Change Healthcare, it's the worst medical data breach in history that somehow inexplicably keeps getting worse. Yes, the ransomware attack on the UnitedHealth-owned health tech giant last February now affects 190 million people in America, almost double the previous estimate given in October. It's an absolutely abhorrent and horrendous breach that will affect the majority of people in America for life. Even if you haven't interacted with UnitedHealth, there's a good chance Change still handled your data, thanks to its size — in large part thanks to unchecked corporate consolidation over the years. Per its HIPAA notice, the stolen data includes patients' health data, billing and insurance information, diagnoses, medications, test results, and more. All the while, UnitedHealth made $400 billion (yes, with a b) in revenue in 2024 — but couldn't seem to bother with basic cybersecurity practices, like MFA. Change said it'll notify the U.S. government's health department formally at a later date. (Disclosure: I wrote this story.)
More: Fierce Healthcare | WSJ Pro ($) | Reuters ($)
~ ~

THE STUFF YOU MIGHT'VE MISSED
AI tool helps cops (or stalkers) geolocate photos in seconds
404 Media ($): Prepare to get freaked out: a new closed-access AI tool dubbed GeoSpy can examine photos and geolocate where they were captured within seconds, based on surrounding information — including landmarks, architecture, and more. Some open-source intelligence (OSINT) tools exist like this in a very basic form to geolocate photos but GeoSpy seems to massively soup up those capabilities. Think twice before you take that photo... (or any photo, really).
A screnshot of the GeoSpy tool, showing someone's photo and a larger map showing where that photo was geolocated — based on surrounding information in the photo itself, such as landmarks.
Fake ads target Mac users with malware
Bleeping Computer: As if we need any more reasons to use an ad-blocker, but here we are. Malicious Google ads caught masquerading as Homebrew ads are directing Mac users to download malware, tricking victims into thinking they're downloading the legitimate open-source package manager. (Per @JTParker09, here's the VirusTotal link). Malicious ads are a common way for attackers to target people searching for certain software. Use an ad-blocker! uBlock Origin is one of the best (Wipr, too); and if your browser doesn't support it, change your browser.

No more Let's Encrypt expiry emails
Let's Encrypt: Everyone's favorite free TLS certificate issuer Let's Encrypt will soon no longer send out email notifications for expired domains beginning June 2025. Let's Encrypt certs expire after 90 days (and can be automatically renewed), but found that sending emails cost the nonprofit-run organization thousands of dollars each year in emails. On the flip side, by not emailing people, the organization no longer has to store email address information that isn't necessary — so that's a win for privacy. Nice! (via @campuscodi)

FortiGate config leaks now reveal victim email addresses
The Register: If you recall, someone recently released around 15,000 configuration files for FortiGate firewalls used by enterprises across the globe. These config files contain credentials, IP addresses — and now email addresses — which at least makes it somewhat easier to identify individuals at affected organizations. Cyber weatherman @GossiTheDog (with a Medium ($) blog post on the issue) also published the known email addresses for visibility, and is now reporting a slightly clearer forecast for affected orgs to take action.

Web bugs exposed Subaru's system for tracking millions of cars
Sam Curry: I can't remember who first said modern cars are trackers on wheels, but it's absolutely true. No more so than Subaru vehicles, thanks to a buggy Subaru web portal used by employees. Sam Curry, the incredible car hacker of today's times, along with Shubham Shah, found bugs in the portal allowing anyone to track Subaru vehicles — including their historical location data(!). He proved this by asking his mum for permission to access her Subaru's location across Omaha over a year! (supportive parents, ftw!). The bugs also allowed anyone to take control of the vehicle, like unlocking the car and honking its horn. Wired ($) digs in with its own reporting. (Car makers: please make a "stupid" car. No internet connections wanted!)
A screenshot of a Google Map showing all of the locations across Omaha where Sam Curry tracked his mum's Subaru car using bugs in a Subaru staff portal.
New Android anti-theft security feature lands
Bleeping Computer: Google has a new Android "identity check" feature that locks sensitive device and account settings behind a biometric lock (like your fingerprint or face scan) when outside of a trusted location, such as home or work. This is meant to prevent device thieves from taking control of your unlocked but snatched device. It's a similar (if not almost identical) feature rolled out by Apple last year. It's a good idea, but so far limited to Google Pixel devices running Android 15 and Samsung Galaxy phones running One UI 7.

Almost phished using a crafty Google short-URL attack
Zach Latta: Here's a detailed walkthrough of how Zach Latta almost got phished by a pretty complex attack involving Google's official g.co URL shortcut. This attack almost resulted in Latta granting access to his Google account hijacked. Of course, a big part of this is to stop picking up the phone (and manually checking for signs of improper account activity yourself), but this walkthrough might help save you — or someone else — from this crafty hack attempt. (I will add, though: this comment cracked me up. "The first evidence that it was a scam was that you received a call from Google support. Google's lack of customer support is legendary.")
A phishing email that looks almost like a perfect Google Workspace spoof, saying "Your Google Account has been reset," using the g.co subdomain.
~ ~
THANKS FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Cloudflare issue leaks chat app users' broad location: Really impressive work here by security researcher Daniel, a 15-year-old high school junior, who discovered an impressive information disclosure bug that allows anyone to determine someone's broad location (like a person's city) by sending an image (or emoji) to a target — using a friend request push notification on Discord, for example. The issue at hand is that the image is cached in one of Cloudflare's datacenters closest to the intended target, which can be used to infer roughly where a person is located. As noted by 404 Media ($), this shows the importance for at-risk users "to protect not just their message contents, but their network activity as well." (via @hackermondev)
An animated GIF showing a Discord bot that creates an image cached by Cloudflare, and sent to someone, allowing the bot to return an approximate location of where that recipient is, based on the distance of the recipient to Cloudflare's nearest datacenter.
Court reconsiders Pompompurin sentence: Conor Fitzpatrick, aka Pompompurin, a prolific hacker behind the notorious BreachForums and accused of other major hacks (and CSAM charges), will be re-sentenced after a court found the hacker's previous punishment was not sufficient. Cyberscoop has more on the case. In short, the judge was quite un-thrilled by the hacker's lack of remorse and persistent violations of his probation by using a VPN to access the internet. (via @PogoWasRight, @nixonnixoff )

To Pyongyang via North Carolina: The DOJ threw charges at a North Carolina-based laptop farm this week, which prosecutors accuse of enabling North Korean IT workers to gain unauthorized employment at big U.S. firms and earn a wage (and stealing data) for the purposes of funding the regime's nuclear weapons program. The scheme allowed the North Koreans to earn around $866,000 over six years(!). Remember, these fake IT workers are everywhere — they could even be in your company. The scale of this operation is absolutely huge, and has been able to generate billions in illegal revenue for making nukes. Yeah, not great! (via Cyberscoop)

U.S. spies withheld a bunch o' bugs before 2023: Sometimes when the U.S. government (or a close ally — a country or private company) finds a bug that its spies reckon could be used for, well, spying, the feds will keep hold of these bugs and use them in offensive cyber operations – all the while without telling the affected vendor. The feds make this decision through a process called VEP, or the vulnerabilities equities process. This week, the U.S. government revealed during 2023 that it informed companies of 39 bugs — but that it previously withheld 10 bugs discovered in "prior years" from disclosure. In other words, 10 of those bugs were probably used to actively hack people. (via @joemenn, Ron Wyden)

Govtech giant Conduent hacked: Conduent, a major tech contractor for state and local governments, such as providing the tech that allows states to provide child support and other state benefits, was hacked. Conduent danced around the issue for most of the week, but eventually came clean that its ongoing outage was caused by a cyberattack. Several U.S. states were affected by the outage caused by Conduent's hack. Conduent was hit by Maze ransomware in 2020, by the way, so something to keep in mind. (via TechCrunch)
~ ~

THE HAPPY CORNER
Welcome once again to the happy corner. Take a breath. (Paper bags available upon request.) Let's check in and see how our good friend Hello Kitty is..
A person in a full-sized Hello Kitty constume, sat at an office desk with a cup of coffee, on her phone, with a huge fire in the background on someone else's desk. Hello Kitty does not appear to give a.f.
...well, I guess that answers that.

There are a couple of scrapings from the barrel of good news this week. First up, the U.S. Second Circuit Court of Appeals ruled that backdoor searches by U.S. spy agencies of Anericans' private communications collected under the authority known as Section 702 are — in fact — illegal. This means that U.S. authorities cannot search this massive database of NSA-collected data for Americans' communications without first obtaining a warrant. That's a huge deal, actually. The EFF — which has argued the unconstitutionality of warrantless access to Americans' data for more than a decade — has a good blog post on the decision, and so does Cato.

And, lastly. I really hope this Reddit post is real... this young'un intern may have saved an entire company by discovering a bug in their legacy authentication system that's as old as the kid who found it. I'm not entirely sure what it means to call token validation "kinda thicc," and their Jira ticketing could probably do with some work ("Auth be acting mad sus"), but this is... absolutely excellent work. Hats off to the kid, and I hope they get a full-time job out of this. Plus, per the post, now the company has to explain to the CEO what "no cap frfr" means.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cybercat is Cow, who can be seen here taking it easy after a long day hacking. Many thanks to Keegan P. for sending in! (Apparently, cybercats can be exchanged for extra credit in cybersecurity class — that's so cool! A+ cybercatting.)
Cow is a very fluffy white kitty with big paws and rolling on their back on the carpet by the garden door.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
And that's it for this week... hope everyone is doing OK and sending my best to you from a very, very chilly U.S. east coast. As always, feel free to get in touch if you have anything you want to share for the newsletter — drop me an email any time.

Catch you next Sunday,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — january 19 edition

✇~this week in security~ Archive Feed
this week in security — january 19 edition
PowerSchool breach may hit millions, Salt Typhoon sanctioned, Fortinet firewalls under attack, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 3
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

PowerSchool breach may affect millions of students; no MFA on hacked account
TechCrunch: Bear with me, there's a lot this week. Let's start with one of the biggest hacks of the year (already, I know): PowerSchool, used by 18,000 schools and 60+ million students, was breached. In absence of information from the company, affected school districts helped each other to investigate, while some districts say "all" historical staff and student data was stolen. Turns out PowerSchool wasn't using MFA on one of its support accounts, which granted the hackers access to steal gobs of data. A lot of highly sensitive student data was taken; including grades, medical data, SSNs, and more. Many schools have already notified their students of the breach, so stay on alert for more. My team at TechCrunch did incredible reporting on this story this week (disclosure: obvious bias alert!). Keep a close eye on this!
More: PowerSchool | TechCrunch | K12TechPro | USA Today | @malwarejake
Jake Williams toot: "The data you don't retain can't be stolen when your systems get compromised. Stop hoarding data you'll never use."
Treasury names and sanctions Salt Typhoon, and the hacker targeting Treasury
U.S. Treasury: In its final days, the Biden administration's cyber team has named, shamed, and sanctioned the group known as Salt Typhoon, the China-backed hackers behind the biggest breach of U.S. phone and internet giants; as well as the hacker behind the recent Treasury hacks. Look at that; things can happen at speed when they want to get done... Per the Treasury, Salt Typhoon is linked to a Sichuan-based cybersecurity company called Sichuan Juxinhe, and has "direct involvement" with the hacking group. Meanwhile, the U.S. Treasury is sanctioning Yin Kecheng, a Shanghai-based cyber actor affiliated with the Chinese MSS, the ministry for foreign intelligence, with the hack of the Treasury itself. Bloomberg ($) revealed that the scope of the Treasury hack includes the breach of 400+ computers and the theft of more than 3,000 files from the department. All this comes in the same week that the feds unsealed action they took to force-remove the China-linked PluxX malware from thousands of U.S. computers. Departing CISA chief Jen Easterly posted some words on the threat from China; and the outgoing FBI director also shared his views.
More: Washington Post ($) | CBS News | Ars Technica | @argvee | @dnvolz

Biden admin goes all out on final cyber executive order
CSO Online: Relatedly... it's the Biden cyber team's swan song with their final executive order. Rushed out in the last days of the administration, outgoing top cyber official Anne Neuberger set out the order as setting up the next administration on the best possible footing. But as it was her last briefing, Neuberger said it wasn't clear to her who was doing what in cyber under Trump — since she won't be around to see it. Much of the order was patching issues the government had worked on over the past few years. It's unclear if the Trump admin will accept or rescind the order, details of which you can read here and Wired ($) has a breakdown, too. Much of the Trump admin's public rhetoric has been on cyber-offense, which only really seems like a smart idea if you've got an incredibly strong defense base at home — which... we don't.
More: White House | Cyberscoop | CNBC | Axios

Fortinet warns of auth. bypass zero-day under attack to hijack firewalls
Bleeping Computer: It's a day ending in "y," so of course there's yet another major bug in a widely used enterprise security edge device that allows hackers to break into the network ostensibly protected by the product. This week it's Fortinet, whose firewalls are vulnerable to CVE-2024-55591, which Fortinet says is under active exploitation in the wild. Arctic Wolf says the bug was first exploited back in November, so... that's probably a fair number of organizations pwned so far. This lands in the same week that a hacking group released config files and VPN credentials on over 15,000 Fortinet devices, which @GossiTheDog has a good blog post with more details.
More: Fortinet | TechCrunch | The Register

Microsoft's first Patch Tuesday of 2025 patches 161 bugs
Krebs on Security: Speaking of bugs, get your fill of flaws in this month's Patch Tuesday. Krebs has your run-down of the 161 updates from Microsoft, including three privilege escalation zero-days in Hyper-V, but little is known about the bugs under attack in the wild just yet. The monthly bug patch includes six kernel address leak fixes, all submitted by @yarden_shafir. That's incredible work! And thanks as always to Krebs for pulling these reports together!
More: CrowdStrike | Cyberscoop | @screaminggoat
Yarden Shafir tweet: "Today Microsoft fixed 6 kernel address leaks that I reported: CVE-2025-21316 through CVE-2025-21321."
~ ~

THE STUFF YOU MIGHT'VE MISSED
Texas sues Allstate for violating privacy rights of 45 million Americans
The Record: Texas' attorney general is suing Allstate and its subsidiary Arity for allegedly collecting, using and selling cellphone location data and customers' movements of more than 45 million Americans without their knowledge, per a presser. (Ars Technica has some good yarn, too.) Allstate and other insurers would "use that consumer’s data to justify increasing their car insurance premium." Yuck, gross. Damn, if only they'd do something about this kind of invasive data collection and not say, oh I don't know, not focus on some nebulous threat from TikTok?

At least 8 Americans wrongly arrested after AI face matches
Washington Post ($): Get yourself a pot of coffee and riled up for this weekend long-read. This infuriating story (the piece itself is very well done) looks at deficiencies in policing standards across the U.S. resulting in overconfidence by police that AI and facial recognition was working — when it absolutely wasn't. The effect that these arrests had on their lives can't be understated.

How Barcelona became an unlikely hub for spyware makers
TechCrunch: Sun, seafood, beautiful beaches... and spyware? That's Barcelona, Europe's newest spyware hub, according to multiple people involved in the spyware and exploit making business, who spoke with @lorenzofb. The piece follows a would-be hire at a shadowy, secretive spyware maker starting out in Barcelona. Sure, Barcelona sounds fun and the city clearly has incentives to move there, but it's actually easier for spyware makers to export their products to Europe from Europe than it is from Israel, where many of these companies started out. At least for one person, moving to Spain was because of "expulsion" over emigration. This story got an important shoutout by Citizen Lab's @jsrailton at the U.N. Security Council, which saw governments this week call for regulations on the use of spyware.

Millions of 'failed' accounts vulnerable due to Google's OAuth Flaw
Truffle Security: OAuth, the login feature that lets you sign in with an online account (think the "sign in with Google" login option) can have its benefits, but you're putting your account access in the hands of someone else; in this case, Google. If you lose access to your account (or Google bans you), you're stuffed. This same issue happens with expired or lost domains, such as when a startup collapses; you can re-access any account that's connected to the newly revived domain (like Zoom, HR systems, and more). Truffle Security has a good post on what happens if you buy these expired domains and what access you can get to defunct Google accounts. The research was presented at ShmooCon; you can watch the talk from the blog.
A screenshot showing access to a defunct startup's Zoom account after re-registering an expired domain.
Russian FSB campaign aims to exploit WhatsApp accounts
Microsoft: Hackers believed to be associated with Russia's FSB are behind a new campaign targeting access to WhatsApp users. Microsoft's new research shows the hackers are using fake QR codes to gain access to WhatsApp accounts — which, let's not forget, are widely used across governments (and in the U.K.). The Guardian has a good tl;dr.
~ ~
THANKS FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Clop claims hacked Cleo customers: The Clop ransomware gang's latest mass-hack campaign targeting customers of Cleo Software seemed to return little, if anything, on the ransom front and appears to have been a bust. Clop named dozens of companies that it claimed to have hacked in recent weeks by way of exploiting a zero-day in the Cleo software used by its customers, but actually, many of the companies said they had no evidence they were hacked (which of course doesn't mean they weren't), but several said they weren't even Cleo customers! (via TechCrunch)

Gov't websites awash with scams and porn: Reports this week show both U.S. federal and Indian government websites are full of spam, scams, and sometimes porn, for reasons that aren't completely clear, but somehow, somewhere, hackers are breaking in and dropping pages and redirects to their own sites, which are getting cached in Google and other search engines. It's not a new issue by any means... and yet, nevertheless, it persists. (via The Intercept ($), @dell)
Dell Cameron post on Bsky: "I wrote this story twice and then gave up," followed by two screenshots of Gizmodo stories reporting on hacked government websites redirecting visitors to porn websites.
British ban busts bad bods' business: The U.K. government says it's going to — probably, maybe, someday — ban itself and other public sector organizations, including schools and local councils, from paying any hacker ransoms following a cyberattack. The U.K.'s security minister says it's only a proposal for now (details within), but comes after a series of major hacks at NHS trusts across the U.K. over the past year, including the Synnovis lab hack, which Bloomberg ($) reports that a post-mortem of the incident shows it had real-world harm on patients. (via U.K. government, Home Office)

Otelier breach exposes millions of hotel goers: Well, this ain't good: Otelier, a hotel management platform, was hit by a data breach after threat actors broke into the company's AWS S3 cloud storage and stole millions of guests' information and reservations from well-known hotel chains like Marriott, Hilton, and Hyatt. Otelier confirmed it was hacked, and apparently it was due to stolen credentials (through info-stealing malware, no less — a common theme!). It's unclear if MFA was used; but either way, that's an eye-wateringly big breach for such a simple, basic security issue. (via Bleeping Computer)

CISA to get new leadership: Politico reports that with leadership at CISA (and the rest of the Biden administration's political appointments) leaving on January 20 ahead of the Trump admin's inauguration, the CISA top job may end up going to former Dept. of Energy and NSC staffer Sean Plankey. I guess we'll find out in, *checks notes*, a day or two or whenever. (via Politico)

TikTok and others disappear after U.S. ban: We can't not talk about the TikTok ban that went into effect overnight. I have a lot of opinions on this, but suffice to say, it's clearly a First Amendment issue to ban an app (ie. Congress created a law that prohibits free expression), and that the national security concerns aren't that much different from the U.S. tech giants that exploit their users the same way, just at home where that data, and algorithms that handle that data, can also be used against them. If TikTok is a national security threat, so is Meta, so is X, and so are data brokers that collect all of this data and share it with others. And please, don't try to use a shady VPN to get around the ban; not least, you can't, but also it's just very, very bad for your security to hand your network traffic to an entity you cannot trust any more than your ISP. (via BBC News, Associated Press, Wired ($))
Shaun Johnson tweet: "I’d never want the Chinese to get my data. They’d use it to exploit me. That’s why I trust it only with the least exploitive people ever, the American billionaire class."
~ ~

THE HAPPY CORNER
There's no time to wait. Happy corner, commence!

Next time you hear that a large enterprise or corporate giant was hit by a "sophisticated attacker," remember that it was probably just a fat cat and not the mountain lion you might be picturing.
vx-underground tweet: "This image is a perfectly analogy for most enterprise compromises — a "sophisticated attacker" was NOT a state-sponsored Threat Actor. It was just a fat cat," followed by a fat ginger cat that was mistaken for a mountain lion.
Moving on. Not even Harry Potter can escape the corporate phishing test.
A four-panel comic, of an owl dropping off a letter to Harry Potter, and when opened, screams, "YOU HAVE FAILED A CORPORATE PHISHING TEST."
Now, in obscure science news. Imagine you're a piece of interstellar rock, hurtling through space at absolutely ridiculous speeds. You're whizzing past asteroids, stars, and through the dust of the occasional comet trail. Then, out of nowhere, you see this bright, blue, beautiful planet in the distance... and as you get nearer, you see that it's this round, gorgeous oasis in space, and you can't wait to get even closer. As you approach, you feel like you're speeding up, as you dodge your way through a cluster of orbiting satellites... you're getting hotter and hotter, but closer and closer... and you're nearly there and...
an animated GIF of a doorbell camera video showing a driveway at someone's house, then suddenly a meteorite smashing on the ground into a million tiny pieces.
...whoops? Well, by catching this footage on a doorbell camera, it's a historic first since these sorts of events don't happen very often, scientists say.

And before we go: bonus cybercat, because why not?
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet Shane, this week's cyber cat. If you think companies take your security and privacy seriously, you'd be right to be suspicious. Shane, on the other hand, really does want you to take your security and privacy seriously. You're a great advocate, Shane! (ba-dum tssk.) Thanks so much to Rob S. for sending in!
Shane is a very handsome, green-eyed tabby cat who's looking directly into the camera with a serious (but cute!) expression on his face.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
Thanks for reading this edition! I'll be back as usual with the roundup next Sunday. I'm sure it'll be a busy one. For all those who are leaving the federal government on Monday, especially those who worked in cyber, thank you for your service.

As always, if you have any feedback you want to share my way, please drop me an email — or anything else for the newsletter. Cyber cat or friend? Send 'em along!

All my best,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — january 12 edition

✇~this week in security~ Archive Feed
this week in security — january 12 edition
Huge breach of location data, PowerSchool data breach, China hack of Treasury deepens, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 2
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Hackers claim massive breach of location data from Gravy Analytics
404 Media: Well, it happened — and it looks like this could be a big one. A major broker of location data, Gravy Analytics, had a data breach that lost an eye-watering amount of location data to hackers who raided its AWS account. A sample published on a hacking forum this week saw somewhere in the region of tens of millions of location data points across the world from ordinary users whose phone apps track where they go. This is all thanks to real-time bidding, a process that exploits the ads industry to power the surveillance industry. (Ad-blockers are your friend!) There are thousands of apps — and very popular apps, like Tinder, Candy Crush, and others — that use bits of code (like SDKs) to display ads in their apps, which have a side-effect of allowing brokers to listen in and acquire users' real-time location data, which the apps themselves might not even explicitly know about themselves. (The WSJ has a good primer on how this works.) This data is highly trackable and is a nightmare for privacy; Forbes ($) also has a look inside the hacked data. Little word yet from the company, Gravy, except a brief notification via Norwegian media – because the law there requires a breach notification. The U.S., meanwhile, has no such law. The hackers behind the breach have threatened to post more, but deleted their forum post... either way, this will be a major story to keep a close eye on.
More: 404 Media | NRK.no | Reuters ($) | EFF | @fs0c131y | @josephcox
Baptiste Robert tweet: "Your mobile apps are sharing your location with companies like Gravy Analytics. For instance, here are the locations of Tinder users in the UK," followed by a screenshot of the UK map with location dots all over it.
PowerSchool hack exposes K-12 student and teachers' personal data
Bleeping Computer: A major data breach at edtech provider PowerSchool saw a hacker steal a ton of sensitive data on students and teachers in K-12 districts across North America. PowerSchool is a major provider of school software, used by some 50 million students. The stolen data includes personal information — names and addresses — but also Social Security numbers, some medical data and grades, according to a leaked FAQ. The company admitted that the hacker broke in with a "stolen credential" (sigh!). Looks like the company paid the hacker to delete the data, but really, come on, nobody can trust that! DataBreaches.net has resources for students and affected teachers and parents alike. Expect data breach disclosures (well, at least in the U.S. states that require them) to drop in the next few weeks and months, and there will probably be a fair number of them.
More: TechCrunch | Reddit /r/k12sysadmin

Japan links Chinese hacker MirrorFace to dozens of cyberattacks
Associated Press: Japan blamed a China-backed hacking group called MirrorFace for being behind dozens of cyberattacks targeting the Japanese government and tech companies across the country in a multi-year hacking spree since 2019. MirrorFace sent emails with malware and targeted VPNs to get access to internal networks. It's the latest warning about Japan's cybersecurity posture of late; in 2023, @ellenwapo reported that China hacked some of Japan's most sensitive networks — to a point where the U.S., a major ally of Japan, was getting reeeeally concerned with its own secrets.
More: NPA.go.jp | Kyodo News | TechCrunch

China hackers targeted Treasury's CFIUS office in December breach
CNN: Speaking of China... looks like we have another member of the Typhoon family to add to our bingo card. Silk Typhoon (previously Hafnium — yes — of that mass email hacking fame) is back with a new campaign targeting the U.S. Treasury. It started with a December breach of a BeyondTrust private key that allowed remote access to Treasury employee workstations and unclassified documents. Then, the Treasury's OFAC office for imposing financial sanctions was hacked; and now CNN reports that CFIUS — in more acronym salad — the committee that assesses foreign investments and transactions for national security risks, was also targeted by the Chinese hackers. CISA also said this week it doesn't think there's any other department, other than the Treasury, affected by this particular campaign... but didn't say how it came to that conclusion.
More: CISA | Bloomberg ($) | The Register
~ ~

THE STUFF YOU MIGHT'VE MISSED
New Ivanti VPN bug exploited to hack into companies
TechCrunch: New year, new Ivanti bug exploited in the wild (and almost exactly to the year since its last major flaw). This time it's CVE-2025-0282 in Ivanti's Connect Secure (VPN product), which is being actively exploited to break into company networks. The folks at Mandiant said, per its investigation, that it looks like China-nexus actors are behind the hacks and that "multiple" organizations were compromised. So, patch today! This is likely to be an ongoing issue for a bit; watchTowr Labs, which investigated (also: A+ meme game), said exploitation has already seen "widespread impact." More from @screaminggoat.

White House unveils Cyber Trust Mark labeling program
Nextgov/FCW: The Biden administration unveiled — in its penultimate week — its long-awaited Cyber Trust Mark program, its cybersecurity labeling program for consumer internet-connected devices. This labeling system is designed to certify that smart devices are sold with certain security standards (as defined by NIST), such as no default passwords and the ability to patch security updates. "Have your IoT devices as part of a healthy, balanced security diet" — at least that's the goal. Certified devices will hit the shelves in 2025.

DEF CON's hacker-in-chief faces fortune in medical bills after paralyzing neck injury
The Register: Marc Rogers, the head of security for the DEF CON hacker con, faces tens of thousands of dollars in medical bills after an accident left him with a broken neck. Speaking with the folks at The Register, Rogers says the prognosis is good and that he's doing better; but, of course, this is America and Rogers couldn't rely on his health insurance provider doing the right thing in time before the injury got worse. Rogers' GoFundMe is online for anyone who can spare a few. All the best for a speedy and full recovery, Marc!
Katie Moussouris tweet: "Excellent article by ⁦@iainthomson ⁩for ⁦@TheRegister ⁩on national treasure ⁦@marcwrogers’ luminous career with a commentary on why his broken neck needs a crowdsourced fundraiser in the richest country in the world to aid his recovery."
Corellium founder's mystery pardon involved spam and fish
Semafor: First of all, no, this doesn't involve some obscure British food (I would know). For years, reporters have been trying to figure out why Chistopher Wade, the co-founder of mobile security research firm Corellium, was granted a pardon by President Trump on his way out of office the first time around. Was it to do with government contracts? Or was it to do with a spam operation he ran in the 2010s and was ultimately granted a legal lifeline through chance encounters over his personal fish obsession? Perhaps...

Voice phishing groups found abusing Apple 'account confirmation' prompts
Krebs on Security: Brian Krebs is back with an important story revealing how voice phishing hackers are abusing Apple's own processes to trick unsuspecting victims into granting access to their Apple accounts. It's the same hack that targeted Mark Cuban not so long ago. Cuban spoke with Krebs and explained how the hackers obtained access to some of Cuban's crypto wallets.
~ ~
THANKS FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
Telegram hands over user data to authorities: Turns out when authorities arrest a company's CEO for failing to help the authorities investigate serious crimes, things can change at that company pretty quickly. Months after Telegram CEO's arrest, the app's transparency bot (which isn't very transparent) now shows a spike in government demands for Telegram users' data in the months that followed. India, Germany and the U.S. are the top requesting countries, per a global breakdown of the data. Meanwhile, E2EE messaging apps like Signal data can't give over data it doesn't have to begin with. (via 404 Media ($), Forbes ($))
China hacks Philippines: Hackers backed by China have penetrated the executive branch of the Philippines government over a years-long campaign, per @jamietarabay. The hack also included the president's office. The Philippines government was more tightly lipped in a later press conference, not confirming a breach, but said that the attacks were "persistent." China appears to be continuing to try to hack its way out of international disputes, including over land and territory. (via Bloomberg ($))

Nyet, nyet! Boom, pszzzt: That's the sound of a Russian internet provider in St. Petersburg having its digital systems obliterated in a destructive cyberattack, claimed by Ukrainian hacktivists. The ISP, Nodex, said in a post on Russian social networking site VK that its systems were "destroyed" in the breach, in which the hackers posted screenshots of the ISP's internal network and its backup systems. (via The Record, TechCrunch)
A screenshot of a Cloudflare Radar traffic trend for Nodex, the hacked Russian ISP, showing a complete dropoff of internet traffic from January 7 (UTC) onwards.
UN aviation agency confirms breach: The United Nations' civil aviation agency, ICAO, confirmed a breach this week affecting 42,000 recruitment-related records stolen from the agency, affecting some 12,000 people. In a brief update, ICAO said names, email addresses, dates of birth, and employment history were stolen (and later published on a known hacking forum) in the breach. (via ICAO, Reuters ($))

DNC may have had phone snooping tech: Newly analyzed radio wave data collected by Wired reporters walking around the Democratic National Convention found that there is in fact evidence that the DNC had a cell-site simulator in its presence, potentially capable of spying on devices that were within its geographical range. These so-called "stingray" devices can intercept sensitive data from most devices in its range. The new data analysis — carried out by the EFF — wasn't conclusive but all signs point to a stingray in use. (via Wired ($), @dmehro)
~ ~

THE HAPPY CORNER
He says with gusto this week: This is the happy corner! And I think we can start with what everyone else is thinking, too. It has been a very trying couple of weeks.
Lockdownyourlife post: "I'd like to cancel my subscription to 2025. The 7-day trial was shitty, and I'm definitely not interested."
But let's try to make the best of it. After all, it's the only 2025 we'll ever get. So maybe that impulse purchase — like this adorable crocheted dumpster fire — isn't such a bad thing, especially if it's going to bring you joy.
A crocheted dumpster fire holding a sign that says "emotional support dumpster fire. It's fine, I'm fine, everything is fine!" The dumpster is green with a gray top and gray feet, and there's a red and yellow flame on top.
Meanwhile, sometimes it really is worth it to meet your heroes, like @iwriteok did this week when meeting the developers of the VLC media player at CES. VLC was one of the first pieces of software I downloaded from the internet when I got my first Windows computer back in the early '00s. Long live VLC! This interaction is wholesome a.f.
Robert Evans post: "after days of grifters and con men at CES we stumbled upon the booth for VLC. they were all dressed as wizards and told us, 'we have nothing to sell, we just decided to show up.' i told them I'd been using their software to pirate media for 15 years and they said 'keep doing that'." The next post says: "sometimes it's worthwhile to meet your heroes."
Absolutely amazing work from @mspecter and @stellars, who reverse-engineered dozens of FTC privacy and security rulings over the years and identified how these investigations were put together and from what sources. This is a real public service; and it's been a huge pet peeve of mine that the FTC has brought action against various firms but seldom credits the people — often reporters — who do the work that identifies the issue to begin with. The FTC and Independent Reverse Engineering project, which was presented at ShmooCon this weekend, aims to solve that.

And on that note... I am consumed with FOMO, as I can't be at ShmooCon this year (it's final year, no less). For those there, have an amazing time. There's plenty to do and see, hijinks and happy memories going round!
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Ssssshhhhhh.... Zzzz.. zzz... Zzz.... this week's cyber cat.... is... Sweetpea... Zzzzz... clearly fast asleep ... thanks so much to Eden K... Zzzzz.... for sending in! .... Zzzzzz
Sweetpea is a very cute, very fluffy grey Russian blue kitty curled up on an office chair on top of a copy of The New York Times.
Keep sending in your cyber cats! (or a non-feline friend). Drop me an email at any time with their name and a photo, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
I won't keep you any longer — this has already been the longest newsletter of the year — go and enjoy your weekend and have a great rest of your week.

As always, please do drop me an email with any feedback or anything for the happy corner. And if you have a cyber-cat update, I'd love to hear from you!

Catch you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — january 5 edition

✇~this week in security~ Archive Feed
this week in security — january 5 edition
China hacks Treasury's OFAC, US Army soldier indicted over telecom hacks, Chrome extensions hacked, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 8, issue 1
View this email in your browser | RSS

~ ~
Welcome back to ~this week in security~ and a happy new year! Phhrrhbbttt! 🥳
An animated GIF of a gentleman with a moustache throwing glitter in the air in front of him.
...alright, let's get on with it. Commence the news!
~ ~

THIS WEEK, TL;DR

Chinese hackers compromised Treasury's sanctions office
Washington Post ($): Happy New Year to all — except, maybe, the U.S. Treasury's sanctions office, the Office of Foreign Assets Control (or OFAC), which was recently hacked by China government-backed hackers, per U.S. officials. The hackers used a breached private key owned by BeyondTrust, which provides remote access and identity services to big companies and government departments (like the Treasury), to gain remote access to Treasury employee workstations and unclassified documents. The hack was disclosed on Dec. 30 in a letter to lawmakers, attributing the hack to China, in the same week that OFAC sanctioned a major Chinese tech company, Integrity Tech, for its apparent role in running the botnet behind Flax Typhoon's hacks targeting U.S. systems and critical infrastructure. So maybe that's a clue why China hacked OFAC to begin with..! This is the latest cyberattack by China targeting the U.S. in recent months, so don't think this is settling down any time soon. The WSJ ($) has a great long-read on how China got this far; and Bloomberg ($) looks at why Guam has become a major U.S. focus of Chinese hacking efforts.
More: BeyondTrust | Wired ($) | Treasury | TechCrunch | The Guardian | NBC News
State Dept. spokesperson Matthew Miller tweet: "We are sanctioning Beijing-based cybersecurity firm Integrity Technology Group for its role in computer intrusion incidents. This follows a court-authorized operation to disrupt a botnet consisting of hundreds of thousands of consumer devices in the U.S. and worldwide."
U.S. Army soldier arrested in alleged AT&T, Verizon extortions
Krebs on Security: U.S. prosecutors have arrested a serving U.S. Army soldier for his alleged part in the mass thefts of call records — thought to be from AT&T (via the cloud computing company Snowflake) and Verizon last year. The bare-bones indictment charges Cameron John Wagenius with two criminal counts, but says nothing about the actual case itself. Krebs, who first reported the indictment, spoke with Wagenius' mother who confirmed some details about her son's links to the also-indicted Snowflake hackers. The indictment comes soon after Krebs pieced together a digital trail of evidence pointing to Wagenius as another person who was likely behind the telco hacks. No confirmation from the authorities yet beyond Wagenius' arrest, but all the reporting so far suggests that's probably just a matter of time.
More: Indictment [PDF] | @briankrebs | @screaminggoat

Check if you ran any of these 33 malicious Chrome extensions
Ars Technica: Jussstt before Christmas, dozens of Chrome extensions were discovered to have been hacked to push out malicious updates that were capable of stealing cookies, session tokens and passwords from users' browsers. (That's a major problem since extensions generally auto-update in user browsers, with few checks to make sure they're not malicious.) One affected company included Cyberhaven's (which I mentioned in last week's dispatch), a security company that provides its Chrome browser extension to 400,000 users — mostly employees of corporate customers. Turns out the hacking campaign was largely directed at the theft of Facebook user account credentials for ads, per Secure Annex, which did the analysis. It looks like the campaign dated back at least 18 months, and may have stolen data on some 2.6 million devices. There's also a list of affected extensions here... Browser extensions can be a major risk. The fewer you have, the better.
More: Secure Annex | Bleeping Computer | @tuckner
~ ~

THE STUFF YOU MIGHT'VE MISSED
Tangem fixes bug that exposed seed phrases
Cointelegraph: Cryptocurrency wallet provider Tangem has fixed a bug that saw the company mistakenly log some users' private wallet keys. The fix came after Redditors called foul and Tangem, for its part, could have handled its communications better. Tangem provided a response and said about 0.1% of users were affected. Logging is great, but just make sure you're not logging sensitive data that you really don't want to see.

A look back at Mac malware in 2024
Objective-See: Top Mac researcher @patrickwardle published an annual round-up of the state of Mac malware last year. It's an interesting look at what's working in Mac malware (including info-stealers capable of pinching your passwords). Keep an eye out for fake apps or any untrusted app; it seems like this is a major delivery mechanism for backdooring access.

Vehicles amass huge troves of sensitive data
Washington Post ($): An exploding Tesla Cybertruck in Las Vegas this week led to discussion about the amount of data that vehicles collect and store, which can be used by police or investigators (counterpoint: or also shared with third-parties, or lost and stolen in data breaches). Most modern vehicles collect huge amounts of data, including precise location records, speed, and often any data from a phone connected to the car. It might sound obvious, but just like your phone, your car is a constant tracker of where you go (which can infer what you do or who you see).

2024 in CVEs show XSS bugs were the most reported
Jerry Gamblin: And back again this year is @jgamblin's review of recorded CVE vulnerabilities. During 2024, some 40,009 CVEs were published, up 38% from the year prior, with granular analysis on which days and months were most popular for filing CVEs, and more. An interesting note is that the most common type of vulnerability, aka CWE (or common weakness enumeration) shows CWE-79 — the fancy designation for web-based cross-site scripting (XSS) vulnerabilities — was by far the lead over others. Fix your web code, people!
~ ~
THANKS FOR YOUR SUPPORT
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A collection of This Week in Security themed stickers and two mugs, one in black, one in white, on a grassy background.
~ ~

OTHER NEWSY NUGGETS
U.S. teachers, firefighters paying for spyware firm: A deal to get Israeli spyware maker Paragon into the hands of U.S. private equity giant AE Industrial partners for some $500 million was funded, in part, from several retirement funds for American teachers, police and firefighters, per Israeli news outlet Globes. Can't help but imagine plenty of folks not being particularly thrilled about their pensions being used to fund spyware companies. (via @vaspanagiotopoulos, @evacide)

Pony up your ID for porn: As of today, some 17 out of the 50 U.S. states (mostly across the U.S. south) have age verification laws that require adult websites to verify the ages of visitors before entering. The result has been some of the bigger sites — like Pornhub — blocking access entirely to users in those states, arguing that giving your ID every time you access a restricted site "will put children and your privacy at risk." Clearly it's not a great idea to have a huge database of people's identity information tied to access to adult websites. Something, something... huge target for extortionists? (via 404 Media ($))

Hackers start leaking data on Rhode Island residents: The state government of Rhode Island said the hackers behind a recent ransomware attack on its state systems for residents' social services programs and benefits have leaked some of the data online. The state is urging residents to take action to protect themselves after residents' ID documents and personal information was stolen; around 650,000 people use the state systems that were attacked. Special shoutout to Deloitte, the govtech contractor who set up and managed the system that got hacked, which by the way made an eye-watering $67 billion in revenue during 2024 but couldn't secure a website. (via Rhode Island, The Record)

Tenable CEO Amit Yoran dies: Amit Yoran, the chief executive of security firm Tenable, passed on this week weeks after taking a leave of absence in December as he battled cancer. Yoran was 54, and widely acclaimed across the cybersecurity industry. (via Tenable, CNN)
Lesley Carhart post on Bsky: "Terrible news today about the loss of Amit Yoran. He was a larger than life figure in cybersecurity and we will be lesser without him. May his family and friends find peace."
~ ~

THE HAPPY CORNER
New year, same old happy corner. Welcome once again! (Sorry about all the glitter everywhere.)

To the lucky folks with data protection laws: Get spammed? Don't get mad, get even. This is one way to find out how they got your data to begin with.
Neil Brown post: "Received: two spam email including my personal data. Sent: two subject access requests for the source of my personal data. Happy holidays!"
This year brings a whole new edition of What Can 'Doom' Run On? and we're in for a treat. @rauchg built a Doom-CAPTCHA that's capable of verifying you're human by playing the age-old classic to take out at least three enemies (before they get you). I absolutely love this.
An animated GIF of a CAPTCHA window that reads: "Play DOOM and kill at least 3 monsters," followed by a virtual Doom game controlled by keyboard presses.
And lastly, this week. For so many folks catching up on their emails over the holiday, this is absolutely a mood.
Thinkwert tweet: "How your email finds me," followed by a photo of a person dressed up in a full-body Hello Kitty outfit and pink dress in an office with a sledgehammer with a smashed laptop on the ground.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's (and this year's first!) cyber-cat-pup is Terrence, aka the Terminator, whose human tells me that this is his daily "Stop staring at screens" pose, which becomes a headbutt if not actioned within two minutes. Time to play! Thanks so much to his human Andrew L. for sending in!
Terrance is a very handsome cyber-dog with a toy in his mouth.
New year, new plea: send in your cyber cats! (or a non-feline friend). You can email them in at any time with their name and a photo, and they'll be featured in an upcoming newsletter. Sent in before? Would love an update!
~ ~

SUGGESTION BOX
And that's it for this week, thanks for tuning in. Hope you had a good new year! I'll be back next week with the usual drop from the week.

If you want to drop me any feedback, please do — it's really lovely hearing from you.

From a chilly U.S. east coast, I'm out for now.
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — december 29 edition

✇~this week in security~ Archive Feed
this week in security — december 29 edition
Clop hacks dozens of companies (again), hackers hijack Chrome extensions, Volkswagen location data exposed, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 47
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Clop ransomware gang claims data-theft attacks on 66 Cleo victims
Bleeping Computer: The Clop ransomware is back with *checks notes* 66 new corporate victims after its latest round of mass-hacks. As mentioned last week, Clop has repeatedly targeted enterprise file transfer tools over the years for their propensity to hold highly sensitive corporate data. Clop eked out some partially redacted company names that it claims to have hacked, likely in an effort to extort the victims further. The hackers exploited CVE-2024-50623, a bug in Cleo Software that the company thought it fixed some weeks back but actually wasn't. Expect to see a fair number of these companies disclose the breaches in the next few days, and some of them are thought to be fairly big in size.
More: Cleo Software | TechCrunch | PCMag

Hackers hijack a wide range of companies' Chrome extensions
Reuters ($): A wild situation arose over Christmas when unnamed hackers broke into a corporate account of at least one company, Cyberhaven, to publish a malicious version of its Chrome extension capable of stealing passwords from potentially thousands of its downstream Chrome browser users. (The trouble with browser extensions is that they're often updated automatically without thorough checks on the Google extension store side.) Cyberhaven, a company that claims to prevent data-loss and exfiltration attacks (which... 👀), said in a post-mortem that the hackers broke into the company's account using phishing, and the end goal was... to target Facebook ads accounts?! OK, then...! In any case, the company warned customers to rotate and revoke "all passwords" and to review logs for suspicious activity, given the access that the malicious extension had to the user's browser. The supply chain attack also affected several other popular apps each with tens of thousands of users, as noted by @jaimeblascob's tweets. Also worth reading @mattjay's piece on this, it's very detailed.
More: Cyberhaven | Vulnerable U | TechCrunch | @lorenzofb
Lorenzo Franceschi-Bicchierai tweet: "NEW: Data-loss prevention startup Cyberhaven said hackers took over its official Chrome extension, pushing a malicious version designed to steal passwords and session tokens. @jaimeblascob told us Cyberhaven may be one several other hacked extensions."
White House says Salt Typhoon hacks possible because of telecoms' bad security
Cyberscoop: And let's not leave out a quick end-of-year update to the Salt Typhoon shenanigans, the China-backed threat group that has been rooting around in U.S. telecom networks for months. The White House on Friday squarely put blame on the now-nine listed telcos that were hacked — including AT&T and Verizon, which pinky-promises that its networks are now clear from the hackers. Top WH cyber official Anne Neuberger said that telecom networks are "not as defensible as they need to be" (which is about as scathing as Neuberger gets). In one case, the hackers broke into an admin account's credentials with access to over 100,000 routers. In another case, the hackers erased logs once they were on the inside, not that the companies were always keeping logs to begin with. Cyber pros are once again reminding folks to do the security basics since these do the most to keep bad actors out, not focusing all your energies on zero-days! These telcos made billions in profit this year alone, so it's not like they can't afford it. In all, less than 100 people had their communications targeted through the telco hacks — mostly U.S. government officials and those in the Washington DC area. To say that this could've been worse is an understatement; this should be a major wake-up call to the U.S. — even if history shows that it probably won't be.
More: Bloomberg ($) | The Record | USA Today | @malwaretech
~ ~

THE STUFF YOU MIGHT'VE MISSED
U.S. blames North Korea for $308 million crypto hack
FBI: In a brief statement, the FBI said it was attributing a hack and theft of $308 million in cryptocurrency from Japanese exchange DMM in May. A company employee was tricked into copying a malicious Python script into their Github by a North Korean threat actor masquerading as a recruiter, allowing the hacker to access the employee's cookie information and credentials, exposing access to the company's corporate systems. The hack was attributed to TraderTraitor (yes, there's more to North Korea than just the Lazarus hackers), a group that U.S. cybersecurity agency CISA says often uses recruitment lures to entice would-be victims into high-paying jobs. More from SecurityWeek.

Thousands of North Korean VPN IP addresses published online
Spur: Speaking of pesky North Korean spies, security firm Spur has released thousands of IP addresses linked to Astrill, a VPN service often used by North Korean IT workers to hide their location and online activity. Per Spur, the company says it continues to see reports from its customers about fraudulent North Korean IT workers trying to get hired at Western firms. This list of IP addresses can be used to scan logs for potential threat activity. For North Korea, it's all about that crypto (for the goal of making nukes). (via @campuscodi)

Trump's natsec advisor suggests use of 'offensive' cyberattacks
Politico: The next U.S. national security advisor, Rep. Mike Waltz, suggested (blustered?) in a tweet about going "on the offensive" in cyberspace in response to hacks targeting the United States; the idea is to "impose COSTS" (capitals not mine — we don't like to shout in this newsletter) on those who steal U.S. technology and the like. You'll struggle to find many experienced cyber and policy folks suggesting that's a good idea. @malwaretech (who has a very good thread on this), @hexadecim8, @ciaranm, and so many others have good posts and points. If billion-dollar corporate giants spent more time listening to the cyber-defense advice from the folks at CISA and not exploiting everyone else for the sake of their gargantuan profits, maybe we'd be in a much better cyber position as a country.

"We know where your [Volkswagen] is"
Der Spiegel: Fantastic reporting out of the Chaos Computer Club this year. Do you know where your Volkswagen is? These reporters certainly do. That's because the German carmaker was inadvertently exposing the GPS location data and other vehicle information from VW, Seat, Audi and Skoda vehicles. Some 800,000 cars had unprotected data left in Amazon's cloud that the researchers say contained enough information that the data could be linked to drivers, owners and fleet managers — including two German politicians. Cars; they're trackers on wheels! I long for the days of non-internet connected cars — or, as they used to be called back in the day... cars. Solid thread by @wchr here. And the takeaway: Don't collect data you can't guarantee its protection. Or, just don't collect the data to begin with.
A screenshot showing maps of several European cities, including London, Oslo, Stockholm, and Amsterdam, all featuring thousands of location dots in red showing where VW vehicles have been driven or parked.
~ ~
HAPPY HOLIDAYS AND THANK YOU
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
A collection of This Week in Security themed stickers and two mugs, one in black, one in white, on a grassy background.
~ ~

OTHER NEWSY NUGGETS
Last minute rule to limit healthcare leaks: Rita Mae Brown once said: "If it weren't for the last minute, nothing would get done." Cue the Biden administration's latest (and last minute) proposed rule change to HIPAA that would require healthcare organizations bolster their security, such as encrypting data, to help prevent repeat cases of massive data breaches like... Ascension, or Change Healthcare, or HCA, Kaiser, HealthEquity — all of which happened during 2024 and which collectively, by my count, have resulted in the theft of medical data on more than 130 million people this year alone. The rule could go into effect in early 2025, assuming nothing — or nobody — stands in its way. The rule change seems like a no-brainer, though. (via Reuters ($), The Record)

UN approves cybercrime convention nobody likes: The United Nations General Assembly approved a new cybercrime convention that by all accounts nobody seems to like. The effort was designed (in theory) to make collaboration of cross-border cybercrime investigations easier while reducing the safe havens that cybercrims can operate in. Except, plenty of folks (including big tech companies) have rightfully noted that the convention could be used to criminalize security research. The U.S. admitted it shares these concerns, but said that the convention has safeguards to prevent the rules being used to oppress or violate human rights. That's not hugely reassuring. (via United Nations)

Japan airline hack sparks delays: Japan Airlines was hit by hackers this week, and responded quickly by shutting down a router (used for data communications) that reportedly had a surge in traffic, which caused the disruption. The airline said some flights were canceled and many delayed. No word on who was behind the attack. (via Nasdaq, The New York Times ($))
~ ~

THE HAPPY CORNER
Psssttt... Is anyone around this week? For anyone who is, welcome! Here's the download from the happy corner.

It's the end of the year, so it's a little quieter on the wires than usual, but what a year it's been. Wired ($) has a look back at the worst hacks of 2024 — plus, TechCrunch has the badly handled breaches (disclosure: I co-wrote this story!); plus, our annual jealousy list of the best cybersecurity stories from the wider reporting world this year that you can get stuck-in with on this quiet pre-New Year weekend.

Plus, for those of you who are home for the holidays, give the gift of good security advice. You know that your friends and family need it! Start with the basics, since those are the easiest and most effective things to do to get your cybersecurity posture in the best possible position. And for those who don't yet have a "family password" — well, there's a very good reason why you and your family should have one preagreed and prearranged.

And for anyone who wants a deeper-dive into some of the more technical cybersecurity stories of the year — from hacking campaigns to malware, supply chain hacks to spyware and influence operations — @craiu has you covered with his round-up (plus, bonus podcast if you haven't checked out Security Conversations by @ryanaraine already!).

And finally, time for a new year's resolu... ahh, too easy.
nixCraft toot: "My New Year’s resolution? 3840 × 2160"
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cats are two brothers Eddie (left) and Ernie (right), who can be seen here chilling after a long, looong day of working the security defensive lines for their human. You deserve the rest! Many thanks to Christoph W for sending in!
Two cybercats snuggling next to each other on an orange blanket on a couch: Eddie is the red/ginger kitty and Ernie is the grey tabby kitty.
Send in your cyber cats! (or a non-feline friend). You can email them in at any time with a photo, including their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's it for this week... year! Thank you so much for reading this year. It means the world to me that so many people read weekly, and it's a joy putting this newsletter together every Sunday. My sincere thank you to everyone who has donated or subscribed to help support this newsletter's upkeep.

As always, get in touch any time with feedback or cyber-cats for the newsletter.

For now, have a safe, happy, and healthy New Year.

Catch you next,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — december 22 edition

✇~this week in security~ Archive Feed
this week in security — december 22 edition
WhatsApp wins NSO spyware suit, US weighs TP-Link ban, Ascension breach hits millions, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

🎄 volume 7, issue 46 🕎
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

WhatsApp wins ruling holding spyware maker NSO liable for hacking
Washington Post ($): Breaking news from Friday: Spyware maker NSO Group will be on the hook for damages in a case brought by WhatsApp-owner Meta, according to a summary judgement from a federal court in California, after finding NSO had essentially hacked into Meta's systems by sending its malicious spyware through its servers over a thousand times to targeted WhatsApp users. The ruling found that the case can proceed to trial only to determine how much damages should be. The case began after WhatsApp found evidence that more than 1,400 WhatsApp users were targeted with NSO's spyware back in 2019. It's not known which governments authorized the hacking, but NSO has plenty of countries that use its spyware. The ruling was called a "decisive blow" to NSO Group.
More: Reuters ($) | Court Ruling [PDF] | @jameeljaffer | @davidakeye
Will Cathcart post: "This ruling is a huge win for privacy.We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions.Surveillance companies should be on notice that illegal spying will not be tolerated.WhatsApp will never stop working to protect people’s private communication."
Serbia used Cellebrite tools to unlock phones then plant spyware
Amnesty: Speaking of spyware... damning findings from Amnesty, which found evidence that spyware was planted on a journalist's phone after a routine police traffic stop, only to find later that his phone had spyware planted on it. Forensic analysis shows Cellebrite tools were used to unlock the journalist's phone without their passcode and that access was used to plant the spyware. The spyware, dubbed NoviSpy, was found on more phones belonging to civil society, suggesting that the spyware is "used widely" by Serbian police and authorities, potentially on hundreds if not more phones. TechCrunch and 404 Media ($) had great coverage, who also spoke with the journalist directly. In the same report, Amnesty (and Google's zero-day hunting unit) confirmed it had ultimately gotten fixed a Qualcomm zero-day unearthed in October, which Amnesty says was used by Cellebrite to unlock various phones. There's a good lesson here: if you're ever forced to give up your device to cops (passcode or not), assume the worst and get your device checked (more on this later).
More: Project Zero | Washington Post ($) | @DonnchaC tweets | @_sethJenkins

Ascension says 5.6M hit by May ransomware attack
Reuters ($): Earlier in May, Ascension (which owns over 140 U.S. hospitals) was hit by outages and disruption for weeks following a cyberattack. Months later, the healthcare giant confirmed that the ransomware attack allowed hackers to steal medical data on 5.6 million people, including lab test results, procedure codes, and more. That (by my count) is the third largest healthcare related data breach of 2024, per the Dept. of HHS ongoing figures. That's a drop in the ocean to Change Healthcare's 100M+ data breach.
More: TechCrunch | Milwaukee Journal Sentinel | The Record

U.S. weighs ban on Chinese-made router in millions of American homes
Wall Street Journal ($): The U.S. government is said to be weighing the prospect of banning Chinese-made TP-Link routers across the U.S. next year. Why? Because the routers have been frequently targeted by hackers to launch cyberattacks — including China, which is where TP-Link devices are manufactured. The company "routinely" ships devices with security flaws, per authorities, though the U.S. has never outright said (or provided any evidence) that TP-Link routers are a direct security threat. Which, this might be fair to some extent — but can we not say much the same about routers made in the U.S.? CISA's latest report on the top routinely exploited flaws last year were found in... Cisco routers (see: The Record for more). Instead of playing whac-a-mole with the ban hammer, maybe we should listen to folks like CISA who have been telling us for quite some time now to build security in devices by default? Anyone... anyone...?
More: CSO Online | @WeldPond
~ ~

THE STUFF YOU MIGHT'VE MISSED
Hackers stole $5.3M in crypto from stolen LastPass vaults
ZachXBT, The Block: The LastPass breach of December 2022 is the gift (to hackers) that keeps on giving (them your cryptocurrency). Around 40 customer password vaults from yesteryear, which were stolen during the 2022 hack, have since had their master passwords cracked, allowing access to the credentials stored inside — including those of crypto accounts and the like. (This is because prior to the breach, LastPass' complexity requirements for master passwords were, well, crap.) That's allowed the long-game hackers to steal at least $5.3 million in crypto in recent weeks by using those cracked credentials which the owners hadn't changed, according to top crypto investigator @ZachXBT speaking with The Block. Per Chainalysis, hackers have stolen $2.2 billion (with a b!) in 2024 alone, with North Korea remaining a major thief.
A pie chart representing "funds stolen by type of compromise" over Jan-Nov 2024, with "private key compromise" at 43%, "security vulnerability" at 6.3% and code exploit at 8.5%. More at source.
New critical Apache Struts flaw exploited to find vulnerable servers
Bleeping Computer: A new Apache Struts2 bug just dropped, and this one looks like it could be problematic. The new bug (tracked as CVE-2024-53677) — since patched — can allow attackers to manipulate file-upload parameters to enable path traversal (an increasingly common bug these days!) that can be used to remotely plant malicious code on an affected system, allowing the attacker to run commands on the server and more. The bug reads similarly to CVE-2023-50164, which came out a year ago. (Time flies!) Some are exploiting the bug using public proof-of-concept code, so affected customers should update today. More from SANS.

Reviver digital plates can be jailbroken to display false numbers
Wired ($): Digital license plates that can hide your license plate (or spoof someone else's) sounds like something you'd get in an action movie. It's also highly illegal. But the good folks at IOActive found digital plates made by Reviver are vulnerable to firmware modification that allow exactly this. The 65,000 plates in circulation can't be fixed, per @agreenberg, but the bug will be fixed in plates going forwards.
A photo of a hacked digital license plate, which reads: "HACKED BY IOACTIVE".
Why Apple sends spyware victims to this nonprofit security lab
TechCrunch: If you're one of the unlucky few whose iPhones are targeted by government spyware, Apple will notify you and tell you to take the matter seriously (you should!). But Apple won't help or forensically analyze your device for signs of spyware, like the Harris presidential campaign found out recently when Apple refused to get hands-on with the phones. Instead, the tech giant will direct folks to the digital lab at Access Now. Security experts working in the digital defense space say this is actually a good approach. Great story from my TC colleague @lorenzofb.

Cyber agency CISA says gov't officials should use E2EE
CISA: After decades of advocating for (and sometimes winning) backdoors, those very same senior officials and lawmakers are now being told to use end-to-end encrypted apps, like Signal, to avoid having their communications accessed by Chinese hackers who are currently in the networks of numerous phone and internet companies. I know, the irony is not lost. But still good advice for everyone, anyway.

BeyondTrust says hackers accessed remote-support SaaS instances
BeyondTrust: This week, identity giant BeyondTrust, used by tons of companies to handle their employee logins, confirmed an incident in which hackers got their hands on an API key for its Remote Support SaaS instances, allowing password resets for affected accounts. Bleeping Computer explains in its reporting that BeyondTrust's report (which isn't very clear!) implies two potential zero-day bugs were exploited to gain access. It isn't yet known if downstream customer data was accessed.
~ ~

OTHER NEWSY NUGGETS
Change Healthcare's hack somehow gets worse: New details from the massive February ransomware attack at Change Healthcare, which caused widespread disruption and outages across U.S. healthcare for months and led to the theft of 100 million-plus individuals' medical data, reveal more about the attack. That's because the state of Nebraska is suing Change for its "alleged" (heavy quotes) mishandling of the world-class fustercluck. Plus, its parent company UnitedHealth told TC's @carlypage that it's still notifying affected individuals, so the 100-million number is likely to rise even further. Welp. (via TechCrunch)

Clap Clop back: The Clop ransomware gang took credit for another round of mass hacks, this time targeting file transfer tools developed by Cleo Software. That makes sense, since this isn't Clop's first rodeo targeting corporate file-transfer tools. Clop previously exploited bugs in Accellion, MOVEit, and GoAnywhere. These file transfer tools are targeted because the customers use them to send large, sensitive files over the internet but don't (or forget to) delete them afterwards. (via Bleeping Computer)

He makes it, he breaks it: CISA was created in 2018 by the Trump administration, and now looks set to be the focus of attention when Trump takes office again. @ericgeller (+ thread) speaks with sources and agency insiders who fear the worst about what's to come, and what that ultimately means for defending the nation against malicious threats. (via Wired ($))

Third LockBit member in the can: The U.S. has charged a Russian-Israeli national with being a key developer of the LockBit ransomware. Rostislav Panev is currently in Israeli custody awaiting extradition to the United States. That's now three members of the LockBit crew in custody out of seven charged to date; that's progress. (via Cyberscoop)

Russia, China, Iran, Israel, aka the SS7 crew: Sen. Ron Wyden casually dropped new info [PDF] on which countries the U.S. believes are exploiting flaws in SS7, the global protocol used to route phone calls and texts around the world but also widely abused for surveillance purposes. In the note, DHS reportedly said that Russia, China, Israel and Iran are the "primary countries" reportedly "using telecom assets of other nations to exploit U.S. subscribers." (via 404 Media ($))
~ ~
THANKS FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Take a moment for you, we're in the happy corner.

If we ever needed an update to the "task failed successfully" meme, here's @meetar with a solid substitute.
Meetar post: "Current status," followed by a screenshot of a "congratulations" screen covered in confetti that reads "A network error has occurred."
Enjoy this alternative to The Twelve Days of Christmas with much better, modern, geeky lyrics.

If you need a last minute present for a relative who you know loves to grill, you can exchange your Social Security number for some actual CIA barbecue sauce.

And, since we're about to heat peak festive season, enjoy this week's final moment of peace, courtesy of RGB_Lights' annual holiday light show — though, as a friendly fyi, there are ⚠️ a lot of flashing lights! ⚠️
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week is a multi-cyber cat special that I title simply: "Reservoir Cats." 

Thank you so much to Rosa U. for sending in!
Three tabby cats on their human's porch, stood in a row, two facing the camera and the third looking down. Looks in the style of "Reservoir Dogs," but with cats.
Send in your cyber cats! (or a non-feline friend). You can email them in at any time with a photo, including their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
I want to close out this week's newsletter with a personal note from me, sending my best and wishing you a very merry and happy Christmas, Hanukkah, Festivus and more to all those who celebrate, and peace to everyone. I hope you have a chill and relaxing festive season, however and wherever you spend your time.

And really, thanks so much for reading; getting the coffee pot on and writing this newsletter every week to thousands of you is one of my favorite things. I love hearing from you, too, so if you ever want to get in touch, please do. I'll catch you next week to close out the year, and onwards to 2025!

With love from me, to you and yours,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — december 15 edition

✇~this week in security~ Archive Feed
this week in security — december 15 edition
Cleo software hit by zero-day hacks, China spying on calls of US political leaders, North Korean IT workers indicted, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 45
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Zero-day in Cleo Software, used across supply chains, actively exploited
Bleeping Computer: There's a new zero-day in town, and — you guessed it — it's under active attack. Security firm Huntress this week revealed that the pre-auth bug (read: no passwords required) in the widely used Cleo Software, which Cleo fixed in October, wasn't so fixed after all and hackers were still exploiting the bug, aka CVE-2024-50623, to steal data from its file transfer tools. Yes, it's another round of "mass-hacking file transfer software"-ageddon. Huntress and Rapid7 suggested pulling affected servers from the internet until the bug can be resolved. It looks like ransomware actors may be behind this latest round of attacks, just as it was with Accellion and MOVEit, which were similarly targeted because these file transfer tools store vast amounts of sensitive company-stored data. Hundreds of exposed systems are online, according to recent internet scans, given that Cleo is used by some major companies, including biotech and logistics firms.
More: Cleo Software | Dark Reading | The Record | BankInfoSecurity | @cisakevtracker | @gossithedog thread

U.S. says China hacked calls of 'very senior' political figures
Reuters ($): Let's check in with what's happening with Salt Typhoon, the China-backed hacking group targeting telcos and internet firms. Top White House cyber official Anne Neuberger said the group targeted and recorded phone calls of "very senior" U.S. political figures. We know that includes both Trump and Biden/Harris camps. That's on top of a huge amount of phone metadata taken from the Washington DC area. But it's looking like the operation may have been more focused and targeted on senior political figures — at least that's the latest running theory. There was a classified briefing on Capitol Hill this week, and only 67 House lawmakers (out of 435!) turned up to hear the government's classified assessment of the China-backed espionage campaign, suggesting they think the whole thing is "meh," (even if the rest of us are alarmed a.f.) Well, at least some are trying to do something about it, such as announcing a new bill aimed at mandating telcos to implement security requirements to defend against these kinds of foreign attacks.
More: Sen. Ron Wyden | TechCrunch | Politico
Meredith Whittaker tweet: "The reason it’s not getting more coverage is that remedying the conditions that led to this, which we’ve been warning about for years, would require unwinding dangerous x surveillant norms the current tech industry relies on. Coverage or no, the find out era has arrived and a fix is urgently needed, however painful."
DOJ indicts 14 North Korean IT workers that earned $88 million
The Record: The Justice Dept. is throwing the book at 14 North Koreans who prosecutors accused of stealing identities of U.S. citizens to illegally obtain employment as part of an ongoing scam to earn money and steal intellectual property to aid the regime's nuclear weapons program. All because North Korea just loves nukes. It's a reminder that companies should do more to defend against rogue or fake workers, because it's not just money they want, but corporate secrets as well. The DOJ will have to bide its time, as the North Koreans are a little far from their law enforcement's reach. Some are as far as China and Russia, and not just Pyongyang.
More: Justice Dept. | CNBC | BBC News

U.S. takes action against Chinese group mass-hacking firewalls
U.S. State Department: A double-whammy from the U.S. feds, after the government took multi-pronged action (indictments! sanctions!) against Sichuan Silence and one of its employees, Guan Tianfeng (now wanted by the FBI) for allegedly breaking into around 81,000 Sophos firewalls around the world. Sophos dropped details of the campaign. Some 23,000 or so firewalls were located in the U.S. — some were protecting critical infrastructure (hence why the feds are involved). The compromises were allegedly for stealing company data — since firewalls are network-edge devices that can be exploited to break into full networks. The feds are rewarding up to $10 million for information about Tianfeng or Sichuan Silence. Another reminder of the close links between some Chinese private entities and Chinese-backed cyberattacks. (Additional reading, see: Flax Typhoon).
More: Justice Dept. | U.S. Treasury | Cyberscoop | @campuscodi
Catalin Cimpanu post: "Guan Tianfeng, the Sichan Silence employee, was also indicted (FBI poster below)"
~ ~

THE STUFF YOU MIGHT'VE MISSED
How much do I need to change my face to avoid facial recognition?
Gizmodo: No face swaps (or removals) necessary, and while you might want to invest in a mask and a scarf (it is the winter across the northern hemisphere), your best bet for the most part is to avoid firms, stores and services that rely on facial recognition. Many of the experts who were asked what can be done to avoid facial recognition, the answer was "it depends." But avoiding places where it's employed to begin with is the most effective, if not arduous method.

Yahoo's Paranoids loses 25% of staff this year
TechCrunch: Yahoo has laid off around 25% of its cybersecurity team, known as the Paranoids, over the past year, according to multiple sources. That's around 40-50 people out of 200 employees laid off or lost through attrition since the start of 2024. The company's red team was eliminated as part of the layoffs, we've learned. (Double disclosure alert: Yahoo is my employer, and I co-wrote this story.)

SEC disclosure rules are a hot mess, one year later
Axios: Last December, the SEC began enforcing new cybersecurity disclosure rules; you know, to try to get companies to be more transparent about cybersecurity incidents, like data breaches. Turns out, bzzzt! nope. A new analysis of more than 70 individual 8-K filings reporting cyber incidents shows only around 17% of 8-K filings with the SEC provide specific details about the material impact on a company's business. Most are also just copy-and-paste jobs with near-identical and generic terms. The SEC wanted transparency, and the companies did the barest minimum.
Chris Wysopal post: "BreachRX analyzed the SEC public 8-K filings disclosing cyber incidents. They found a startling lack of transparency which goes against the whole point of requiring public filings. How can investors & people doing business with you have any confidence if this is what they get?" followed by a screenshot of a list of bullets, detailing the BreachRX report.
Meet Termite, the ransomware gang taking credit for Blue Yonder's breach
Cyberscoop: There's (yet another) new ransomware gang in town. Termite is taking credit for the ransomware attack that hit Blue Yonder (another supply chain firm). The gang uses a reworked version of Babuk, whose ransomware source code was made public in a leak several years ago. The group is said to be targeting victims indiscriminately. For Blue Yonder's part, the company spluttered out an update on Thursday (after a near-week of silence!) saying its restoration was still in progress.

New EU smart devices rule takes effect
TechCrunch: The European Union's Cyber Resilience Act, now in force, requires firms making products that are sold in the EU to meet certain cybersecurity requirements. The U.K. has a similar law in effect already, and now Europe's getting it, too. Compliance with the rules will start in 2027, but best to get ahead of this one now than face hefty fines for failing to secure your products.
~ ~

OTHER NEWSY NUGGETS
Location broker offers to track people via doctor visits: Another creepy location data firm, Fog Data Science, is reportedly asking police for the address of specific people's doctors so that individuals can be identified in massive datasets storing people's location data. That's per 404 Media ($), which has the docs to prove it. Fears are that the location data can be used against people seeking reproductive care in a post-Roe America. (via 404 Media ($))

Krispy Kreme fills cyber holes: Donut giant Krispy Kreme was forced this week to fill its security holes after finding itself in a jam following a cyberattack. The company said some online orders were disrupted by cowardly custards. At least it was a grand time for headline writers and pun enthusiasts. Honestly, I just dough-nut believe it. (via BBC, The Register)

Patch Tuesday drops fresh zero-day: Brian Krebs has your latest round-up of all the patches you need to know from this month's Patch Tuesday. There are 70 security holes plugged in Windows, with one zero-day under active attack in its Common Log File System, which can grant an attacker "system"-level (aka root) privileges on a vulnerable device. CLFS remains a popular avenue for ransomware gangs of late, per Rapid7's analysis. (via Krebs on Security, @screaminggoat)

Rhode Island hacked: A cyberattack hit Rhode Island's RIBridges system, which the state uses as its centralized benefits eligibility system, including SNAP and food benefits. Looks like there was some communication with the threat actor, which sent a screenshot of the compromised files to consulting giant Deloitte, which developed the system. (So at least we know who to blame for the system's shoddy coding.) Reuters ($) confirmed a ransom was demanded, so likely a ransomware or extortion gang was behind the breach. The state has details on the programs affected and the likely types of data stolen, including Social Security numbers and certain banking information. And right before the holidays? That's callous. (via RI Governor)
~ ~
THANKS FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Aaaaand breathe. Or scream! Either way, welcome to the happy corner.
SwiftonSecurity tweet: "Screams into bucket," followed by Richard Westmoreland tweet: "That's what the S in S3 stands for."
First up, we have to go to extreme lengths to exit Vim. Alternatively, you can yeet your computer into the nearest body of water. That also works.

Privacy buffs and iPhone users. Now you can automatically share photos with friends, family members, or otherwise interested intelligence officers without also revealing your location. Since most phones these days embed your precise location data with your photos, this simple iPhone setting can switch off the auto-location sharing.

Our annual look at Santa's GDPR compliance — and it's an automatic fail. Again.
Bruce Sterling toot, with a screenshot which reads: "He's making a list, He's checking it twice, He's gonna find out who's naughty or nice, Santa Claus is in contravention of article 4 of the General Data Protection Regulation (EU) 2016/679"
And finally, this week: bonus cybercat: Random street cat or secret CIA spy? (C'mon, we all know cats are actually double-agents.)
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Catalino, a very handsome void floof who can be seen here on the left — and, kinda on the right — after climbing up a tree and discovering that security through obscurity doesn't work. That's one cyber-smart kitty. Many thanks to Bill for sending in!
Catalino is a black, void floof on the left looking at the camera, and on the right, Catalino is seen up a tree, just with his eye reflection.
Send in your cyber cats! (or a non-feline friend). You can email them in at any time with a photo, including their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
It's good to be back after a couple of weeks away; thanks for reading! I'll be back with regular newsletter cadence next week as usual, even (especially!) with the holidays coming up. It's a busy time for hackers and spies, too!

If you want to get in touch about the newsletter — or to throw in some good news or a cyber cat — please do!

I'm off to grab a coffee and a Krispy Krem... oh, wait.

From a chilly east coast,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — december 1 edition

✇~this week in security~ Archive Feed
this week in security — december 1 edition
Supply chain ransomware attack hits grocery stores, Snowflake's third hacker identified, T-Mobile hacked, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

🦃 volume 7, issue 44 🦃
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.S. and U.K grocery stores hit by outages after supply chain ransomware attack
CNN: Happy Thanksgiving to all those who celebrated — except to the miscreants causing holiday chaos at grocery stores and retail chains around the world, thanks to a ransomware attack on supply chain company Blue Yonder. The ransomware attack — not claimed by anyone yet — took out the company's private cloud (its public cloud is unscathed), apparently wiping out critical systems along the way. Starbucks baristas couldn't log hours or get paid, per WSJ ($), some Stop & Shop shelves were left empty ahead of Thanksgiving, and U.K. grocery giants Sainsbury's and Morrisons faced operational hits. Meanwhile, crickets from Blue Yonder since November 24... except to say, "we do not have a timeline for restoration." Not great.
More: Blue Yonder | TechCrunch | NBC News | Cyberscoop | @snlyngaas

Third Snowflake hacker may be a U.S. soldier
Krebs on Security: Absolute mind-bending levels of reporting by Brian Krebs here linking the Snowflake customer breaches earlier this year to a third hacker — and the hacker might well be a U.S. soldier. Prosecutors arrested two hackers allegedly behind the Snowflake breaches, causing huge data spills at AT&T, Ticketmaster, and others. The Canadian newspaper The Record dug into the arrests of one of the accused hackers, Connor Moucka, and how he was caught. It was in large part because he threatened a badass security researcher, who shredded the hacker's opsec to pieces and tracked him down online. FAFO.
More: The Record | @evacide
Per Krebs, the hacker who goes by the handle @reverseshell told a fellow member of a Telegram channel that they are a soldier in the U.S. Army. This user also shared the following image of someone pictured waist-down in military fatigues, with a camouflaged backpack at their feet.
T-Mobile says it spotted hackers before any sensitive data was stolen
Bloomberg ($): T-Mobile went public with an unusually candid statement: Yes, it had been hacked, as the WSJ ($) had reported (though, it wouldn't explicitly say it) but that no sensitive customer data was taken in the intrusion. Bloomberg got the interview with T-Mobile's CSO, who said the hackers resembled the Chinese hacking group Salt Typhoon (the hackers widely targeting telcos and internet firms) and that the telco spotted the hackers running commands on their routers. So, no "sensitive" data, huh? I asked, and a spokesperson said no contents or metadata of calls, texts or voicemails were taken, all of which it considers "sensitive," thanks in part because of the company's extensive logging. Maybe, just maybe, T-Mobile secured its systems just well enough after the eighth cyberattack in as many years to have avoided, for the most part, a ninth.
More: T-Mobile | Bleeping Computer | Geekwire | @gregotto
~ ~

THE STUFF YOU MIGHT'VE MISSED
Russian authorities allegedly arrest LockBit hacker
Oleg Shakirov: Russian ransomware actors have, for the longest time, gotten away with it in large part because the Russian state doesn't get involved. Until it does. Maybe that's what happened to one particular accused LockBit hacker, aka Mikhail Matveev, who's on the FBI's most wanted list for hacking, well, a lot. Russian media outlet RIA reports Matveev will be tried where he lives in the Russian enclave of Kaliningrad.

7-Zip fixes RCE bug that triggers when opening malicious ZIP
Zero Day Initiative: There's a pretty gnarly bug in file archiving software 7-Zip that can allow remote attackers to remotely run malware on an affected device by opening a malicious ZIP or archive file. Trustwave has a brief explainer. If you haven't patched already, patch today.

Wildlife monitoring tech used to intimidate and spy on women
Cambridge University: Remote controlled cameras and microphones used for conservation science to monitor wildlife are also being misused by local government officials in India, according to Cambridge University researchers, to keep watch on women without their consent. If you've developed tech that collects data, this is a reminder that it can — and will be abused. The paper is online as a PDF.
~ ~

OTHER NEWSY NUGGETS
Hoboken? Hobroken, amiright: The New Jersey city of Hoboken was forced to shut down government offices this week following an as-yet-unclaimed ransomware attack. All city hall online services, municipal court, and street sweeping were cancelled as a result. Hoboken — just over the river from New York City — has more than 60,000 residents and is a major regional transit hub. (via The Hoboken Girl)
A Nixie city alert for Hoboken, which reads: "Hoboken City Hall victim of cyber attack; City Hall closed; All online services suspended," then, in part: "The City of Hoboken was the victim of a ransomware attack in the early hours of Wednesday, Nov. 27, 2024. Due to the cyber attack, City Hall will be closed today and all online City services are suspended. Municipal Court has been cancelled for today. Street sweeping is suspended for the rest of the day. All other parking regulations remain in effect. Waste collection will take place today and Recreation programs will continue as scheduled."
FTC slaps "AI-powered security scanner" company: Heavy quotes here for a reason, as the FTC says Evolv, a company that claims its AI-powered scanners can detect weapons while ignoring harmless items, will "be banned from making unsupported claims about its products’ ability to detect weapons by using artificial intelligence." Say no more! Although, one thing: research site IPVM and BBC News have been on Evolv for years. Behind many regulatory actions are the journalists whose work uncovered the wrongdoing to begin with. (via FTC)

Investor, recruiter, North Korean IT worker: At Cyberwarcon last week, a key theme was the ongoing threat from North Korea, including IT workers, labeled a "triple threat" for their ability to have already gained employment at "hundreds" of organizations to earn money for the regime, as well as stealing data and extorting companies not to make that data public — all for the central goal of furthering its nuke program. North Korean spies have impersonated a VC, recruiters, and more. I wrote about the talks for TechCrunch (disclosure alert!). Plus: bonus laptop stickers.
~ ~
THANKS YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
a selection of stickers and mugs (one black, one white) featuring This Week in Security.
~ ~

THE HAPPY CORNER
Welcome back to the happy corner; and a quieter than usual one this week for the short holiday week in the United States. And with Christmas coming up shortly, it's no wonder that some kids will do their best to stay off Santa's naughty list. Here's a blast from the past (and bonus Little Bobby Tables, which always makes me laugh).
Santa Claus post on Mastodon: "A valiant effort has been made by Little Tim this year, who for some reason has decided to change his name to Tim'); INSERT INTO [NiceList] SELECT * FROM [NaughtyList];-- HO HO HO! Nice try Tim. I don't use #SQL, I use several dozen interconnected #Excel spreadsheets, like a professional."
Meanwhile, as someone who's both a British and American computer, I additionally appreciate this reminder about session cookies. Fact check: spot on, bruv.
An Instagram post, which reads: "American computer: Would you like to enable cookies?" Then on a next line, it reads: "British computer: Alroyt mate, do you want biscuits on yer laptop innit bruv?"
Laugh, yes, but please don't use "beefstew" as an actual password.
Punnyhow post on Threads: "Apparently you can't use 'Beefstew' as a password. It's not stroganoff."
And, last but absolutely not least, while you're at home for the holidays. Routers are little thought-about, easily forgotten, seldom updated and often hacked. Security starts at home!
Sherrod DeGrippo tweet: "It is your patriotic duty as an American, on this holy Black Friday to update the firmware on your parents’ router."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber-cat dog is Tallie, who is working towards becoming a therapy dog and can be seen here brushing up on her skills to achieve CGC (Canine Good Citizen) certification. As a pup who strongly recommends that everyone uses MFA (according to her human), Tallie is already a Certified Cyber-cat Dog with top-marks in my books. Thanks so much to @wendyck for sending in!
Tallie is a brown/dark and white furred doggo sat on a couch next to their human's laptop.
Send in your cyber cats! (or a non-feline friend). You can email them in at any time with a photo, including their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
A shorter, quieter newsletter for Thanksgiving week. As a programming note, I'll be AFK next week, but will be back in a fortnight with your usual drop of cyber news.

In the meantime, if you see anything for the newsletter that you think would be good to include, please get in touch! If you haven't sent in a cyber-cat (or a recent update), I'd love to hear from you — or from them, of course. Tell your cat, "pssp pss pssp pssp," they'll know what it means.

Back in a couple,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — november 24 edition

✇~this week in security~ Archive Feed
this week in security — november 24 edition
US alarmed by Chinese hacks of telcos, Scattered Spider hackers arrested, Graykey phone hacking capability revealed, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 43
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.S. officials "increasingly concerned" about Chinese hacking U.S. telcos
Washington Post ($): As the U.S. continues to learn new details of the Salt Typhoon hacks targeting U.S. telecom and internet giants, the country's top telco chiefs were summoned to the White House to explain why Chinese hackers were running around their systems, fearing that they could access unencrypted calls and texts on American directly from the wire. Per @nakashimae, Senate intelligence chief Sen. Mark Warner says this is the "worst telecom hack in our nation’s history." The New York Times ($) that the feds were concerned the Chinese might use their access to identify people which authorities may have "repeatedly contacted," such as informants, from FBI phones. Meanwhile, Bloomberg ($) reports the NSA director wants to publicly disclose some of the details of the hacks to help other network giants defend, too. (Makes sense, right?) All the while, let's not forget about the threat from the other Typhoon groups... like Volt Typhoon, the Chinese hacking group that's still prepositioning themselves (per Reuters ($)) in U.S. critical infrastructure to strike in the event of a conflict with the United States over, say, Taiwan, for example. None of this is particularly good, but it's about to be a new administration's headache.
More: New York Times ($) | Reuters ($) | Bloomberg ($) | @nakashimae tweets
Ellen Nakashima tweets: "Though fewer than 150 victims have been identified and notified by the FBI, the records of people those individuals have called or sent texts to run into the "millions," Warner said," followed by another tweet, which reads: "The intruders are still in the networks. Booting them out could involve physically replacing "thousands and thousands" of outdated routers and switches, he said."
'Scattered Spider' hackers arrested by U.S. authorities
Justice Department: It's the end of an era for, well, at least some of the hackers known as "0ktapus," and later, "Scattered Spider," who were... mostly caught in recent months to face justice. The DOJ declared victory this week, claiming the arrests of five "advanced persistent teenagers" of mostly young adults (some of which were teens at the time of the hacks) who were caught mostly thanks to their bad opsec. Krebs on Security digs into the arrests and the hackers, who took credit for hacking DoorDash, LastPass, T-Mobile, Twilio (twice), and others. The hackers, for a time, were so prolific that the FBI and CISA put out a warning, urging corporate giants to shore up their security from these highly skilled social engineers.
More: Reuters ($) | Cyberscoop | TechCrunch | Bleeping Computer

Watchdog says many U.S. water systems exposed to high-risk flaws
The Record: Not great news for U.S. cyber resiliency, where close to a hundred drinking water supplies across the country, serving millions of residents, face "high-risk" vulnerabilities that could cause degradation or a loss in water supplies. A new report by the government watchdog GAO reveals some of the troubles in more detail, with the top-level highlight that absolutely more has to be done across the industry. And not just in the U.S., either. U.K.-based Thames Water, which supplies water across the British capital and further afield, is "falling apart" at the cyber-seams, according to one Thames Water insider speaking to The Guardian as part of a wider investigation into the company's apparently lackluster cybersecurity posture.
More: GAO | BBC News

Anyone can buy data tracking U.S. soldiers near nuke vaults in Germany
Wired ($): There are billions (yes, with a "b") of location data points obtained by U.S.-based data brokers that hold huge amounts of sensitive data on where millions of people go at any given time, including who (and where) they interact with. Now, zoom into Wiesbaden, Germany, and you'll see a huge U.S. intelligence gathering hub and, with this location data, also see and track exactly where countless U.S. soldiers and military personnel go all over this base, including nearby to where part of America's nuclear arsenal is stored. Wired, working with a journalism reporting collective, again reveals the danger of data brokers around "sensitive locations," such as military bases. The FTC has long warned against U.S. companies gathering data around sensitive locations, but Wired reports the FTC is "on the verge" of changing its rules, per Ron Wyden's request.
More: Netzpolitik | Bayerischer Rundfunk | @dmehro
A photo from Wired's story, showing an aerial map of Wiesbaden in Germany in darkness with red dots all over the place, showing U.S. soldiers' locations.
~ ~

THE STUFF YOU MIGHT'VE MISSED
Palo Alto Networks warns of firewall zero-days under attack (again)
Unit 42: Of course, there's a new zero-day (but actually two!) in a cybersecurity company's products. This time ...Again it's Palo Alto Networks, and these two bugs can be chained to get unauthenticated access to an affected customer's firewall — and the customer's wider network. The bugs, tracked as CVE-2024-0012 and CVE-2024-9474, are under active exploitation so you might want to patch sooner rather than later. Props to watchTorwr Labs for the great write-up (as usual), and more from TechCrunch.

Phishing simulations aren't so effective, academics say
IEEE: Say what you will about email phishing simulations (and plenty of folks have opinions!). Now, academics say that phishing simulations aren't so effective in practice, according to their eight-month controlled experiment, now available to read. "We find no significant relationship between whether users have recently completed cybersecurity awareness training and their likelihood of failing a phishing simulation." The full results are worth reading, but also note that companies — with their resources and riches — should be the ones rolling out phishing-resistant authentication tech, not putting the responsibility on the users flagging could-be-malicious email themselves. Cue Google's top security veep, @argvee:
Heather Adkins tweet: "Phishing simulations are an ineffective tool. Put in phishing resistant strong authentication instead."
Leaked docs show what phones 'Graykey' can unlock
404 Media ($): Newly leaked documents show that Graykey, a forensic tool owned by Magnet Forensics that's designed for law enforcement to access locked electronics, can obtain partial data from most modern devices, including iPhones running iOS 18.0.1 and a range of Android devices, including Pixel phones. It comes soon after researchers reverse-engineered a new iPhone security feature that reboots inactive iOS devices after three days, putting it in a "Before First Unlock" state that's more difficult to password-crack.

'Every single person should be worried' about the risk from phone spyware
New Yorker ($): Speaking of spyware... @ronanfarrow has a new documentary and article out about how spyware proliferation (or lack of) will likely fare under the incoming Trump administration. Alarming headline, but interesting read — uncovering fresh details about spyware deals done with the U.S. government in recent years.

Russia caught hacking company via neighbor's nearby Wi-Fi
Volexity: A fresh new cyberattack hellscape just opened; turns out Russian hackers were tracked compromising one unlucky Washington DC-based organization by tapping into a nearby neighbor's network, then using the Wi-Fi to "hop" to the intended victim's network across the road. Wired ($) has some yarn on the story, which succinctly explains: "Instead of venturing into radio range of their target, they found another vulnerable network in a building across the street, remotely hacked into a laptop in that neighboring building, and used that computer's antenna to break into the Wi-Fi network of their intended victim — a radio-hacking trick that never even required leaving Russian soil.
A Volexity graphic, that reads: "Nearest Neighbor Attack: Attacker compromises infrastructure in physical proximity to target of interest. A dual-homed sustem is identified and attacker enables Wi-Fi. Attacker uses compromised credentials to connect into the network of actual intended target."
~ ~

OTHER NEWSY NUGGETS
Apple warns of active Mac hacks: Fruit-themed device maker Apple has warned of active cyberattacks targeting Intel-based Mac users, and has rolled out patches to Mac users — as well as iPhone and iPad owners, fearing that the exploit could also target them. The bugs were discovered by Google's TAG, which investigates government-backed threats, so that gives some clues as to who's behind these Mac attacks. Update your devices today. (via Apple, TechCrunch)

The 'i' in CISO stands for 'insurance': A New Jersey-based insurance company is now offering professional liability insurance to top company cybersecurity officers, including CISOs, to shield from liability. CISOs are increasingly facing regulatory heat for security incidents and data breaches that, frankly, aren't always their fault (thanks to big companies withholding vital security funds from their CISOs!) but yet find these issues ultimately land on them. (via Cyberscoop)

Pop, pop, who's there? CISA's red team: Once in a while, CISA's red team is tasked (with consent!) with breaking into a government agency, or, in this case, a critical infrastructure organization to find and shore up cyber weaknesses. No surprise that CISA's team of offensive hackers broke in with staggering results, but only the more alarming when you find out CISA initially gained access to their target's network because the organization failed to clean up a web shell left behind from a previous red-team engagement. (via CISA)
A post by Ceresbzns, which reads "lol, lmao," and followed by a screenshot of a CISA red team post, which reads: "Within this assessment, the red team (also referred to as 'the team') gained initial access through a web shell left from a third party's previous security assessment. The red team proceeded to move..."
Finastra hacked: Global financial giant Finastra confirmed it was hacked, after hackers compromised its internal SFTP system using stolen credentials. (It's not clear yet if there was any MFA on this system, but certainly doesn't sound like it). A threat actor reportedly stole 400 gigabytes of data from the system, but Finastra won't say how many customers are affected. For background, Finastra serves 45 out of the world's top 50 banks, so... that's something for sure. Finastra was hit by ransomware in 2020, too, per Bloomberg ($). (via Krebs on Security)

Keep your medical imagery out of AI: I'll say this once in a while, but it's worth repeating. Please, please, please don't upload your medical imagery — X-rays, CAT and PET scans, etc. — to an AI model, even (especially) if a billionaire tells you to. In fact, probably just best to keep these off the internet if at all possible. With AI, what goes in will eventually come out again. (Disclosure: I wrote this!) (via TechCrunch)
~ ~
THANKS YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Don't worry, there's plenty of space for everyone here in the happy corner. Welcome to all.

Scammers, beware. The next time you try to trick someone into handing over their passwords or sensitive information, you might be talking to a fake grandma. U.K. phone network O2 built an AI grandma designed to waste the time of scammers by keeping them on the phone for as long as possible. It's a beautifully evil trick. Excellent! (Thanks to Michael T. for sending in!)

Meanwhile, for those thinking of rolling their own crypto... just don't.
Martin Shelton post on Mastodon: "when you roll your own crypto," followed by a photo of a sliding lock on a sliding door, which is ineffective.
Here's a rare opportunity to look inside a roving SMS blaster operation, featuring a car trunk packed with equipment capable of sending a million phishing text messages per hour. Remember, SMS is insecure and should be used for authentication only as a last resort.
A post from Sick Codes, which reads: 35 year old Chinese man arrested in Bangkok, driving around populated areas with a SMS blaster with a 3km radio sending 1,000,000 phishing SMS per hour. "Phone users within range received a message stating: “Your 9,268 points are about to expire! Hurry up and redeem your gift now”. This was followed by a URL for phishing website."
And finally, this week: A big thank you to @CISAJen, who is departing cybersecurity agency CISA on January 20 as part of the transfer of government power, after more than three years at the helm. CISA's continued to do incredible work under Easterly's directorship, and as a country the United States is better for it. A true hacker's hacker, all the best to Easterly and her future endeavors. 🫡 (via NextGov)
a photo of Mudge, Lesley Carhart, Ray Watson, Jake Williams, Jen Easterly, and others at CISA's headquarters in January 2024.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This is Dirk who, according to her human, is very sweet and catches tons of mice. And, like a true cyber cat, I bet she snags in the occasional government-backed hacker, too. She's the sunshine to anyone's day. Thanks to Max B. for sending in!
Dirk is a black and orange cyber cat, outside by a pot of flowers, mid-meow. (Very cute indeed.)
Send in your cyber cats! (or a non-feline friend). You can email them in at any time with a photo, including their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
That's a bumper edition of the newsletter this week. Thanks for making it all the way through. Next week is Thanksgiving in the U.S. so expect a little lighter on the news... but who knows, we'll see. As for now, enjoy the rest of your Sunday.

As always, please do reach out with anything for the newsletter. It's lovely to hear from you!

'til next time,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — november 17 edition

✇~this week in security~ Archive Feed
this week in security — november 17 edition
Snowflake hackers' indictment unsealed, Amazon confirms MOVEit data breach, China hacked T-Mobile, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 42
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.S. unseals charges against hacker of Snowflake's customers
Krebs on Security: U.S. prosecutors have (finally) unsealed the charges against two hackers, John Erin Binns (in Turkey, so don't expect an extradition any time soon), and Connor Riley Moucka, in Canada. The duo are accused of carrying out some of the biggest data breaches of the past year by hacking into customer accounts of cloud giant Snowflake between November 2023 and October 2024. All of this was possible thanks to breached passwords and no MFA on the Snowflake accounts. Krebs, expectedly, has the full background on the hacking duo. Binns and Moucka allegedly extorted some of the companies they stole data from, including AT&T, which had an eye-watering 50 billion (yes, with a 'b') customer call and text records stolen. The hacks also affected Santander, Ticketmaster, and around 165 other companies — many of which haven't publicly disclosed their breaches (yet). This might be the end of the road for these hackers (for now), but there's likely a lot more to come from these mass-hacks.
More: 404 Media ($) | Bloomberg ($) | TechCrunch

Incoming Trump administration urged to focus on China, ransomware
Cyberscoop: There are a few updates to note in the world of politics as it pertains to cyber. Top White House official and U.S. cyber advisor Anne Neuberger urged the incoming Trump administration to keep focusing on China, amid the ongoing intrusions by Chinese hackers into U.S. phone and internet giants (more on that later), and, of course, ransomware. Cyberscoop looks ahead, and The Record also digs into what's to come. Ransomware is a major problem that's still getting worse, but relies largely on Russia finally deciding to do something about the problem within its own borders. (We can hope! But quick vibes check: probably not.) Meanwhile, we'll likely see cybersecurity deregulation — with CISA as a potential early casualty, despite the good it's done. And, expect to see the rolling back (or dwindling) of spyware proliferation efforts, per Wired ($). Oh, and Tulsi Gabbard may well be the next chief spy of the United States. Make of that what you will.
More: Wired ($) | TechCrunch | BankInfoSecurity | @kaitlancollins
How to protect yourself from government surveillance
Wired ($): Trump has promised to jail his enemies and deport millions of people, and Wired has published a detailed, thorough guide looking at the ways to protect yourself from ongoing (and future) government surveillance. All of this matters more than ever. Just this week, Trump's incoming border czar said he plans to use AI to aid deportations. Some supporters of this have suggested the government could "comb through millions of records of immigrants" to meet Trump's deportation goals. And given that the U.S. government can simply buy your location data without needing a warrant, it's going to be easier than ever for the government to identify people (either wrongly or arbitrarily) using the data that we all leave as a trail behind us. It's not too late to protect yourself, but like anything in cybersecurity, think of it as an investment in something you hope ultimately never happens.
More: 404 Media ($) | Politico Pro ($)

Palo Alto Networks confirms new zero-day under attack affects its firewalls
SecurityWeek: It's a day ending in "y," so of course there's a brand new zero-day under exploitation in *checks notes*... a cybersecurity company's own security product. Palo Alto initially said there was no evidence of exploitation of its firewall management software, only to about-face soon after. The security advisory confirmed it found hackers exploiting the "unauthenticated" bug (so no passwords or keys needed to take advantage). CISA added the bug to its running list of known-exploited bugs and ordered federal agencies to secure any systems within three weeks, but no details yet on exactly who's carrying out the attacks. These so-called "edge" devices are the bane of some network defenders' lives, and no wonder, when some of these products seem to cause more hassle than not.
More: Palo Alto Networks | Cyberscoop | Bleeping Computer
~ ~

THE STUFF YOU MIGHT'VE MISSED
Researchers warn of critical bug in Citrix Session Recording
watchTowr Labs: The folks at watchTowr Labs say they have found unauthenticated RCE bugs (think remotely running malicious code) in Citrix Session Recording, which captures all of the user's activity when using Citrix's products. Citrix has an advisory out, and disputes that no authentication is needed. But, security researchers called that out as bunk, since some organizations are still deploying their instances over the internet without authentication. The friendly folks at @Shadowserver urge folks to update as hackers attempt to exploit the bug. Some good yarn from Cybersecurity Dive, too.

North Korean-linked hackers caught experimenting with new macOS malware
Cyberscoop: Security researchers at Jamf [PDF] say they've found malware embedded in macOS applications using Flutter, which heavily obfuscates code, and that the malware appeared as clean when uploaded to mass anti-virus scanner, VirusTotal. It's not known if the malware was used in attacks, but was capable of bypassing Apple's notarization process, which checks if code is free from malware. Good intel to know if you're a Mac organization.

Hacking hackers with a fake ransomware builder
Cristian Cornea / Medium ($): ...and on that note, a good reminder that code on the internet is not always safe! One security researcher packaged up a fake ransomware builder as a secret honeypot and advertised the builder on a known cybercrime forum. The researcher found over 100 hackers used their ransomware builder, which allowed the researcher to identify what the hackers were doing and targeting.
~ ~
THANKS SO MUCH FOR READING!
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

OTHER NEWSY NUGGETS
T-Mobile's ninth recent hack: Pour one out for T-Mobile (or don't) for its ninth cyberattack since 2018. This time, the Chinese hackers known as Salt Typhoon, which've been breaking into phone and internet giants to target their wiretap systems, have also compromised T-Mobile. The telco didn't say much, only that its systems have "not been impacted in any significant way." (What does "significant" mean? I asked...) T-Mobile is the latest company affected; AT&T, Verizon and Lumen were also compromised, with the hackers targeting call and text logs of high-profile Americans, including U.S. presidential candidates. (via Wall Street Journal ($))

MOVEit like it's 2023: Remember the MOVEit data breaches from last year? A bug in Progress Software's file transfer tool allowed the Clop ransomware gang to mass-hack hundreds of companies that store gobs of data in their MOVEit servers. That includes Amazon, which this week confirmed — more than a year on — that the hackers stole employee information stored in Amazon's MOVEit instance. An individual on a known hacking forum claimed to have 2.8 million lines of Amazon employee data stolen in the breach. (Ah, it's the data breach gift that keeps on giving, I say with as much sarcasm as you'd expect from me). @vxunderground says no customer data seen just yet, but that may change. So far, it looks like it was mostly HR and other internal company information. HSBC and others also reportedly had data taken. (via TechCrunch, 404 Media ($))

Hot Topic hacked: Data breach notification site Have I Been Pwned alerted some 57 million customers of clothing and merchandise site Hot Topic that they had data stolen in a recent data breach. It looks like its sister brands, Box Lunch and Torrid, may also be affected. The stolen data includes names, dates of birth, phone numbers, physical addresses, purchase history, and partial credit card data. Hot Topic hasn't commented on the breach. Let's hope it answers the regulators' questions, then. (via Bleeping Computer, @haveibeenpwned)
A screenshot from Have I Been Pwned's website, which reads, in part: "In October 2024, retailer Hot Topic suffered a data breach that exposed 57 million unique email addresses. The impacted data also included physical addresses, phone numbers, purchases, genders, dates of birth and partial credit data containing card type, expiry and last 4 digits."
Discord leaker gets 15 years: Jack Teixeira, the former member of the Massachusetts Air National Guard, was sentenced to 15 years in prison for leaking and publishing several classified military documents about the war in Ukraine on Discord last year. The whole case of leaking classified documents had U.S. officials scrambling after learning that the files had been circulating online for several months before they were discovered. (via Associated Press)

November's Patch Tuesday fixes two zero-days: Microsoft has patched two actively exploited zero-days, including a bug in Windows Task Scheduler tracked as CVE-2024-49039, discovered by Google's Threat Analysis Group (which finds government-backed threats — so this could be an indicator of commercial spyware or the like). A separate spoofing bug tracked as CVE-2024-43451 can reveal NTLMv2 hashes, if exploited. More details from SANS' ISC. (via Krebs on Security)

NSO, not its customers, operated Pegasus: An ongoing legal case launched by WhatsApp, which sued Pegasus spyware maker NSO Group for deploying its spyware against thousands of WhatsApp users, saw a raft of sworn depositions unsealed this week. One revelation includes an NSO employee stating that NSO does in fact operate its spyware, not its government customers, despite the spyware maker long claiming it doesn't know who its clients are targeting. Another is that NSO cut off 10 government customers in recent years for abusing Pegasus (which, I know, seems like an entirely redundant statement, but alas, here we are). (via TechCrunch, The Guardian)
~ ~

THE HAPPY CORNER
And breeeeathe. This is the short-and-sweet happy corner.

There's not much this week. Top of mind was this novel way of reading the license terms that you'd otherwise never think about.
Let's check in with Inspirational Skeletor, who in times like these, still has our collective backs.
A photo of Skeletor, with the caption: "In a time of destruction, create something."
And, for a moment of peace: If you have decided to finally take the leap from The Site Formerly Known as Twitter™, load up this beautiful (and dare I say, relaxing) Bluesky data visualization and enjoy disassociating from reality for a few.
A screenshot of a visualization of flying through a rectangular cube through space and the walls are Bluesky posts in realtime.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Kiki, who can be seen here brushing up on her chomping hacking techniques. Thanks so much to Alice B. for sending in!
Kiki is a brown, orange and white kitty with white socks for paws, sitting on a bookshelf next to some hacking and cybersecurity books.
Kiki can be seen chomping on a book that's called "Cyberspace" and another called "Hacking."
Keep sending in your cyber cats (or a non-feline friend!). Feel free to email any time with a photo with their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's as much as I can find this week; there's a few things to keep an eye out for next week, including potentially more on the Snowflake indictment, and the ongoing fallout left behind by Salt Typhoon. We're also heading into the holiday season, and that's a busy time for network defenders...

In the meantime, please do reach out with anything if you ever want to get in touch about the newsletter. Sending good vibes to everyone.

Peace,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — november 10 edition

✇~this week in security~ Archive Feed
this week in security — november 10 edition
Hacker behind Snowflake breaches arrested, China Typhoon hacks 'more pervasive' than thought, FBI warns of fraudulent subpoenas, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 41
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Canada arrests man suspected of Snowflake data breaches
Bloomberg ($): We are starting this week in Canada, where authorities arrested a man of alleged involvement in the customer data breaches at cloud computing giant Snowflake. Much of the breaches rested on Snowflake's customers not using MFA — or Snowflake mandating its customers use MFA. That was a problem, because all the hacker (or hackers, plural) needed to steal huge amounts of a customer's data was through stolen employee passwords. Some 165 Snowflake customers — think corporate giants — were affected, including AT&T, Ticketmaster, and others. Much of the data was held for ransom, and some of the companies allegedly paid (again, AT&T). The arrested suspect is understood to be still in Canada under a provisional arrest warrant, and held in custody. Expect more to come on this in the coming week or so, as we'll likely understand more about the chief suspect and the wider group of cybercriminals behind these hacks.
More: 404 Media ($) | Wired ($) | Krebs on Security

Chinese 'Typhoon' hacking far more pervasive than previously thought, say sources
ABC News: Hold onto your hats, this one is getting messy. New reporting this week suggests the FBI is investigating whether China used its access to the wiretap systems of U.S. internet and phone providers to hack into the phones of high-profile Americans, including politicians, using malware (or spyware). Forbes ($) is also reporting similarly. If so, that's a major escalation of access to wiretap systems — so, unencrypted phone calls and text messages were stolen from the telcos themselves — but also that access was potentially used to directly compromise at least one iPhone belonging to a Trump-appointed lawyer. Exactly how remains unknown, but it's clear that this is a fast moving and developing story, linked to the "Typhoon" family of Chinese hackers. The Chinese access could easily affect at least thousands of people across the United States. Or, given that these wiretap systems have broad access to a vast amount of our personal communication records, potentially anyone in the United States. House lawmakers are now in the loop — at least until January, by which — well, pffft, anything could happen.
More: Wall Street Journal ($) | Cyberscoop | @dnvolz

FBI warns of spike in hacked police emails used to send fake subpoenas
Krebs on Security: What's worse than being subpoenaed? Having a fake subpoena sent to a tech company for your personal data. But that's quite literally what's been happening with some crime groups, who have been publicly boasting about their ability to break into the email accounts of law enforcement, government agencies, and police departments (and popping webshells!) to send fraudulent "emergency data requests" (EDRs), which are meant to be used for obtaining user data in exigent circumstances only when there's no time to get a legal order. Equally bad, the tech companies have been tricked into turning over real people's data in response to some of these requests. @briankrebs has been on this story for years, and others, explaining how this scheme works. Now, the FBI has issued a rare admission that the EDR system is flawed and that, while companies must take better care of filtering out fraudulent requests, the police departments have to secure their systems far better as well. Who knew a backdoor could be used for abuse? It's not like the security community hasn't been warning about this for years...
More: TechCrunch | IC3 [DocumentCloud]
Matt Johansen tweet: "Major platforms impacted: Apple, Meta, Snap, and Discord have all reportedly received fraudulent EDRs. These companies collectively process tens of thousands of legitimate emergency requests annually," followed by a screenshot from a TechCrunch article, which reads: "Apple, Google, Meta, and Snap, which store huge amounts of customers’ personal and private data, collectively receive tens of thousands of emergency data requests every year. Bloomberg reported in 2022 that some of the fraudulent emergency data requests date as far back as early 2021, and were carried out by groups of mostly teenagers and young adults, such as Recursion Team, and later, Lapsus$, which went on to hack into some of the world’s largest companies, including Uber."
Google patches two Android vulnerabilities exploited in targeted attacks
SecurityWeek: Google is warning of "limited, targeted exploitation" of two vulnerabilities targeting Android. The two bugs are designated CVE-2024-43047 (found in Qualcomm chips, which I mentioned last month) and CVE-2024-43093 (an Android software bug in the Android's Framework component). Those fixes are now rolling out, so update as soon as you can. Details about the exploitation isn't yet public, but both Google's Threat Analysis Group and Amnesty International discovered the Qualcomm bug, so there's a greater than zero chance that a commercial spyware vendor may have been behind this exploitation.
More: Android Security | Bleeping Computer | Cyberscoop
~ ~

THE STUFF YOU MIGHT'VE MISSED
An exploration of new macOS sandbox escape vulnerabilities
Mickey Jin: A popular way that malware tries to slip into macOS is by abusing its sandbox escape, which allows the malware to break out of the operating system's protected sandbox to access the user's underlying system, software, and data. Thanks to @patch1t's "attack surface" cheat-sheet, we now have a comprehensive look at the weaknesses in macOS' sandbox protections.

Voted in America? This website doxxed you
404 Media ($): U.S. voter rolls are public, but still highly restricted at the states' level — though not impossible to obtain. One website called VoteRef, set up by a former Trump campaign official, is collating and publishing voters' registration data — including home addresses. This is (as of the time of writing this) entirely legal, because there are few restrictions on U.S. voters' data, and even fewer laws there to protect it. This is a major privacy and security threat, given there's been a rise in political violence of late... and yet just seems to be Yet Another Totally Normal Thing in America™. Politico wrote earlier this year about the states trying to fight against these sorts of sites, yet still failing in the courts.

Canada orders closure of TikTok Canada, citing national security
Government of Canada: The Canadian government has put the kibosh on TikTok Canada, the social media giant's operations in the country, which TikTok's parent, Bytedance — unsurprisingly — isn't happy about, and claims will destroy hundreds of jobs. This isn't a ban on Canadian users accessing TikTok, but the government said the decision to shutter the company's Canadian operations was based on national security. The specific reason wasn't given, because, guess what? National security, wink wink. @mattjay has a good thread on this.

Crypto CEO kidnapped for $1M ransom
CBC: Sticking with Canada for a secon... and what now?! Who needs ransomware when you've just dragged the CEO of a crypto company off the street into your van, and threatened him into paying a $1 million ransom? That's exactly what happened in Toronto during rush hour this Wednesday. The CEO, who runs WonderFi, was released unhurt, and client funds weren't taken. But this is, alarmingly, one of many instances of suspects using physical violence against cryptocurrency owners. The rates of these kinds of incidents tend "to correlate with the exchange rate of bitcoin," per CBC. Huh, so let's go take a look at the price of bitcoi... ah, gotcha.
A screnshot showing the market cap graph of bitcoin, at roughly $79,800 U.S. dollar — its heighest ever price.
Cyberattack on Microlise disables prison van and courier vehicle tracking
SecurityWeek: Tracking systems and panic alarms in prison vans and courier vehicles were disabled this week after a cyberattack at Microlise, which provides car and vehicle tracking solutions for fleet operators. The company told the London Stock Exchange that it was making progress in its recovery, but that some employee data was stolen in the cyberattack. (According to London's FT, some prison van crews were "unaware that vehicles were still being used to transport prisoners for three days after the attack despite continuing software faults" — !!) Telematics and vehicle tracking systems — the technologies that tap into a car's data banks — can be a major weak-link in vehicle cybersecurity.
~ ~

OTHER NEWSY NUGGETS
Pirating software? That might be an infostealer: So, let's go back to Snowflake for a hot second. Remember what ultimately caused those massive data breaches? Stolen customer passwords. And how were those passwords stolen? Infostealing malware, or infostealers, which are often bundled in pirated or cracked software. Once installed on a user's computer, the infostealer can siphon and upload the contents of the user's browser password manager and more to the attacker's servers. In some cases, this type of malware can also steal session tokens, which allow hackers to log in as if they were you without needing your password or multi-factor code. @josephcox's reporting digs into the wider cybercriminal ecosystem of stealing and trading stolen credentials. (via Wired ($))

Hack, hack, ban, ban: Activision patched a bug in October that they said affected a "small number" of Call of Duty players who were getting banned seemingly at random. Turns out it was a video game hacker who found a bug in Activision's anti-cheat engine, Ricochet, which allowed the hacker to ban "thousands upon thousands" of players over the past few months by triggering banned keywords, such as those related to cheating (including "Trigger Bot," the name of a popular cheat). Here's a look at how the exploit went down, and a look at the back-and-forth race between game makers and game hackers. (via TechCrunch, @zebleerpo)
A screenshot of an in-game notification of a 'friend request' in Call of Duty containing a keyword, "Trigger Bot," the name of a popular cheat. It's this keyword that gets the recipient banned.
Aussie social media law prompts data alarm: Australia has proposed a new law effectively banning under 16s from accessing social media. The move is controversial for a lot of reasons. but from the security point-of-view it's worth noting that enforcement could easily result in age verification checks — and that means collecting lots of data. @ShaneHuntley, one of Google's top security researchers and Aussie native, explains the risks with age verification in the tweets. Collecting historically huge amounts of data hasn't worked out so well for Australia over the past year or so... considering huge data breaches at Medibank, MediSecure, Ticketek, and others... (via NPR, @ShaneHuntley)

Thousands of probationers' data exposed: Data breach hunter @JayeLTee found a publicly exposed system spilling personal information on close to 500,000 U.S. probationers from a service called Professional Probation Services, a company that claims a "corporate culture of knowing right from wrong, and doing right — every time." The exposed data includes Social Security numbers, email addresses, and more. But, instead of "doing right" and disclosing the incident to those affected, the company appeared to go into "hiding mode," including by removing the CEO's name from the website. Ah, yes, the internet — where everything is forever. Good job there's a copy! (via @JayeLTee)
A side-by-side screenshot from JayeLTee's blog, showing the PPS website previously showing the CEO's name and face, and then a photo of the website with it removed following JayeLTee's disclosure to the company.
Soltani, signing off: Ashkan Soltani, the privacy buff who headed California's Privacy Protection Agency, the enforcement arm of California's groundbreaking privacy law, the CCPA, will leave the agency he founded after three years at the helm. Soltani, a former journalist and researcher who covered the Snowden files extensively, said the agency is "well-positioned" to continue leading the state of California — and the wider U.S. — in privacy and consumer protection. Congrats, and thanks, to Soltani. (via Politico Pro ($), @alng)
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
For those skipping straight to the happy corner this week, I saved you a spot. Come in. Welcome to everyone, and everyone is welcome.

Kids! If you ask your hacker parents how they spent their time online during the 80s and 90s, prepare for this Glomar response.

Some actionable advice for those on the social webs and wanting to keep your privacy and security in as best shape as you can: Block Party does good work to protect you against online harms before they can strike. The Washington Post ($) has some good yarn on the startup. (via @evacide)

If you, like me and — well, everyone, probably — is concerned about securing your digital data and communications in the wake of the China Typhoon-related hacks, former CISO @boblord has a beginner's guide on what you need to know about securing your phone, messaging and more. From passkeys to using a password manager, these are all good bits of security advice anyway. Encryption is the way to go. Encrypt all the things!

And, finally. I have some words on this to come next week, too, but wanted to share a note by The Verge about the PRESS Act, a press protections bill that was passed by the House in January and waiting for the Senate to take up a vote. The bill, if passed, enshrines federal and nationwide protections for journalists from having to give up their sources, and would replace a patchwork of different state laws across the United States. As someone who's literally had the FBI turn up at their house for doing this job, or for the journalists who had their phone records secretly seized to search for clues about their sources, it's intimidating as hell and all of this can have a real chilling effect on journalism and a free press — something that, as The Verge notes, will become increasingly relevant in a second Trump administration, during which all of the aforementioned happened. The bill has broad bipartisan support, but just needs a vote on the Senate floor. As someone who reads the news — you're reading this newsletter right now! — please, do everyone a huge favor and ask your senator (via the ACLU) to pass the PRESS Act today.

And, your final moment of zen this week. Can it make tea? Can it run Doom? Can it make tea and run Doom? Looks like you've got yourself a hackable teasmade.
Glenn Pegden toot: "If anyone familiar with 80s UK chintz needs cheering up today…. …. Last Night I got Doom running on a Teasmade," followed by a photo of a teasmade running 'Doom' in its embedded display.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat-and-friend special are Pepsi, a 14-year-old kitty (whose human tells me that she recently finished a six-month course of chemo, congrats!) and who occasionally tolerates her dog brother, Toby (who in my opinion is a very huggable and handsome pup). Well, you two are so adorable, and considerably warmed my heart this week. Thanks so much to Sebastian for sending in!
Pepsi is an orange and brown kitty on a couch next to Toby, a very handsome pup.
Send in your cyber cats! (or a non-feline friend). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's all for this week. Thanks for reading, it really means a lot. I'm sending all my good vibes and love this week, wherever you read this newsletter.

As always, please do reach out if you have any feedback or want to drop anything in the newsletter for the following week. It's always lovely hearing from you, especially when it's a cyber cat (or friend).

Onwards,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — november 3 edition

✇~this week in security~ Archive Feed
this week in security — november 3 edition
Sophos reveals years-long Chinese hacks, DOJ takes down Redline, Okta's new auth bypass bug, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

🗳️ volume 7, issue 40 🗳️
View this email in your browser | RSS

~ ~
Ahh, it's good to be back! There's an autumnal crisp in the air. The leaves have turned. There's a pot of coffee on the stove. It's so nice to start today's newsletter after a refreshing two weeks awa... oh no.
a man sat at his desk closing his laptop, with an "oh my god what the hell" expression on his face, mouthing the word, "oh..."
...alright, let's get to it. Welcome back to ~this week in security~
~ ~

THIS WEEK, TL;DR

Inside Sophos' five-year war with Chinese hackers targeting its firewalls
Wired ($): Let's start several timezones away in Chengdu, China, where a network of hackers carried out years-long hacks against customers of Sophos firewalls. By targeting these network-edge devices, these hackers can gain a foothold inside a victim's organization. After five years of chasing the hackers, Sophos finally revealed this week its collective effort, and how it caught the hackers' red handed. In some cases, Sophos discreetly installed "implants" on the Chinese hackers' own Sophos devices to monitor their attempts to exploit the company's firewalls, which led to the unmasking of the long-running espionage operation. The full breadth of the research is pretty staggering, but good to see the company take on the security of its own products, raising awareness about the "cybersecurity industry's awkward silence around the larger issue of vulnerabilities in security appliances serving as entry points for hackers," per Wired's write-up. More by Sophos here.
More: Sophos | Bleeping Computer | @threatresearch | @a_greenberg | @gossithedog

U.S. and international partners take down Redline and Meta password stealers
Justice Department: In what increasingly feels like the "DOJ's weekly corner," the feds and its international partners this week announced the unveiling of an indictment against a Russian national for allegedly creating the Redline (and Meta) password stealing malware (which the feds said were largely the same operation). These were malware-as-a-service operations, which allow other cybercriminals to access reams of usernames and password combinations stolen directly from millions of victims' computers. Maxim Rudometov, whose arrest status (if any?) isn't yet known, could face 35 years in prison if caught. Redline is a notorious infostealer, and found used in a series of hacking campaigns, including the Uber hack in 2022. Password stealers were also the way that so many Snowflake customers were hacked earlier this year (remember that?). Turns out the DOJ found Rudometov in part because the hapless hacker's opsec was so bad that he used his hacker handle in his profile on at least one Russian dating site.
More: Eurojust | TechCrunch | The Register

Okta warns of 'long username' authentication bypass bug
Okta: And what feels more and more like "Okta-corner..." (well, maybe stop releasing bad security news on a Friday night?)... Okta dropped the ball (again) and took to the most inconvenient time to announce it — and folks clearly aren't happy about Okta's handling of this new authentication bypass bug (which given the company's past incidents, this tracks). Get ready for this one: In certain cases, accounts with usernames of 52 characters or more "could allow users to authenticate by providing only the username, regardless of the password entered." You can read the full advisory online, since it's not easily findable on Okta's website or Trust homepage (which makes you wonder why). Pour one out to the countless Okta customers who had to work Friday into the weekend.
More: The Verge | @mattjay | @SecureOwl | @k8em0 | @dcuthbert
vx-underground tweet: "October 30th Okta disclosed a vulnerability whereas individuals could bypass AD/LDAP Delegated Authentication by providing a username greater than 52 characters. It required a cached previous success login attempt. tl;dr employees with long last names are a security threat."
Chinese hackers stole phone audio from both Harris and Trump campaigns
Wall Street Journal ($): And since we have a few minutes, let's check in on the Volt Typhoo... oh no, it's worse than it was. Looks like the Chinese hackers behind a series of intrusions into U.S. wiretap systems (yes, these are required by law) are still in those systems, and as such are able to listen to any unencrypted call and read any unencrypted text message of potentially anyone in the United States. The hackers, per the WSJ, have been accessing the audio from both presidential campaigns. There's still a lot up in the air and plenty remains uncertain. What is clear, though, is that backdoors evidently can — and will — be abused to spy on people. That's the point! Maybe we shouldn't have them to begin with?
More: Washington Post ($) | @RonDeibert
~ ~

THE STUFF YOU MIGHT'VE MISSED
Senators warn of U.N. Cyber Convention consequences
Sen. Ron Wyden: A group of Democratic U.S. senators, led by Ron Wyden, are sounding the alarm over the new U.N. Cyber Convention, which they say could be used by some countries to justify censorship, surveillance and human rights abuses. The lawmakers also warn that the convention doesn't do enough to protect journalists or security researchers from reporting on or advocating against authoritarian abuses. More via @magmill95 or The Record, take your pick.

Colorado voting passwords accidentally posted online
9News: Here's a line you don't want to read a week before the election: "The Colorado Secretary of State’s Office inadvertently posted a spreadsheet to its website with a hidden tab that included voting system passwords." On the bright side, at least there were passwords to begin with, the issue was quickly fixed, and officials said there was no breach of voting machines. That's good news. In reality, the bigger problem are deepfakes, which use AI to make fake but convincing audio or video content, with the goal of influencing the vote or sowing discord about the integrity of the election. Some of it's already been linked back to Russian disinformation units, per the FBI.
A screenshot from one of the spreadsheets containing passwords posted online, which includes a list of election machines and where they're located.
Hacking-for-hire scandal rocks Italy, implicates Vatican
Politico: Incredible news out of Italy, where a hacking-for-hire scandal is unraveling. Politico reported this week that prosecutors accuse an IT consultant of being behind a multi-year breach of a national security database, which allowed the downloading of reams of private data belonging to thousands of Italians (including the president and prime minister!) of which some of the data was used for blackmail and intimidation. Some four people have been arrested so far, and prosecutors are scrambling to investigate dozens more. So far, the Vatican(!) and Israel have both been found seeking information from the hacking network, for reasons yet to be ascertained. A very, very curious story, indeed. More via @Bing_Chris.

Russia's SVR using RDP files to hack networks
Microsoft: Keep an eye on rogue RDP configuration files flying around, it could well be Russia's SVR trying to hack into your networks, according to Microsoft. The SVR hackers (think Russia's foreign intelligence service), known as Midnight Blizzard or APT29, are highly capable and skilled (and also hacked into Microsoft, no less!). Watch out for this new attack method. Microsoft has some IOCs for you to check out.
~ ~

OTHER NEWSY NUGGETS
U.S. hacked Venezuela in failed overthrow attempt: The CIA reluctantly but successfully hacked Venezuela's military payroll system some time around or after 2019, as part of a wider effort by the then-Trump administration to destabilize the Maduro administration. The hack succeeded, but the effort to oust the Venezuelan strongman ultimately failed. The inside story finally comes to light. (via Wired ($), @zachsdorfman)

Wiz CEO says company targeted by deepfake: Assaf Rappaport, the CEO behind cloud security juggernaut Wiz, said his company was recently targeted by a deepfake of his voice. "Dozens of my employees got a voice message from me," Rappaport said this week. "The attack tried to get their credentials." The attack failed because the deepfake didn't sound like the CEO, in part because he has public speaking anxiety (which helped in this case!). Good to know that anyone, even security companies, can be targeted by this AI-generated trickery. (via TechCrunch, Forbes ($))

India using cyber tech to spy on separatists: A warning from the Canadian government for folks in the Indian diaspora that India is using spy and surveillance tech to track separatists and critics overseas. The Canadian government linked the intimidation efforts and attacks on Indians living abroad, including in Vancouver, to a top Indian government official called Amit Shah. This all comes amid the backdrop of India using spyware and hackers-for-hire, which — as a reminder, Reuters' ($) blockbuster story about Appin is back online after an Indian court lifted its takedown order. (via The Guardian)

No clicks needed for this Synology bug: Home backup stans, make sure your Synology systems are up-to-date, as there's a new vulnerability that could allow "zero-click" (as in, interactioness) access to your storage drive. The bug, found in the photo engine, was patched, but the researchers warned that the bug is easy to exploit and can be exploited over the internet. More from @kimzetter in the tweets, and with more from @adamshostack. (via Wired ($))
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Woooooof, and we're done with the news. Leave all your stress behind; it's time for the happy corner.

First up, a major congrats to all the winners and those recognized in the Cyberscoop 50, some of the finest minds in cybersecurity as tallied by some 800,000 votes. From CISOs and CISA to security researchers and threat intelligence, these are all well deserved.

This week for the Day Job™ (disclosure alert!), I sat down with Marqeta's Heather Gantt-Evans and MongoDB's Darren Gruber at TechCrunch Disrupt to talk, among other things, about advanced persistent teenagers — the groups like Lapsus$ and Scattered Spider — and why the industry has underestimated the threat.

Moving on to brighter news... *drumroll please* Yes, it's time for an update to our long-running series, What Can We Run Doom On?, and this time it's... it's the new Nintendo Alarmo, the interactive alarm clock. Why run Doom? Why not? Full details from @GaryOderNichts in the tweets (+ source code, too!).
A Nintendo Alarmo on a desk, with a small LCD display that's running the first-person shooter, Doom.
In excellent (and frankly, well timed) news, the U.S. election system is secure and we should be confident in it. Houston Public Radio has a good story on how federal cybersecurity and election officials plan for all eventualities, including addressing distrust and disinformation. This is an excellent read. "No matter who you vote for, you can have confidence that your vote will be counted as cast," says top U.S. cyber official @CISAJen.

And with that, a personal note from me...

Last year, after more than a decade living and working as a U.K. expat in the United States, I made the decision to become a U.S citizen, so that my voice — and vote — in this election would count. I felt it was my duty to give back to a country that has given me so much. America welcomed me, gave me opportunities, and the people are some of the finest in the world. In things I didn't think I'd have to say or qualify in the year of 2024, I stand on the side of human rights, peace, freedom, and democracy. This is not a controversial opinion! Let love win, it's all we have. If you can, please vote on November 5 (or sooner).
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Ravioli (great name, by the way), who can be seen here conducting a live wiretap. Can you hear what's being said on the line? "More treats, more treats..." I believe you, Ravioli! Thanks so much to Tristan for sending in!
Ravioli is a white and grey/brown kitty who can be seen with their teeth exposed chomping on a rope-like chew toy. Very cute.
Send in your cyber cats! (or a non-feline friend). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
And that's it for this week — my deepest thank you for reading (or subscribing, wherever you get this!). I hope you have a great week — and I'll catch you next Sunday with your usual dispatch from the past seven days.

As always, please do reach out if you have any feedback, or want to submit something for the newsletter! Your cybercats (and their friends) are always welcome.

Love and peace,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — october 20 edition

✇~this week in security~ Archive Feed
this week in security — october 20 edition
Anonymous Sudan arrested, US charges SEC's X hacker, Microsoft loses security logs, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 39
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.S. charges Sudanese men with running powerful DDoS-for-hire gang
Washington Post ($): Finally, the long-running DDoS-for-hire gang called Anonymous Sudan is done, after its members — two brothers from Sudan (quelle surprise) — were arrested earlier this year and charged with computer hacking and a range of other crimes. Anonymous Sudan was also charged with "knowingly and recklessly causing serious bodily injury or death" in its cyberattacks targeting hospitals, which went on to cause real-world downtime and harm to patient care. The group was certainly powerful for its size, briefly taking down Microsoft and PayPal's services, but was known for consistently hitting targets with DDoS that would favor or benefit Russia. U.S. prosecutors denied a link between Anonymous Sudan and Russia, but others aren't so sure about that.
More: U.S. DOJ | Europol | Wired($)) | Risky.Biz | @jkirk

U.S. charge Alabama man with SEC's X account hijack
Ars Technica: Busy week for the DOJ... after a U.S. man was charged with participating in the hack earlier this year that saw the SEC's X account hijacked and posted false information causing the price of bitcoin to rocket. The Alabama man was charged with SIM swapping the account belonging to a SEC staffer's phone, which ultimately allowed access to the X account (since it had been MFA'd up to its eyeballs). The Alabama man printed a fake ID, claimed to be an FBI agent, and secured the SIM swap in-store. What caught the hapless hacker? Was it reams of CCTV or a ton of evidence from the store and logs? Or maybe it was the accused Googling, "What are the signs that you are under investigation by law enforcement or the FBI even if you have not been contacted by them?" Yeah, no kidding! The indictment is a real hoot.
More: U.S. DOJ | TechCrunch | The Record | BBC News

Microsoft tells customers it lost log data for key security products
Business Insider ($): OK, apologies as this is... two weeks late(!) but wanted to flag this one as it's pretty important. A year after Microsoft begrudgingly agreed to open up the security logs for its customers' cloud products... Microsoft has now conceded that it lost weeks worth of those logs. The technology giant told some customers (the notice is now public) that the logs had failed to save between September 2 and September 19. It wasn't a cyberattack, but "a bug in one of Microsoft's internal monitoring agents resulted in a malfunction in some of the agents when uploading log data to our internal logging platform." The issue affects logs from Entra (which, y'know, important), Sentinel, Defender for Cloud, and Purview... so all fairly critical! Welp. Microsoft's handling of this is classic Microsoft, in that its top PR people stuck their fingers in their ears in the hope that this'll all go away. It won't. Instead, Microsoft continues to flush its customers' trust down the toilet.
More: TechCrunch | Bleeping Computer | @GossiTheDog
~ ~

THE STUFF YOU MIGHT'VE MISSED
How Apple Passwords generates strong passwords
Ricky Mondello: See that new Passwords app on your iPhone and ever wondered how it generates seemingly random phrases that aren't actual words but aren't gibberish either, like hupvEw-fodne1-qabjyg? Good news! Apple's @rmondello has your back with a great explainer of how Apple Passwords generates two-syllable "words." All for the sake of passwords that are briefly memorable but not memorizable; got it!

Taking apart an old Redbox kiosk for fun, data, and Doom
404 Media ($): Those aging Redbox DVD rental kiosks are no more, but not to a community of hackers and tinkerers, who are more than happy to take these defunct devices home to play. Turns out these once-helpful DVD rental machines are still loaded with data, including partial credit card numbers and transaction details. Although the devices can't "phone home" to their official servers, the tinkerers have still managed to repurpose the machines for their own uses... like running Doom. Solid @foone thread to check out, too.
Foone toot: "OH HEY BAD NEWS: when someone opens up the hard drive of a redbox unit, they can pull a file which has a complete list of titles ever rented, and the email addresses of the people who rented them, and where and when"
Nah, Chinese researchers didn't break RSA encryption, but nice try
Rob Joyce: A story went around this week claiming that Chinese researchers broke the widely used RSA encryption using a quantum computer. Ehh, not so much, and ex-NSA's @RGB_Lights dispels the claim, as the attack targeted only a 22-bit key (which isn't very complex) and the computer itself wasn't actually quantum-based. All to say, make a mental note — bad actors will still collect encrypted data today for future decryption, but we're just not at the decrypt-later stage yet.

Some 87,000+ Fortinet devices still open to exploitation
Help Net Security: I know you're just as frustrated as I am having to read this what feels like on repeat every week, but here we are again. There's yet another security bug in a modern-day security appliance, this time it's Fortinet's FortiGate firewalls. The bug, known as CVE-2024-23113 (also see watchTowr Labs), is actively being used in hacking campaigns. According to the Shadowserver Foundation, more than 87,000 exposed Fortinet devices are connected to the internet. On the bright side, the meme game has been excellent.
Alex Chapman tweet: "CVE-2024-23113," followed by a Futurama post-apocalyptic meme, of Fry walking past a sign that says, "0 days since 90s era vulnerability found in security appliance."
Critical hardcoded SolarWinds credential now exploited in the wild
The Register: Surely we can't get any worse than tha.... oh, COME ON. Stand up, SolarWinds. Not like you haven't had enough attention already this decade, but here we are again with *checks notes* hardcoded credentials? The latest SolarWinds bug, aka CVE-2024-28987 has to be manually patched, or it can allow an unauthenticated user to access and modify internal data. Not at all an ideal situation, so patch (manually) today.
~ ~

OTHER NEWSY NUGGETS
Pixel gets security feature updates: Google rolled out Android 15 to its flagship Pixel devices this week, adding a ton of new features and functionality, including theft protection measures that require additional authentication if someone tries to alter key account or device details (similar to iOS 17.3). (via TechCrunch)

Pokemon maker hacked: The long-time gamemaker behind Pokemon, Game Freak, confirmed it was hacked, with decades of data stolen, including more than 2,600 items containing the names and email addresses of former and contract employees. Apparently the breach contains a fair bit of scrapped lore and unused concept art (and some of it quite odd). Not clear if this is some kind of hack-and-leak, or what the motivations are. (via Forbes ($), BBC News)

Kroger Face/Off: Add Kroger to the list of grocery stores that aren't worth your patronage, given the company's efforts to blanket its stores with facial recognition tech. Yes, the face-scanning technology used under the guise of preventing shoplifting but all too often gets things wrong (and people put in jail). Kroger made $3.1 billion in profit last year, so it's clearly not about its bottom line, but most likely about data, the other currency of the United States. (via The Record)

ESET's partner in Israel hacked: Hackers somehow breached ESET's exclusive partner in Israel to send phishing emails to businesses that pushed destructive data wipers under the guise of trying to protect the user against a state-backed threat. The company, ComSecure, hasn't commented on the incident, but ESET proper says it was "aware of a security incident which affected our partner company in Israel last week." ESET itself was not compromised, it said. (via Bleeping Computer, The Register)

Hacker still inside the Internet Archive: In not-so-great, late-breaking news (as in, just before this newsletter went out), the threat actor behind the breach of the Internet Archive has now auto-responded to every one of the non-profit's Zendesk tickets, clearly as a way to show they still have access to its systems. (The online archive remains in read-only mode for now.) @troyhunt, who initially disclosed the incident to the Internet Archive, posted the response from the hacker in a tweet, claiming the site hasn't yet reset its API keys. Suffice to say, this cyberattack is clearly ongoing. You can donate to the Internet Archive as it continues to rebuild. (via Washington Post ($), @troyhunt)
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Welcome to the happy corner — the more the merrier this week, and not a moment too soon.

It's Hallowe'en season, and so don't forget to check your kids' candy for malware, USB sticks laced with Stuxnet, homebrew auth, and errant large language models. Let the Hallowe'en memes begin! (And please do send in your favorite.)
A cut-through photo of a candy bar with a photo of Balrog inside, with the caption: "Parents, please check your kids candy this Halloween. I just found a Balrog, servant of Morgoth, in my son's candy bar. Be safe."
In excellent news, Hack To The Future, a deep-dive non-fiction by @hexadecim8, which follows the history of the critical and often-fraught relationship between the U.S. government and the hacker community, has gone to print! I'm super excited for this book, and it's out in December — just in time for the holidays. Pre-order today!
Hexa toot: "Big news: my upcoming book - Hack To The Future - has officially been sent to the printer! More news coming soon!"
Meanwhile, over on Bluesky, we have your latest get-out-of-webinar excuse:
Laura Gazzoli post on Bsky: "Unfortunately I will not be able to attend after all. My apologies, my initial enthusiasm was caused by a misreading of 'webinar' as 'winebar', under the circumstances I hope you understand"
...and speaking of solid advice: If, by chance, you do pick up the phone these days, here's an easy way to handle pesky callers.
Amit Serper post: "I rarely get telemarketing calls anymore but when I do I always ask in a very stern voice "IS THIS A SECURE LINE?". The person on the other hand usually says no and then I hang up."
And, before you go, check out @morgan_sung's new podcast series called Close All Tabs on KQED, exploring the incredible and often weird world of internet culture and politics. Available on Spotify and your usual podcast places. Plus, bonus cybercat!
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
Meet this week's cyber cat, Storm, who can be seen... Zzzz... Zzz... *snoozing* after a long day hacking... ssshh..... Zzzz..zz..zzz... thanks to Paul W. for sending in!
Storm is a white furry kitten sprawled out asleep on their human's desk with their belly exposed.
Send in your cyber cats! (or a non-feline friend). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
That's it for this week... and next... so this newsletter will return in a fortnight on November 3. Thanks for tuning in and reading, it's hugely appreciated! In the meantime, please do reach out if you have any feedback.

Gone phishin'...
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — october 13 edition

✇~this week in security~ Archive Feed
this week in security — october 13 edition
US investigating Salt Typhoon hacks, Internet Archive breached, Qualcomm zero-day under attack, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 38
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.S. officials race to understand severity of China's recent hacks
Wall Street Journal ($): Let's start this week with the "Typhoon" family of Chinese hackers gearing up for war. Over the past few months, (at least) three distinct China-backed hacking groups — Volt Typhoon, Flax Typhoon, and now Salt Typhoon — have been caught laying the groundwork for a future conflict with the U.S., such as over Taiwan. Salt Typhoon is the latest group to catch the eyes of U.S. authorities, after breaking into several major ISPs' wiretap systems (think AT&T, Lumen, and Verizon) in an effort to snoop on U.S. internet traffic and, potentially, access information on subjects of U.S. surveillance. U.S. officials don't yet seem to know how far and wide the intrusions go — some as recently as "within the last week"(!) — but now the ISPs are under the spotlight for how they implemented a government-mandated backdoor law from some 30 years ago. Lawmakers are asking questions [PDF], including some scathing words for the FCC and the DOJ for not doing anything about this sooner when previously warned.
More: CBS News | TechCrunch | EFF | @riana

Internet Archive hacked, 31 million user records stolen
Bleeping Computer: A seemingly random popup on the Internet Archive's website alerted visitors that the non-profit's internet's online backup engine was "on the verge of suffering a catastrophic security breach." Turns out that's exactly what happened. Some 31 million user records were stolen from the Internet Archive and provided to Have I Been Pwned. HIBP owner Troy Hunt contacted the Internet Archive (as detailed in his disclosure timeline), but the non-profit's site was DDoS'd and defaced with the popup warning of the breach at around the same time. The stolen passwords in the data set are bcrypt-encrypted but email addresses were exposed in plaintext. The Internet Archive said it was working on rebuilding the site after scrubbing its systems and upgrading its security. As an aside, attacking the Internet Archive has widely been considered a really, really sh*tty thing to do, akin to hacking hospitals or other public services.
More: The Verge | SecurityWeek | @troyhunt tweets | @brewster_kahle tweets
Morgan Sung tweet: "can't they take down my student loan servicer or something instead," quote tweeting Brewster Kahle, saying: "Sorry, but DDOS folks are back and knocked http://archive.org and http://openlibrary.org offline. @internetarchive is being cautious and prioritizing keeping data safe at the expense of service availability."
Hackers targeted Android users by exploiting Qualcomm chip zero-day
TechCrunch: Qualcomm confirmed this week that unknown hackers were exploiting a zero-day bug in its widely used chipsets, used by dozens of popular Samsung, Motorola and ZTE-made phones. Details of the bug aren't yet known, but who found it is the most telling. Google's Threat Analysis Group, which investigates government hacking threats, found evidence of "in the wild" exploitation — meaning the bug is actively being used to hack people — and Amnesty confirmed the report, suggesting activists (or other members of civil society) may have been targeted. Could this be another spyware attack? Possibly. But more to come in the next few weeks, likely, when patches are rolled out and the risk to customers lowers.
More: Qualcomm | @__sethJenkins | @mattjay | @evacide

Microsoft's Patch Tuesday fixes two actively exploited zero-days
CSO Online: It's that monthly roundup of Patch Tuesday updates, landing with fixes for two zero-days exploited in the wild and another three publicly disclosed zero-days. One of the exploited bugs is a remote code execution flaw in Microsoft Management Console, which can trigger when a user is tricked into opening a malicious saved console file (though Microsoft was light on details around who was exploiting it). Bleeping Computer also has a list of recent security updates from other companies, from Cisco (plenty) to Ivanti (including zero-days, again).
More: The Register | @wdormann
~ ~

THE STUFF YOU MIGHT'VE MISSED
Hacked 'AI girlfriend' data shows CSAM prompts
404 Media ($): An 'AI girlfriend' site that lets its users create an "uncensored" chatbot was hacked and its contents leaked, including users' specific chatbot prompts — some of which described CSAM-related prompts. @Laughing_Mantis has heard of two extortion attempts linked to this breach, opening up a new fresh wave of hell for network defenders.

Palo Alto fixes bug that allowed remote admin takeover
Horizon3.ai: Researchers disclosed a series of bugs in a Palo Alto product called Expedition, including an unauthenticated SQL injection bug that allowed the exfiltration of database data. Cybersecurity is difficult, and so is software, but this isn't what you'd expect in a product from a security company. @dcuthbert, preach!
Daniel Cuthbert tweet: "I’ll keep on screaming this until I retire: it’s not the attackers I worry about, it’s the utterly shit engineering we continue to see from those promising to protect us. Stuff like this is inexcusable."
14,000 medical devices are online, unsecured and vulnerable
Cyberscoop: Nearly half of the 14,000 IP addresses of exposed and vulnerable medical devices as surveyed by Censys are located in the United States. Blame in part the decentralized nature of the U.S. healthcare system, compared to the U.K., which only has a handful of exposed devices online.

Meet the team paid to break into top-secret bases
BBC News: The BBC has a good story on red teaming, the groups of physical hackers and social engineers tasked with breaking into military bases or corporate headquarters upon their request. As the BBC goes, it's a pretty vanilla take on red teaming, but a nonetheless good read for anyone who wants a surface level view of how a physical pen test can go down.
~ ~

OTHER NEWSY NUGGETS
Alright, buckle up. We've got some hacks to blast through.

MoneyGram 'fesses up to data breach: Money transfer giant MoneyGram confirmed a data breach, after last month experiencing a cyberattack caused a week-long outage. The company, which serves more than 50 million people a year, wouldn't share how many customers are affected. (Disclosure: I wrote this story!) The data includes personal information — and transaction data — including dates and amounts. Bleeping Computer has more reporting on the incident itself, and more from @TonyaJoRiley in the tweets. (via TechCrunch)

Someone scraped thousands of Fidelity customer docs: Fidelity, one of the world's largest asset managers, said 77,000 customers had personal information scraped (seemingly) from a Fidelity customer document storage server. Someone created two new user accounts on Fidelity that allowed some kind of access to the document storage, so certainly a breach but not quite a hack. A strange case, compounded by the fact that Fidelity wouldn't answer any questions — but other data breach notices confirmed the accessed data included Social Security numbers and driver's licenses. (via TechCrunch)
A screenshot from Fidelity's data breach notice with New Hampshire, which reads: "Between August 17 and August 19, 2024, an unauthorized third party accessed and retrieved certain documents related to Fidelity customers and other individuals by submitting fraudulent requests to an internal database that housed images of documents pertaining to Fidelity customers. Fidelity detected the unauthorized activity on August 19 and immediately disabled the two accounts used to make the requests and terminated the access. An investigation was promptly launched with assistance from external security experts and remedial actions were taken to prevent a recurrence of this type of activity. The unauthorized access was limited to the single internal database and since August 19, there have been no new instances of this unauthorized activity. The unauthorized third party did not gain access to any Fidelity customer accounts or funds."
FTC slaps Marriott and Starwood over breaches: The Federal Trade Commission told the hotel giant Marriott (including Starwood, which Marriott owns) that it must pay $52 million and improve their cybersecurity postures after several data breaches between them, including three incidents between 2014 to 2020 affecting more than 344 million customers worldwide. Glad to see the FTC act... several years after the fact. Better late than never, eh. (via FTC)

IronNet settles class action lawsuit: IronNet, the company set up by former NSA director Keith Alexander that was left to crumble under its management (check out this AP yarn from last week's newsletter), will pay $6.6 million to settle a class-action lawsuit that accused the company of making false and misleading statements to plump up its stock price. It's a huge fall from grace for a company that claimed – crucially(!) — a lot but allegedly provided little substance. (via DataBreachToday)

Aussie big firms made to report ransom payments: Some interesting news out of Australia; larger businesses (some 6.5% of all businesses in the country) that make $3 million (AUD) in annual turnover or more will soon have to report ransom payments to the Australian government. That's a start, given that banning ransom payments outright probably isn't going to happen — at least in the U.S., which would make the whole international side of enforcing the ban far trickier. (via The Record)

Firefox flaw, fast fix: The folks at Mozilla have updated Firefox to fix a zero-day bug under active attack within 25 hours of receiving its initial bug report. Per @campuscodi, the zero-day was used to target users of Tor Browser, which relies on Firefox. That's a fast fix, for sure — update today! (via Mozilla)
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Not a moment too soon... welcome back to the happy corner. Just a couple of things from the barrel this week:

First up, here's one way to never fail the phishing test.
An animated GIF of two people shaking hands, one says "HR congratulating me for not failing the phishing test email," and the other person saying "me who doesn't read emails"
And... finally. A hacking group this week took out some of Russia's top state media outlets as well as several court and judicial websites on Putin's 72nd birthday, per Cyberscoop. The hackers left a message: “Happy birthday, d–khead," presumably about the deathly-looking aging autocrat (but actually...). The Russian authorities weren't thrilled, but maybe that's what you get when you illegally invade your neighbor twice in a decade?
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Princess Buttercup, who can be seen here conducting an adversary-in-the-middle attack on their human's computer. Very stealthy indeed... thanks so much to Sean K. for sending in!
Princess Buttercup is a white and grey kitty sitting on their human's laptop on a couch.
Send in your cyber cats! (or a non-feline friend). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
And that's all there is!. Back next with the usual round-up from the week, and hopefully more on those China-backed hacking groups that seem to have the U.S. on edge. We will see!

As usual, feel free to reach out with any feedback, or anything you want to share for an upcoming newsletter.

I'm off to enjoy some autumnal nature and changing leaves.

Catch you next Sunday!
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — october 6 edition

✇~this week in security~ Archive Feed
this week in security — october 6 edition
LockBit worked with Russia-linked hackers, Meta's smart glasses hacked to insta-dox, China hacked US wiretap systems, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 37
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.K. says LockBit worked with Russia-linked hackers
National Crime Agency: Let's start this week in London, where U.K. officials revived LockBit's previously seized dark web leak site to announce the revealing of a LockBit ransomware affiliate as also a high-ranking member of Evil Corp, a Russian cybercrime gang with links to the Russian government, thanks in part to his dad, a former FSB official. Along with the unmasking, the U.S. issued fresh sanctions and an indictment. The fresh links between the two groups are interesting as U.K. authorities say Evil Corp provided "direct assistance" to the Russian state, in part by targeting NATO countries with hacks, though the details weren't immediately known. It's the latest round of activity from the U.K. and U.S. authorities attempting to take down LockBit for good.
More: Justice Dept. | U.S. Treasury | Bloomberg ($) | TechCrunch | BBC News
National Crime Agency tweet: "Further Evil Corp cyber criminals exposed following NCA investigation, one unmasked as LockBit affiliate, as UK, US and Australia unveil sanctions," followed by a graphic showing the connections and overlaps betwen Evil Corp and LockBit.
Hackers put facial recognition on Meta's smart glasses to dox strangers instantly
404 Media ($): Well this is probably one of the most terrifying things I've seen in a while... A pair of Harvard students hacked Meta's new smart Ray Ban glasses (which have a camera in them — it's Meta, what do you expect?) to feed in raw camera data to a facial recognition service, allowing them to identify people in real-time. Here's the video. Using a large language model (LLM), the students are able to walk up to someone and identify them from their photo — using public data pulled from the internet. It's remarkable and concerning how fast this insta-dox works. One of Meta's not-so-smart spokespeople clapped back that this "could be used with ANY camera, correct?" But it wasn't; it was done using Meta's camera-enabled glasses that look like any regular pair of non-intrusive glasses, which is the point. Genuinely frightening concept brought to life by two incredibly smart students. It is, ultimately, Meta's fault for enabling this project. If you don't like the bad press, maybe don't build things that could be used for abus... oh wait, right, because it's Meta.
More: Ars Technica | I-XRAY [Google Docs] | @AnhPhuNguyen1

How a 'serial hacker' who tried to fake his own death got caught
TechCrunch: Jesse Kipf was a prolific hacker who brokered access to systems he hacked to other cybercriminals. Then in early 2023, Kipf tried to fake his own death by breaking into a U.S. state government's death registry. But Kipf made a couple of critical errors that led FBI agents right to Kipf's front door. Here's the wild inside story of how Kipf got caught, and ultimately sentenced to seven years in prison.
Archive: Justice Dept. | More: @lorenzofb

China hackers targeted U.S. wiretap systems
Wall Street Journal ($): What is old is new again. Young'uns, gather round. Back in the '90s when cell phones were becoming a thing and the internet was still in its early days, the U.S. government decided to pass a law called CALEA that added a legal backdoor every phone company and ISP so that the feds could wiretap phone and internet traffic at will (with a warrant... sometimes!) Sounds bad, right? The OG crypto folks (aka cryptographers) warned for years that there's no such thing as a secure backdoor (and subsequently went on to make this point several times during the "Crypto Wars" of the 2010s, too). Skip to 2024, and now we have Chinese-backed hackers — aka Salt Typhoon (more on this here) targeting these very wiretap portals at phone companies and ISPs, such as AT&T, Lumen (previously CenturyLink), and Verizon at least. According to the WSJ, the hackers engaged in a "vast collection of internet traffic" that these portals allow access to. Thanks so much to the Congress of 1994 for screwing up 30 years later. What's weirdly just as depressing is that some of these very same lawmakers are still in office...
More: @dnvolz | @mattblaze
Frederic Jacobs toot: "China targeted and might have held for months access to the infrastructure used to do wiretaps on the AT&T and Verizon networks. This is a huge "told you so" moment for the cryptographic community that has been saying that such infrastructure does present a huge risk to national security. China reportedly used this capability for intelligence collection, obviously without a warrant... "
~ ~

THE STUFF YOU MIGHT'VE MISSED
Collapse of national security elites' cyber firm leaves bitter wake
Associated Press: Remember IronNet? You probably do, even if the company didn't really get up to much, let alone make money. Founded by former NSA director Keith Alexander, after he was shot out of the government's retirement cannon after losing a huge cache of highly classified documents stolen by a former NSA contractor... I digress... IronNet eventually collapsed after years of mismanagement by top leadership and allegedly engaging in "questionable business practices" and "produced subpar products and services." Actually, it sounds like most of the cybersecurity product world, except, IronNet failed to keep up appearances, and left a trail of unemployment — and anger — in its wake.

Zimbra bug exploited by cc'ing email addresses
Ars Technica: Attackers are actively exploiting a critical-rated vulnerability in mail servers sold by Zimbra in an effort to plant backdoors, per researchers. Zimbra says the bug, CVE-2024-45519, is now fixed but for a time allowed unauthenticated attackers to plant a backdoor on an affected server by sending an email to the target, with a ton of obfuscated code in the cc: field, which when opened by the server plants the backdoor. The folks at @Shadowserver have data, and more from Proofpoint's @justicerage and the excellent @wdormann.
Ivan Kwiatkowski toot: "If you're using @zimbra, mass-exploitation of CVE-2024-45519 has begun. Patch yesterday. Malicious emails are coming from 79.124.49[.]86 and attempting to curl a file from that IP," followed by a screenshot of the cc: field in a Zimbra email showing obfuscated shellcode.
As 23andMe circles the drain, what happens to the DNA data?
NPR: If you haven't already asked to delete your data from 23andMe, the sinking DNA genetic testing company that last year had a catastrophic data breach, now would be a good time. Here's where and how you can delete your data. 23andMe faces removal from public markets and the company's board members recently resigned en masse. If 23andMe goes private or gets sold, so does your private DNA data. Don't give people grief for using a service that ultimately let down its customers (in a multitude of ways) — just go and delete your data while you can.
~ ~

OTHER NEWSY NUGGETS
Crikey, mate! Another major Aussie data breach: G'day to everyone except I-MED, Australia's biggest medical imaging provider, which left "swaths of sensitive health and personal information" at risk because several company passwords were left online for a year. It looks like there wasn't a huge breach of data, but that the access itself is pretty telling. Big companies are still dealing with the same basic security issues from yesteryear, it's quite embarrassing. (via Crikey)

Cambodia arrests cyber journalist: Award-winning Cambodian freelance journalist Mech Dara, whose work has been vital in exposing cyber scams and human rights violations, has been arrested by Cambodian officials, leading to resounding criticism by rights and journalism groups. Repression against journalists in Cambodia is not unusual. Here's hoping for Dara's speedy and safe release. (via The Record)

Domains seized, ColdRiver disrupted: Those pesky ColdRiver hackers, who researchers have attributed to Russia's FSB, are back with a series of cyberattacks aimed at targeting civil society an...d it's gone again, after Microsoft asked a court to seize the hackers' domains. More than 100 websites were seized in this latest round targeting the group. Will it be enough to knock ColdRiver off the map for good? Probably not, as is the nature of advanced persistent groups. (via Justice Dept., Citizen Lab)

Mysterious zero-day hits Rackspace: Rackspace took its monitoring dashboards offline after a zero-day was exploited in one of its applications provided by ScienceLogic. Details remain a mystery, however. ScienceLogic won't say what or where the affected issue is, so now we have an actively exploited zero-day and practically nothing to work with. (via The Register)

North Koreans infiltrating U.S. crypto industry: More than a dozen blockchain firms inadvertently hired undercover IT workers (read: spies) from North Korea, presenting a major cybersecurity (and sanctions!) risk. The workers used fake ID documents, successfully navigated interviews, passed reference checks and presented genuine work histories. What do they want? Crypto! What do they want it for? Nuclear weapons! More from @skesslr in the tweets, and @SwiftOnSecurity, because this could well affect you. (via Coindesk)
Sam Kessler tweet: "North Korean IT workers with fake identities got jobs at @cosmos , @SushiSwap , @yearnfi , @FantomFDN , @zerolendxyz and several other big-name blockchain protocols. This investigation marks the first time any of these projects have publicly disclosed that they unknowingly hired the workers."
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
Finally, and not a moment too soon. Here's the happy corner.

We're long overdue on our long-running series of What Can Doom Run On? This week, it's the turn of quantum computers. As @Lumorti notes, there has yet to be a single practical use for quantum computers. "This changes today, with the release of Quandoom, a port of the first level of DOOM designed for a quantum computer." *audible gasps* — and it (kinda) works! If you're wondering how it functions, PC Gamer has you covered — also, this might be the best news headline of the week.
An animated GIF of a black and white wireframe model of Doom playing on a quantum computer.
In excellent news, @CISAJen has spoken: the U.S. election is secure and there's no chance that a foreign adversary can change the election results. That's right, not Iran, nor Russia or China can alter the final vote count. But there are plenty of things to keep a close eye out for, like misinformation, disinformation and undue influence (yes, even from bad actors here in the United States — you know who!). Remember to check your voter registration (and actually register — go to vote.gov!). We got this, America. More from the Associated Press on Easterly's comments.

Psssst — hey kids: While you're here, here's some very simple advice on how to stop apps and ads tracking you on your iPhone and Android devices. Thank the folks at the EFF!

Happy Cybersecurity Awareness Mo... oh..., turns out it was all just a lobbying effort to prevent actual cybersecurity regulation. Look, Cybersecurity Awareness Month happens every year and while some appreciate the general sentiments, in reality, we should be cybersecurity aware every day, not just for a month. Maybe if companies stopped laying off huge swathes of their staff and stopped approving exorbitant bonuses and compensation for their executives, maybe we wouldn't have some of the biggest data breaches in living history still happening because of fundamental and basic cybersecurity measures, like password reuse and lacking MFA.

OK, fine. I concede that there's one good thing that comes out of Cybersecurity Awareness Month, and that's @RGB_Lights' excellent meme game. And on that note, next time a company says there's "no evidence" of a data breach, well, here's your final thought for the week.
Rob Joyce toot: "It’s troubling to see intrusion responses struggle due to lack of logging and visibility. Build a robust logging strategy and practice hunts to truly understand what you're monitoring and what you can trust. Incident time is a painful moment for discovery learning," followed by a meme of Bart Simpson with a white cane and the caption is, "CHECKING FOR SUSPICIOUS ACTIVITY IN THE LOGS I NEVER TURNED ON" and Bart saying, "Nothing to see here."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week we have a ... two-for-one cyber-dog special (an extremely rare event). Here we can see Daisy (the brown pup) and Bear (the white pup with brown ears), caught by their human plotting their next red team engagement. Many thanks to Omar S. for sending in!
Daisy is a brown pup and Bear is a white pup with brown ears.
Send in your cyber cats! (or a non-feline friend). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
And that's all the news for now. Same time next week? I'll be back at the usual time with your rundown of the week's big news — bring your strongest coffee. I bet we'll hear more on those ISP breaches, too.

As always, you can reach out at any time by email with anything for the newsletter, or just to get in touch!

Take it easy,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — september 29 edition

✇~this week in security~ Archive Feed
this week in security — september 29 edition
Kaspersky force-replaces itself after U.S. ban, Iranian hackers charged with hack-and-leak, remotely hacking Kia cars, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 36
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Kaspersky deletes itself, installs UltraAV antivirus without warning
Bleeping Computer: You know what they say, "In Russia, antivirus uninstalls self." Or something like that, but that's exactly what happened this week when Kaspersky force-replaced its antivirus software quite literally overnight with... a completely brand new antivirus called UltraAV, which nobody's heard of and has absolutely no track record. Kaspersky and Pango, the maker of UltraAV, said to the effect of, "everything is fine, trust us!" But a lot of folks don't, and understandably! Kaspersky had until this week to figure out a replacement software for its one million or so customers before a U.S. sales ban comes into effect, preventing Kaspersky from selling or updating its software. This was about trust. Kaspersky could've asked for consent, but it didn't.
More: TechCrunch | Axios | The Register
Rob Joyce tweet: "This is why handing root-level access to Kaspersky was a huge risk. Users were "migrated" - software uninstalled and a totally different product was installed automagically. They had total control of your machine. #itsabouttrust," quote tweeting Aaron Kempf, who wrote: " Users are suddenly finding their Kaspersky anti-virus automatically uninstalled itself and has been replaced with 'UltraAV'."
U.S. charges three Iranians with hacking Trump campaign
BBC News: New week, new indictment. This time it's the Iranian hackers targeting the Trump campaign, because Iran has been on an absolute tear since the killing of Qasem Soleimani in 2020 and vowed revenge, even if that means trying to take out former government officials in the process. That's why Iran hacked the Trump campaign and tried (badly) to leak the stolen files. Turns out the hackers had access even as recently as last week. Three Iranians were charged with the operation; per the DOJ. It's not just the Iranians, but also the Chinese and the Russians working to influence the election. And please, do not forget to register to vote!
More: Justice Department | NCSC | NBC News | TechCrunch | @bing_chris

Millions of cars could be tracked thanks to a simple website bug
Wired ($): Back in the day it took months or years to figure out ways to hack into a car and take over its controls. Nowadays, thanks to the ubiquitous connectivity of practically every car on the road, it's as simple as scanning a car's license plate and... boom, that's it. At least with most Kia vehicles, or dozens of models that represent millions of cars on the road. That's because of a flaw in a Kia web portal that allowed a team of security researchers to essentially use the portal's unprotected API to interact with cars as if they had the keys in person. Tracking a car's location, unlocking the car, honking its horn, and starting its ignition at will. Just normal, normal stuff. Genuinely brilliant findings here. I wish, wish, wish car makers would stop connecting cars to the internet.
More: Sam Curry | @samwcyo
Neiko Rivera (left) and Sam Curry (right), who's holding a laptop running a custom app they made, in front of a Kia car that they're about to remotely hack.
~ ~

THE STUFF YOU MIGHT'VE MISSED
Newly released investigations toolkit helps open source research
Bellingcat: The folks at open source reporting outfit Bellingcat have a new online toolkit aimed at helping folks find the right investigative tool for the job you need. Much of the web's top investigative folks rely on open source intelligence (what's out there in the open already) and this new toolkit is a great place to start, from analyzing satellite imagery and maps, social media posts, transportation data, and archiving. Plus, most of the tools are free. More from @Bellingcat.

Eric Adams told the FBI he forgot his phone's passcode
404 Media ($): Have you ever been indicted so hard that you forgot your own phone's passcode? That's what seemed to happen to New York Mayor (still, at the time of writing, but I had to check) Eric Adams, whose multiple phones were seized by the FBI last November. It's unclear if the feds got access to his phones, because Adams reportedly changed his password from four digits to six and... subsequently "forgot" (heavy wink) the passcode. Uh-huh. Adams was charged with a litany of federal corruption charges this week. New York, where dreams are made and its officials are (allegedly) corrupt.

MoneyGram files data breach notice with U.K. authorities
TechCrunch: MoneyGram, the second largest money transfer service in the world (after Western Union, apparently), was hacked and its website and backend infrastructure nuked during a days-long outage. Its website was down, its app wasn't working, and its spokespeople couldn't respond because their email was down. (That said, MoneyGram's website and email came back and they still ignored us; quite rude!) But MoneyGram didn't ignore their U.K. legal obligations, filing a data breach notice within the mandated 72-hour window as required by U.K. law. That's to say, MoneyGram is saying it had a data breach, but details remain scarce. MoneyGram serves over 50 million people each year... so that could be a spicy one.
~ ~

OTHER NEWSY NUGGETS
"For FEC's sake! Hacked again": Well, hopefully not going forwards, because the FEC, the U.S. government body that oversees federal election finance laws, will now allow U.S. political campaigns to spend campaign funds on physical and cybersecurity purchases. That's a good move, especially since hacking (or at least targeting) political campaigns seems to be the norm these days. Staff and even family members can be a major weak link in the cyber-chain. (via Cyberscoop)

Tor + Tails = ❤️: The Tor Project is merging operations with Tails, the portable Linux-based operating system that's focused on preserving user privacy and anonymity. Tails will be incorporated "into the Tor Project’s structure," allowing Tails to focus more on the product itself while using Tor's resources for easier collaboration and better long-term sustainability. Big fan of the Tor Project, donate today! (via The Tor Project, TechCrunch)

Volt? Flax? OK, now, Salt Typhoon(?!): Looks like we have our third member of the China-backed "Typhoon" family of cyberattackers; Salt Typhoon is the latest disclosed hacking group working for China, allegedly geared towards collection of intelligence from hacked U.S. internet providers, per the WSJ ($) this week... and as somewhat previously reported by the Washington Post ($). That's as well as Volt Typhoon, which is laying the groundwork for disrupting U.S. military operations in the event of a conflict with China (over Taiwan, for example); and Flax Typhoon, a private company based in China that last week was caught by prosecutors operating a botnet on behalf of the Chinese government. Salt, Flax, and Volt Typhoon. Got it? (via Wall Street Journal ($))

The CUPS uproar that wasn't: A series of flaws in many Linux distributions became the talk of the town this week, but the hype (that wasn't) fell short of expectations. Plus, the bugs can be fixed with simple remediation. The bugs are in CUPS, which has to be manually enabled and requires some work to exploit. (via Cyberscoop)
~ ~
SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

THE HAPPY CORNER
I'm here again after a week away! Welcome back to the happy corner.

First up, it's time to let go of the mandatory password reset. That's right, the U.S. government's standards body is finally proposing to do away with its long-held view that passwords should be reset after 60 or 90 days. Or, as @dangoodin says, NIST is proposing to no longer recommend some of the "most nonsensical password rules." Huzzah!

Also in excellent news, Semiphemeral is back! (Well, almost). The app, which once allowed you to download and delete your entire Twitter stream until Elon Musk threw a world-class strop and cut off all API access, will soon be back with a brand new version capable of automatically removing your data from the former birdsite. Developer Micah Lee explains his reasoning and efforts behind the new app, and how Semiphemeral will allow you to rid your posts from the hellsite.
A screenshot showing the new version of Semiphemeral.
And finally, this week. A bonus cybercat meets caption contest. That's the U.K.'s prime minister, by the way, and his family's new kitty (where's Larry, you ask? He's still there!). But who needs the nuclear codes when you've got the spiciest kitten?
UK prime minister Kier Starmer sat at a table with some documents in front of him; on the table is his new white kitten, very very fluffy and slightly spicy, as if somewhat startled.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~

CYBER CATS & FRIENDS
This week's two-for-one cyber-cats special are Kirby (the beautiful void floof) and Kodo (the handsome gray kitty). I'm told that they can be seen here, taking a quick break from their ever vigilant surveillance efforts. Always monitoring for threats (and treats). Thanks so much to Andy T. for sending in!
Two cats, Kirby (black, on an office chair) and Kodo (gray) sat next to a computer keyboard.
Send in your cyber cats! (or a non-feline friend). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
That's it for this week; all the news that you need to know! It's good to be back after a week away, and as usual I'll be back next Sunday with your newsy roundup from the week. In the meantime, you can reach out at any time by email if you see anything fun for the newsletter. It's always great to hear from you (and your cyber-cats!)

All my best,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — september 16 edition

✇~this week in security~ Archive Feed
this week in security — september 16 edition
U.K. arrests teenager for TfL hack, SonicWall crash bug under attack, Avis data breach, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 35
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

U.K. arrests teenager for alleged Transport for London hack
National Crime Agency: Happy Sunday and welcome once again. This week we start with the absolute fustercluck left behind by the hack at Transport for London, the U.K. capital's public transit authority. While the Tube and buses remain untouched by the hack, TfL's corporate offices remain largely offline. It comes in the same week that TfL quietly conceded that customer data had in fact been compromised, days after enthusiastically claiming it had "no evidence" (well, of course you didn't at the time). Save a thought for the 30,000 TfL employees who have to be verified in-person before they can be allowed back onto the IT network. (I hope staff are being compensated for having to come into work and queue for hours.) U.K. cyber plods have made an arrest of a 17-year-old boy, but it's just that so far — no charges yet, so expect more news to drop soon.
More: TFL Employee Hub | BBC News | TechCrunch | The Register
A screenshot from TfLemployee.com, an employee hub for TfL employees. The screenshot reads: "On advice from specialists, we have deliberately reset every colleague’s OneLondon account. This means you will not be able to access your email account, Platform and other applications. What next: Given the severity of the situation and how important it is to protect ourselves and our customers, you will need to attend an in-person time slot to verify your identity and reset your password. Getting back online: Resetting 30,000 colleague passwords in person will take some time and we will be prioritising the allocation of time slots centrally."
Actively exploited bug can crash SonicWall firewalls
Cyberscoop: CISA has added three known-exploited bugs to its catalog, including a SonicWall vulnerability (tracked as CVE-2024-40766). The bug is especially gnarly because, if exploited, it can cause SonicWall firewalls to crash (we don't want that). SonicWall said the bug is under active attack and "exploited in the wild," but details on who, exactly, are scarce. Cyberscoop says ransomware gangs have targeted SonicWall appliances in the past (since they're edge devices, they can be compromised to access a victim's network), but no public word yet on recent attacks. Since CISA caught a whiff of the bug being exploited, it's now mandated all civilian federal agencies to patch ASAP, given the risk to the federal enterprise.
More: SonicWall | Rapid7 | SecurityWeek | @gregotto

In wake of Durov arrest, some cybercriminals ditch Telegram
404 Media ($): Telegram, the not-very-private messaging app, is hemorrhaging criminals, who just can't leave the platform fast enough following the arrest of Telegram CEO Pavel Durov in France a few weeks ago. Durov remains in France awaiting trial, but 404 Media ($) reports droves of criminals are moving their comms from Telegram to other platforms. That could make visibility into criminal activities trickier, since Telegram has been a hotbed of criminal activity (but also a trove of intelligence). I've seen some of this, too: One crime crew behind a one-time password stealing bot also moved away from Telegram in recent days, citing Durov's recent arrest. "Telegram can't be trusted anymore," they wrote. (Was it ever?) Meanwhile: KrebsonSecurity dives into The Com, the loose description of the online underworld where cybercriminals use violence and threats to get their means.
More: KrebsonSecurity | @zackwhittaker

Thousands of Avis car rental customers had personal data stolen in cyberattack
TechCrunch: Car rental giant Avis said it was hacked and more than 299,000 people had their personal information, credit card numbers, and driver's license numbers stolen in a recent data breach. Avis, which owns Budget and Zipcar, said little else about the incident, or why this data was stored in a way that allowed the data to be compromised. Texas had the most number of affected customers, a total of 34,592 people notified. Let's not forget that Avis made some $12 billion in revenue last year, and its CEO Joe​ Ferraro made over $10.2M in executive compensation — yet the company would not say who at Avis (if anyone!) oversees cybersecurity, and a spokesperson didn't respond to a request for comment. (Disclosure: I wrote this!)
More: Bleeping Computer | Maine Attorney General
~ ~

THE STUFF YOU MIGHT'VE MISSED
Stop blaming your employees for your company's data breach
@gabsmashh: Here's some good advice for the CISO crowd out there. If you don't want your employees loading their work laptops with unapproved software — or accidental malware — then don't let them. So many companies of late (including this week) have blamed their data breaches on their employees. Bzzzzzt! Nope. Don't fall for the con. If an employee was able to install malware that's capable of compromising the entire company, that's the company's fault (and financial responsibility to bear). Remember: any personal apps on your work laptop can often also be accessed by your company. It goes both ways!
Gabsmashh tweet: "but it lets me," quote tweeting Bones: "Haven't said this in awhile STOP INSTALLING UNAPPROVED SOFTWARE ON YOUR WORK COMPUTERS"
Bug lets anyone bypass WhatsApp's 'View Once' feature
TechCrunch: Turns out when you use WhatsApp to send a "View Once" message, which expires and deletes after the recipient views the image or video once (as the name suggests), anyone can grab and save the content for later — defeating the very point of the privacy feature. WhatsApp said it's planning to fix the issue soon. More by Tal Be'ery, who found the bug.

How $20 was used to hijack .mobi domains
watchTowr Labs: How can $20 end up hijacking any .mobi domain? By registering the since-expired domain name that once controlled the WHOIS server. Yes, the folks at watchTowr found the expired domain name and snapped it up as soon as possible, allowing the researchers to effectively take over the TLD and issue TLS/SSL certificates (which the researchers didn't do, but could have). Top quality meme game, aside, this was excellent research and shows that sometimes the smallest thing can snowball into a full takeover. More from Ars Technica.
A reused xkcd cartoon showing a very large, complicated software stack labeled "TLS/SSL" that is supported by a tiny pillar labeled "WHOIS," underneath which is a platform that says, "watchTowr buying a domain."
Microsoft's security summit was mostly talk, little action
Thurrott: Microsoft journalist Paul Thurrott dove into the security summit that Microsoft held this week with CrowdStrike and other vendors following CrowdStrike (and Microsoft's) dualling meltdowns, and found it was... mostly talk and little in terms of actionable takeaways. Press were reportedly not invited and the summit wasn't live streamed, but in a blog post Microsoft said a lot without really saying that much. Thurrott says, "it doesn’t seem that much will come out of it, as there are very few specifics for a way forward," and certainly no timelines, either.

Ex-CrowdStrike staff say 'quality control was not part of our process'
Semafor: Wild reporting here from ex-CrowdStrike employees, who spoke on the record as saying that quality control was "not part" of CrowdStrike's internal processes or conversations. Some two dozen former software engineers and managers "described a workplace where executives prioritized speed over quality," and warned of insufficient training and rising mistakes. CrowdStrike, of course, disputes this, per an unnamed spokesperson, who blamed much of the reporting on "disgruntled former employees." Hmm... and yet 14 of the people who spoke with Semafor left on their own accord. (Didn't we just go over blaming your employees for corporate problems?) Great reporting here.
Rachyl Jones tweet: "I spoke with more than 20 ex-employees who described a workplace where executives prioritized speed over quality, workers weren’t always sufficiently trained, and mistakes around coding and other tasks were rising. Read more at @semafor," followed by a screenshot from the story, which reads: "“Speed was the most important thing,” said Jeff Gardner, a senior user experience designer at CrowdStrike who said he was laid off in January 2023 after two years at the company. “Quality control was not really part of our process or our conversation.”
~ ~

OTHER NEWSY NUGGETS
Alarm sounded over iPhone 16 visual search: The newest batch of iPhones are expected out imminently, and feature a new feature called Visual Intelligence, which lets people take photos of things (or anything) and have Apple's new online search feature. It uses Google's search engine and allows for "third-party integrations," like ChatGPT. Sure, you can pull out your phone and find out what species a dog is, but clearly there could be risks present with third-party apps. Apple says (vaguely), "you’re always in control of when third-party tools are used," but crucially doesn't say how. Straight to @RachelTobac for threat modeling guidance. (via TechCrunch)
Rachel Tobac tweet: "We already see people uploading strangers to their social media to help them “figure out who this hot person is” and other privacy invading behaviors. We know folks already try to uncover people’s identity — let’s avoid making it seamless and 1-step."
Researchers map $900M in ransom payments: Incredible new research classifies some $700 million in unreported ransomware payments over 1,000 addresses (out of a dataset of $900M) that shows the average ransom payments increased steadily between 2019 and 2022. The average payout was about $900,000 — which is a huge amount and goes to show how big of the ransomware problem is. (via Arxiv, @mikko)

Gaze(ploit) into my eyes: Eye-tracking technology is great for accessibility, and it's increasingly found in mixed-reality headsets like Apple's Vision Pro. Now, computer scientists say they have found an attack that lets them decipher — for the most part! — what people enter on the device's virtual keyboard. That includes PINs and passwords with between 77%-92% accuracy. (via GAZEploit, Wired ($))
An animated GIF showing the attacker's view looking at eye-tracking movements and the attack result, which reproduces the sensitive inputs on the other screen.
Congress must act to reimburse SNAP skimming victims: Low-income families that rely on SNAP, a federal nutrition assistance program (previously known as food stamps), who are robbed of their grocery funds because of cybercrime or card skimming attacks, may no longer be reimbursed unless Congress acts by September 30. This federally funded and state administered program is a vital lifeline for more than 40 million people in America. SNAP card skimming is a major problem affecting some of the country's most in need. Congress, for once get your collective arses in gear, for crying out loud. (via NBC News)

Fortinet admits hacked: Security giant Fortinet had a "recent" (but doesn't say when) data breach, with data on some 0.3% of Fortinet customers stolen from a third-party cloud shared storage drive. A threat actor claimed on a cybercrime forum that they took 400+ gigabytes from Fortinet's SharePoint instance. Since Fortinet has "well over" half a million customers, 0.3% affected translates to at least 1,500 corporate customers. Fortinet declined to comment, but did not dispute the number of customers affected. Welp. (via Fortinet)

ChatGPT spits out bomb making instructions: Not a good look for OpenAI's ChatGPT, which after billions of investment continues to spit out instructions for making homemade explosives (and not for the first time). This latest "jailbreak" of the generative AI model involves tricking the hapless chatbot into thinking it's in a fictional sci-fi world where its guardrails don't apply. An explosives expert told @lorenzofb that the instructions were largely accurate and were "TMI" to be released. (via TechCrunch)
~ ~

THE HAPPY CORNER
At last, it's the happy corner. Leave your heavy baggage at the door.

First up, on expiring domain names and certificates... yes, this is the point!
Typing Loudly tweet: "Damn girl, are you an expiring SSL cert? Because I don't trust you after this date."
And for the folks whose kids are going back to school, this tweet is pretty spot on:
Casual Thursday tweet: "Hey parents! This year all school info will be sent via the MyStudent portal on SchoolNet. You’ll need an EduSphere login for the ParentFace app. There should be a link to create your account in your FartFolder. The crossing guard can reset your password if you answer his riddles."
And finally, this week, over a hundred people in the security community are rallying behind Connor Goodwolf (aka David Ross), a security researcher who disproved false claims by the Columbus, Ohio mayor that a recent ransomware attack on the city did not affect city residents. The full letter [PDF] is online (via @caseyjohnellis). The letter calls on the city to drop its lawsuit as it diverts attention from the "real threat," which "harms public safety efforts by reinforcing a chilling effect."
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~
HOW TO SUPPORT THIS NEWSLETTER
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

CYBER CATS & FRIENDS
Meet Eazy, this week's cyber-cat dog, whose human tells me can be seen here on his perennial perimeter patrol for threat actors. (Or, y'know, lizards.) Eazy is a very good boy. Many thanks to @jjdavis for sending in!
Eazy is a brown shorthair dog with a blue collar stood against a brick wall in the sunshine.
Keep sending in your cyber cats (or a non-feline friend!). You can email any time with a photo with their name, and they'll be featured in an upcoming newsletter!
~ ~

SUGGESTION BOX
Well, that was a busy one — thanks so much for reading! As a programming note, I will be away next week and therefore not newslettering, but I will be back the week following with a brand new freshly autumn edition of ~this week in security~ (which will be available as a freshly spring edition to folks below the equator.)

Terrible jokes aside, remember you can get in touch by email any time, and your cyber-cats (or friends) are always welcome!

Catch you in a fortnight,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — september 8 edition

✇~this week in security~ Archive Feed
this week in security — september 8 edition
US charges Russian GRU hackers over Ukraine hacks, London transit cyberattack, ransomware roundup, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 34
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

Five Russian GRU officers charged with targeting the Ukrainian government with destructive malware
Justice Department: Let's start this week in Maryland, of all places, where U.S. prosecutors returned charges against five Russian intelligence officers (*cough* hackers *cough*) working for the GRU, who are accused of launching destructive "wiper" malware against the Ukrainian government in the run-up to Russia's full-scale invasion in 2022. It follows an earlier indictment that included the involvement of a civilian in the scheme. The so-called "WhisperGate" malware attack looked like ransomware hitting the Ukrainian government's systems, but was deliberately unrecoverable. The attack launched around the same time as the Viasat hack, also designed to target Ukraine. The DOJ lifted the lid more on the GRU's hacking unit, aka Unit 29155, which Wired ($) digs deeper into the notorious special forces unit that is "now doing cyber things from behind a keyboard." Great...
More: U.K. NCSC | Reuters ($) | NYT ($) | Nextgov | Security Conversations
Seamus Hughes tweet: "hello russia indictments fall," quote-tweeting Charli XCX: "goodbye forever brat summer."
Spyware vendors thwart restrictions with new names and locations
Washington Post ($): The effort to curb the proliferation of commercial (think government-used) spyware appears to be failing, as spyware makers sanctioned by Western governments manage to skirt many of those restrictions on selling their surveillance products. That includes Predator (developed by Intellexa) and Pegasus (developed by NSO), both firms that have been effectively told they can't have dealings with the United States. The emergence of spyware exploits making their way into Russian government hacking campaigns also raised questions about, well, how that was possible, all the while Predator's infrastructure appears to be returning despite recent sanctions levied against its spyware maker, Intellexa. Clearly more has to be done, but the U.S. is limited and Europe hasn't done nearly enough on its side (per European Parliamentarian @sophieintveld).
More: Recorded Future | DFRLab | The Record | DarkReading | @josephmenn

Ransomware Roundup: Seattle Public Library, Microchip, and Halliburton
Geekwire: Let's start this roundup with the Seattle Public Library, whose 27 branches across the city have returned following a ransomware attack that has knocked the library offline since May. A public assessment of the cyberattack is forthcoming. Meanwhile... It looks like U.S.-based chip supplier Microchip is back on its proverbial feet after crims stole employee data during a ransomware attack disclosed in August, per SecurityWeek. And lastly... oil and fracking giant Halliburton remains mum on its "ongoing" cyberattack, but that Bleeping Computer has linked to RansomHub, the same hackers behind the Change Healthcare breach. Halliburton says some data was stolen, but details remain scarce. Remember, folks: Ransomware is an ecosystem, not a collection of threat groups, per threat intel wizard @sherrod_im.
More: TechCrunch | KIRO 7 Seattle
Sherrod DeGrippo tweet: "Ransomware isn't a collection of threat actor groups. It's an ecosystem. It's full of groups who do zero ransomware but enable it through tooling, infrastructure, code, brokerages, and more. Don't get tunnel vision on this."
~ ~

THE STUFF YOU MIGHT'VE MISSED
The U.S. isn’t ready for cyber chaos in the food and agriculture sector
The Record: The Dept. of Agriculture is meant to help prevent farmland disasters and meatpacking plant failures, but the department is "woefully unprepared" to play that role, per policymakers and other experts, and that leaves the agriculture and food sector — some 10% of U.S. jobs! — at risk of cyber threats. A ransomware attack in 2021 on JBS, a major meat producer, was a taste (inadvertent pun) of things to come.

London transit network avoids delays despite cyberattack
BBC News: The U.K. capital's transport network, including buses, trams and — of course, the world famous London Tube, is running largely alright despite a cyberattack targeting the local government organization's corporate offices. The "ongoing" incident has resulted in online outages for the most part, but The Guardian ($) reports that the incident is "not believed to be a ransomware attack, and no ransom demand had been made." Well, that sounds promising, but sounds like we really need to get that claim attributed to a named spokesperson before we can trust it completely.

Side-channel hack affects older YubiKeys, but no need to panic
Ars Technica: A very sophisticated (read: complicated and laborious) side-channel attack targeting the popular physical security keys, YubiKeys, allows for an in-person attacker to clone a YubiKey and extract the secret key from within. Clearly not great, but practically speaking, it's near-impossible to carry out an attack like this secretly or covertly. Everyone's favorite former CISO @jerry has some grounding words of clarity, but, tl;dr: unless you're a nuclear scientist or an actual spy, you probably don't have much to worry about, and using a YubiKey is still far, far better than not. Still, for those considering rotating their YubiKeys, @J0hnnyXm4s shows you how (🚨 terrible joke incoming 🚨):
Johnny Xmas tweet: "HOW TO ROTATE YOUR VULNERABLE YUBIKEYS (PLEASE LIKE AND SHARE)," followed by an animated GIF of Xmas unplugging a USB-C YubiKey, flipping it over, and plugging it back in again.
Gone in 60 seconds: The worst places to leave your secrets
Cybenari: I missed this research the first time around, but it's brilliant and worth re-sharing. In short, if you accidentally expose your private keys (or any other secret), bad actors can detect and steal those keys in as little as 60 seconds, which means you really, really need to get on top of (actually!) rotating those secrets as soon as possible. Which is all to say, have a detection and remediation plan in place.
A screenshot of the Cybenari report, showing faster access time with: npm at less than 60 seconds, Pypi at 119 seconds, GitHub at 127 seconds, and more.
Over one-third of CISOs report flat or falling budgets
The Register: Do you hear that? That's the sound of corporate executives declaring "cyber is over," and that the world is secure at last, clearly, because why else would these million-dollar bonus-making fatcats allow flat or declining budgets for cybersecurity? Have they looked around recently? No, there isn't a talent shortage — with layoff after layoff, despite record corporate profits — it's greedy executives who hoard their wealth, and face practically no repercussions when their companies get hacked. They destroyed the world, but at least they created incredible value for shareholders (and at the expense of everyone else).

Would you trust AI to scan your genitals for STIs?
The 19th: I don't know who needs to hear this, but you really, really shouldn't upload photos of your genitals to the internet, let alone to an AI model.
~ ~

OTHER NEWSY NUGGETS
White House wants to secure BGP: The Biden administration said this week it wants federal agencies to boost their internet routing security on their networks in the face of rising threats targeting an underlying internet protocol, called Border Gateway Protocol, or BGP. In short, whenever there's a major internet outage not caused by either DNS or a squirrel nibbling through a fiber cable, it's almost always caused by BGP. The fact that the federal government is taking it on sets a good example to the rest of the industry. (via White House, Reuters ($))

Credit cards stolen from Cisco swag store: Network security giant Cisco, whose CEO Chuck Robbins (if you recall) made $31.8 million during 2023 and who recently made the decision to cut several thousand staff from its headcount following an earlier layoff in February, isn't having a very good security week. That's because Cisco's online store for selling swag and other corporate-branded tat (quite frankly) was hacked to include hidden JavaScript code that scraped credit card numbers of customers at the online checkout. I wonder how many of the "limited number" of users had their credit cards stolen as a result? Guess we'll have to wait to find out... (via Bleeping Computer)

Hunting hidden police signals at the DNC: A project by Wired's @dmehro (+ bonus tweet thread) used open-source software developed by the Electronic Frontier Foundation that can detect cell-site simulators (used by police to locate devices nearby) to detect hidden police signals while fellow reporters walked around at the high security, locked-down Democratic National Convention. Really great journalism here. (via Wired ($))

Kaspersky offloads customers to Pango: Following the U.S. government's decision to effectively ban Kaspersky from selling its products to U.S. customers citing the Moscow-headquartered company's links to the Russian government, Kaspersky has offloaded its customer base to the Pango Group. Kaspersky was given until September 29 to offload its one million or so customers before its antivirus updates stopped, putting its customers at risk. (via Axios)

Confidant Health exposed therapy sessions: Thousands of people had highly sensitive health information, including audio and video of therapy sessions, exposed to the internet because virtual medical provider Confidant Health left an unsecured database on the internet — no password required — containing, in part, transcripts and other medical note of its patients, according to a security researcher. Confidant CEO Jon Read chided the "sensational nature" of the findings. Perhaps if Confidant didn't have such a colossal and negligent security lapse to begin with, none of this would've happened. You've nobody to blame but yourself there, Jon. (via Wired ($))
~ ~

THE HAPPY CORNER
And breathe... (paper bags upon request). This is the happy corner.

First up, this toot speaks for itself.
Cryptax toot: "Yesterday, as we were passing an italian highway toll, joke of my son "oh mom, can't you pay by command line?" ..."
Per @troyhunt, there's a cool project on GitHub that allows you to determine the percentage of ads that your device is blocking (or allowing through). This project is a good way to stress-test your ad-blocker — and you should absolutely use one, because they're good for both privacy and security.
A screenshot of the D3Ward adblocking test, showing 79% of the ads blocked on this page.
In other good news, the White House has launched a cybersecurity hiring sprint to try to fill some 500,000 job openings across the cybersecurity sector. (More from Cybersecurity Dive). A key thing here from National Cyber Director Harry Coker is that, "many Americans do not realize that a cyber career is available to them," and that there's a "perception" that you need a computer science degree and a deeply technical background to get a job in cyber. Nope! Per the top U.S. government cyber official: "The truth is, cyber jobs are available to anyone who wants to pursue them. Cyber professionals are part of a dynamic and diverse modern workforce and individuals from all backgrounds and disciplines have a place." Hell yeah, and diversity is absolutely key.

And finally, this week. A friendly reminder (via @Em0nM4stodon) that Inspirational Skeletor always has wise words to share. Speaking of...
Inspirational Skeletor toot: "Only caring about your own rights is exactly how you lose them."
And, a friendly reminder! If you are eligible to vote in the U.S. but haven't registered yet, take a few minutes to check at Vote.gov.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

CYBER CATS & FRIENDS
This week's cyber cat is Fluffy, who is fluffy by name, cyber-secure by nature. That's because Fluffy multi-factors all the things, so Fluffy can spend their time thinking about literally anything else... mice, treats, threat hunting... Many thanks to Mikael F. for sending in!
Fluffy is a shorthair tabby with beautiful eyes, sitting on a blue blanket.
Send in your cyber cats (or a non-feline friend!). Drop me a quick email any time with a photo with their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
And that's it for this bumper newsletter this week! Thanks so much for taking the time to read. See something cool, send it in! You can drop me an email any time with research, news stories and other fun things you see from around the web. Enjoy your week and we'll catch up next.

All my best,
@zackwhittaker
  •  
  • ↗️
↗️

this week in security — september 1 edition

✇~this week in security~ Archive Feed
this week in security — september 1 edition
China hacking U.S. ISPs, Russia reusing spyware exploits, Iran's Tickler malware, North Korea taps Chromium zero-day, and more.

~this week in security~

a cybersecurity newsletter by @zackwhittaker

volume 7, issue 33
View this email in your browser | RSS

~ ~

THIS WEEK, TL;DR

China linked to targeted attacks on ISP software
Black Lotus Labs: Security researchers at Lumen's Black Lotus Labs found evidence that Volt Typhoon, the China-backed hackers that have burrowed into tons of U.S. critical infrastructure in the event of a future conflict with China (think Taiwan), are also targeting U.S. internet providers — specifically software they run for managing network configurations. The Chinese hackers are targeting Versa Director, notably a bug that allows the planting of web shell code on the server, as part of efforts to target downstream would-be victims. The zero-day bug — which dates back to mid-June — is now fixed, but Versa blamed its customers for not patching sooner. Uh-huh, well that's certainly a choice. As you'd expect, the Post ($) story has a solid run-down of the situation.
More: CISA | Ars Technica | KrebsonSecurity | TechCrunch | The Record

Google says Russia reusing exploits made by spyware makers
Google TAG: Google's Threat Analysis Group, the security researchers focused on government-backed threats, said this week that cyber-spies working for Russia's foreign intelligence service (aka, APT29, or the FSB) were caught reusing iOS and Android-targeting exploits developed earlier by spyware makers Intellexa and NSO Group. The exploits were found buried in hidden code on Mongolian government websites and designed to steal credentials from what looks like Mongolian government employee email accounts — so, understandable that Google might think Mongolian civil servants were likely the target. How did the FSB get the exploits, you might be thinking? Google said it isn't sure, but didn't rule out the FSB buying the exploits once they are no longer zero-days (ie. since the exploits can still be useful for hacking unpatched devices). But Google said that this is what happens when spyware makers develop exploits that proliferate to "dangerous" threat actors like the Russian government.
More: Wired ($) | TechCrunch | Cyberscoop | @mattjay tweets
Chris Bing tweet: "Highly interesting finding by TAG that helps illustrate the issue of capability containment. One should not assume necessarily that NSO sold the tool to Russia. Historically, the company has said Russia is not a client. There could be multiple things at play here," and quote tweeting a Billy Leonard tweet, which reads: "New analysis from @Google TAG on suspected APT29 waterholes against 🇲🇳 gov. n-day exploits targeting iOS and Android we first observed in use from commercial surveillance vendors🫢 more details in the blog! awesome work from @_clem1 and team"
Iran caught using 'Tickler' malware to target governments and satellites
Microsoft: Iran, not content with trying to faff with the U.S. presidential election, is now trying to score a big win in space — targeting satellite communications. The Iran-backed hackers, known as APT33 (or Peach Sandstorm), are using password spraying attacks (which by all accounts seem to be pretty effective, going to show simple security protections can help!) and deploying malware that Microsoft calls Tickler — (why?!) — as a custom multi-stage backdoor. Wired ($) breaks down Microsoft's research in more detail, as does a Microsoft tweet thread. All in the same week that CISA confirmed another Iran-backed group, this one called Pioneer Kitten (again, these names??) that apparently moonlights with a ransomware gang, likely in support of Iran's goals but "not sanctioned" by the regime.
More: CISA | The Register | @snlyngaas

North Korean hackers exploited Chromium zero-day to steal crypto
TechCrunch: So, that's China, Russia, Iran... now let's wedge in North Korea to complete our quad of naughty hackers. Yes, North Korea has been found exploiting a Chromium zero-day (read: exploited before it was patched) to steal — yes, you guessed it — crypto, all so the country can build up its sanctioned nuclear weapons program. This is the tenth zero-day in Chrome this year, reports Bleeping Computer. Google patched the Chromium bug on August 21, two days after Microsoft first spotted the North Korean hackers exploiting the bug. Since it's a bug in Chromium, any browser that relies on it — Google Chrome through Microsoft Edge — were affected. Microsoft added that the group it calls Citrine Sleet (seriously, none of these names make sense!) deploys fake cryptocurrency trading sites that can plant a custom Windows kernel rootkit(!) on a targeted computer, which means it's absolutely game over for the victim's device data.
More: Microsoft | SecurityWeek
~ ~

THE STUFF YOU MIGHT'VE MISSED
Texas to spend millions on warrantless snoop tech
Texas Observer: Police in Texas will spend close to $5.3 million on a contract with a company called Cobwebs, which makes a tool called Tangles that can allow police and investigators to geofence over an area and track mobile movements without needing a warrant. The tool relies on data gathered from smartphones, such as location data, which is collected from apps and shared with others. Good thread by @FrancescaDnunz. There has never been a better time to yeet your phone into the nearest large body of water.
Francesca D'Annunzio tweet: "Device-tracking services rely on location pings and other personal data pulled from smartphones, usually via in-app advertisers. Surveillance tech companies then buy this information from data brokers and sell access to it as part of their products."
U.S. Marshals concedes data was stolen in earlier ransomware attack
The Record: Meanwhile, speaking of law enforcement, the U.S. Marshals said it was aware of a claim by a ransomware gang that it has close to 400 gigabytes of stolen data, but that the incident was not a "new or undisclosed incident." What it looks like is a ransomware attack from February 2023 has come back to bite the Marshals in the behind. The federal law enforcement agency has no idea how the Hunters ransomware gang got the stolen data — but doesn't change the fact that it did — and that it appears to contain sensitive law enforcement materials, including apparent details of electronic surveillance.

Google uncovers Iranian counter-intel operation, two years after reporter
Google Cloud: A new blog post by Google looks at an Iranian counter-intelligence operation involving dozens of fake recruiting sites aimed at trying to hook Iranian citizens into working for overseas governments. The operation dates back to at least 2017, and was initially discovered back in 2022 by former journalist @arawnsley (whose tweets on this are great). Excellent research and findings here.
Costin Raiu tweet: "So this turned out to be an IRGC domestic counterintelligence op, as detailed by Google's report today," quote tweeting Adam Rawnsley from 2022, which reads: "My latest: Someone has spent the past four years creating fake Mossad recruiting websites and buying Google Ads to target them at intelligence and military veterans from Iran, the Assad regime, and Hezbollah."
Bypassing airport security via SQL injection
Ian Carroll: Excellent research here by way of @iangcarroll and @samwcyo, who found a simple SQL injection bug in a TSA program called Known Crewmember, which, as you might guess, is a system at airport security for allowing pre-cleared pilots and cabin crew to skip security screening checks. TSA sought to fix the bugs, but did an absolutely awful job of trying to cover the fact that the agency had royally messed up. The full blog post is worth the read. Meanwhile, in other news: Seattle's hacked airport is still largely offline, even if planes are still landing and taking off. Here's what it's like to fly through the hacked airport.

City of Columbus sues man after he discloses severity of ransomware attack
Ars Technica: Prepare to get extremely cross. The mayor of the city of Columbus in Ohio said that data stolen in a recent ransomware attack targeting the city was "unusable" by the attackers. Turns out that was blatantly wrong, and a security researcher proved it by showing local reporters how easy it is to access the stolen files. (That's kinda the point of these ransomware and extortion tactics; these gangs publish the data so it's easier to extort the victims.) Instead of accepting that the city has a bigger problem than it clearly realizes, the city took the researcher to court and secured a restraining order. So, to be clear, the mayor's response is to blame other people rather than handle its scandal. Good luck finding help going forwards. Clearly the city of Columbus in Ohio is hostile to security researchers.
Lesley Carhart toot: "Columbus Mayor's office" followed by a screenshot from Fallout, which says in large green text on screen: "Everyone disliked that."
~ ~

OTHER NEWSY NUGGETS
North Korean spies hate this one weird trick: Here's a novel... if not somewhat unorthodox technique for trying to weed out suspected North Korean spies trying to earn a place at your company so they can steal your secrets. (It's a real problem!) When asked by one recruiter to send their resume, Twitter, Github, and a short note saying, "I hate Kim Jong Un, f**k North Korea," the applicant immediately vanished. Extraordinary problems require extraordinary solutions. But maybe check with your folks in HR, first... (via @PopPunkOnChain)
A screenshot from a X DM window that asks the recipient to send their resume, Twitter and Github, as well as saying, "Furthermore, please say 'I hate Kim Jong Un, Fuck North Korea."
Telegram boss' phone hacked: Pavel Durov, the CEO of Telegram bailed by French prosecutors who was told he can't leave the country amid a raft of criminal charges against him, had his phone hacked in 2017 by a joint French and UAE operation. According to the WSJ, French authorities were "acutely concerned about Islamic State’s use of Telegram to recruit operatives and plan attacks." Durov is a high-profile target: perhaps it's worth wondering how many other tech executives have had their phones hacked? Remember Jeff Bezos? (via Wall Street Journal ($))

Mirai's back, baby: Not that it ever really went away, the Mirai botnet — which was open-sourced so anyone can cause chaos with the power of enough hacked devices — is now drawing power from an unpatchable zero-day vulnerability in the AVM1203 widely used surveillance camera made by Taiwan-based firm AVTECH, which has no plans to fix. By exploiting the bug, known as CVE-2024-7029 — per Akamai — the Mirai botnet can break in and harness the many, many hacked devices' bandwidth to collectively pummel targets with floods of junk internet traffic. (via Ars Technica)
~ ~

THE HAPPY CORNER
It's the happy corner. Rejoice!

Remember the One Million Checkboxes website? As the name suggests, it was a collection of one million checkboxes that went viral overnight. Check a box, and it's checked for everyone. Uncheck a box, and it's unchecked for everyone. But, for a brief moment a few days in the site's infancy, its owner thought the site had been hacked. Well, it turns out a friendly Discord group figured out a way to hack it (in the nicest way) to stress-test the site with as much as it can handle. Turns out, quite a lot — and the friendly hackers were able to write messages, draw images, and animate a GIF. The full blog post is worth your time. Of all the creative people I've met in my time, hackers have to be way, way up there.
A screenshot of what appears to be a monochrome drawing of a Windows "blue screen of death," written in base64 on the One Million Checkboxes website.
Moving on. Error 502: very bad gateway.

Here's a blast from the past. The National Security Agency finally released (in response to a FOIA — thank you, MuckRock!) a 1982 lecture by Admiral Grace Hopper, widely known as a pioneer in early computing. The full YouTube video is online, and it's amazing to see how much stands up today. Cyberscoop looks at the video and what Hopper predicted – and how far we've come.

Signal, the world's favorite end-to-end encrypted messaging app, recently turned ten. Incredible to think that Signal started out as the janky apps RedPhone and TextSecure — but have gone on to secure much of the world's communications. Wired ($)'s @agreenberg sat down with Signal president Meredith Whittaker to talk shop, surveillance, AI and more. It's also worth noting, Signal is free but it's not cheap to run, and it needs our help and support to keep protecting millions who rely on it. By the end of reading this interview, you'll feel the jolt of energy you need to take on the world.

And, on this final jaunty note, your weekend moment of clarity.
An animated GIF of a video, which shows three people singing "Are you depressed?" then, "or is it just..." then the three of them dancing behind the words "CAPITALISM" spelled out on screen as they dance off screen.
If you have good news you want to share, get in touch at: this@weekinsecurity.com.
~ ~
THANK YOU FOR READING
 
~this week in security~ is my free weekly cybersecurity newsletter supported entirely by donations from readers like you. As a working journalist, I don't run ads or accept sponsors for this newsletter. Donations help reduce the costs of sending this newsletter while keeping it free, weekly, and without tracking.

To support this newsletter, check out my Ko-fi to drop a one-time donation, or sign up from $10/monthly to get cool swag shipped worldwide.
~ ~

CYBER CATS & FRIENDS
Meet Murphy, this week's cybercat. That's the face of a cat whose canarytoken on an airgapped system just triggered. Thanks so much to Matt S. for sending in!
Murphy is a fluffy cyber cat with a little snaggle tooth, lying on their back with their belly all fuzzy.
Send in your cyber cats (or a non-feline friend!). Drop me a quick email any time with a photo with their name, and they'll be featured in an upcoming newsletter.
~ ~

SUGGESTION BOX
Thanks so much for reading this packed edition! For those in the United States, enjoy your Labor Day weekend. I'll be back next Sunday as usual with your roundup from the week. As always, please drop me an email any time with anything you think would be good for the newsletter. Weid, wonderful, cats, and good news galore.

Back next week,
@zackwhittaker
  •  
  • ↗️