A Review of the Best News of the Week on Cyber Threats & Defense
How Hackers Used Slack to Break into EA Games (VICE, Jun 14 2021)
A representative for the hackers explained to Motherboard how the group stole a wealth of data from the game publishing giant. “Once inside the chat, we messaged a IT Support members we explain to them we lost our phone at a party last night,” the representative said.
Vulnerabilities in Weapons Systems (Schneier on Security, Jun 08 2021)
““If you think any of these systems are going to work as expected in wartime, you’re fooling yourself.”
That was Bruce’s response at a conference hosted by US Transportation Command in 2017, after learning that their computerized logistical systems were mostly unclassified and on the Internet. That may be necessary to keep in touch with civilian companies like FedEx in peacetime or when fighting terrorists or insurgents. But in a new era facing off with China or Russia, it is dangerously complacent.”
G7 Turns Up the Heat on Putin Over Ransomware Attacks (Infosecurity Magazine, Jun 14 2021)
Leaders urge Russia to hold cyber-criminals to account
Filter Out the Noise
Since I started this curated security news in June 2017, I’ve clipped ~19,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
Intl. Law Enforcement Operation Disrupts Slilpp Marketplace (Dark Reading, Jun 10 2021)
A seizure warrant affidavit unsealed today states Slilpp had sold allegedly stolen login credentials since 2012.
Verizon DBIR 2021: Top takeaways for security pros (SC Media, Jun 11 2021)
Today’s columnist, Louis Evans of Arctic Wolf, says ransomware gets the headlines, but the Verizon DBIR study points out that security teams still need to lookout for business email compromises. A major BEC by the Russian group RedCurl last summer hit 14 companies in six countries, including construction companies, financial firms, retailers, insurance businesses, law firms, and travel.
Microsoft Patches 6 Zero-Days Under Active Attack (Dark Reading, Jun 08 2021)
The June 2021 Patch Tuesday fixes 50 vulnerabilities, six of which are under attack and three of which were publicly known at the time of disclosure.
Hackers can mess with HTTPS connections by sending data to your email server (Ars Technica, Jun 09 2021)
Cross-protocol attacks could potentially steal login cookies or execute malicious code.
Flaws in Rockwell Software Impact Products From Schneider Electric, GE and Others (SecurityWeek, Jun 10 2021)
Several vulnerabilities discovered by Kaspersky researchers in Rockwell Automation software impact industrial products from Schneider Electric, GE and other vendors.
How a conference room speakerphone might let attackers into your company network (Help Net Security, Jun 14 2021)
Several egregious vulnerabilities affecting the Stem Audio Table conference room speakerphone could be exploited by attackers to eavesdrop on what’s being discussed in its proximity, download malicious firmware, achieve and maintain network persistence, and more, GRIMM researchers have discovered.
Microsoft Disrupts Large-Scale BEC Campaign (SecurityWeek, Jun 14 2021)
Microsoft today announced it disrupted a large-scale business email compromise (BEC) campaign in which the attackers used forwarding rules to access messages related to financial transactions.