The Top 15 Security Posts – Vetted & Curated
*Threats & Defense*
1. New attack on home routers sends users to spoofed sites that push malware (Ars Technica, Mar 25 2020)
Attack, which uses DNS hijacking, is the latest to capitalize on pandemic anxiety.
2. Windows code-execution zeroday is under active exploit, Microsoft warns (Ars Technica, Mar 23 2020)
There’s no patch available now. Here’s what to do until Microsoft issues one.
3. Micropatches block exploitation of Windows zero-days under attack (Help Net Security, Mar 27 2020)
While we wait for Microsoft to provide fixes for the two new Windows RCE zero-days that are being exploited in “limited targeted Windows 7 based attacks,” ACROS Security has released micropatches that can prevent remote attackers from exploiting the flaws.
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~13,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share on Twitter Facebook LinkedIn
*AI, IoT, & Mobile Security*
4. Saudis suspected of phone spying campaign in US (The Guardian, Mar 29 2020)
Whistleblower’s data suggests millions of tracking requests sent over four-month period
5. Zoom iOS App Sends Data to Facebook Even if You Don’t Have a Facebook Account (VICE, Mar 26 2020)
Zoom’s privacy policy isn’t explicit about the data transfer to Facebook at all.
6. Hackers accessed Telegram messaging accounts in Iran – researchers (Reuters, Mar 31 2020)
Iranian hackers have compromised more than a dozen accounts on the Telegram instant messaging service and identified the phone numbers of 15 million Iranian users, the largest known breach of the encrypted communications system, cyber researchers told Reuters.
*Cloud Security, DevOps, AppSec*
7. Zoom Removes Code That Sends Data to Facebook (VICE, Mar 30 2020)
The change comes after Motherboard found the Zoom iOS app was sending analytics information to Facebook when users opened the app.
8. How to Secure Online Coding Platforms (DevOps, Apr 01 2020)
The evolution of DevOps teams and a greater reliance on cloud-based computing has completely changed the coding process. Now, with Integrated Development Environments (IDEs), coding can be done entirely online. This is convenient, but are online IDEs secure? To answer this, we will focus on two popular cloud-based IDEs: AWS Cloud9 and Visual Studio Online.
9. New Marriott Data Breach Affects 5.2 Million Guests (Infosecurity Magazine, Mar 31 2020)
Hotel chain Marriott International suffers second data breach
*Identity Mgt & Web Fraud*
10. Privacy vs. Surveillance in the Age of COVID-19 (Schneier on Security, Mar 30 2020)
“I think the effects of COVID-19 will be more drastic than the effects of the terrorist attacks of 9/11: not only with respect to surveillance, but across many aspects of our society. And while many things that would never be acceptable during normal time are reasonable things to do right now, we need to makes sure we can ratchet them back once the current pandemic is over.”
11. The Zoom Privacy Backlash Is Only Getting Started (Wired, Apr 01 2020)
A class action lawsuit. Rampant zoombombing. And as of today, two new zero-day vulnerabilities.
12. Privacy in critical care after telehealth demands jump (SC Media, Mar 31 2020)
As coughs and body aches drive anxious Americans to telemed services in record numbers, relieving the burden on medical facilities stressed to breaking with COVID-19 cases, the subsequent relaxation of privacy requirements puts them at risk of PHI compromises, cyberattacks and privacy violations.
*CISO View*
13. Security and Privacy Implications of Zoom (Schneier on Security, Apr 03 2020)
In general, Zoom’s problems fall into three broad buckets: (1) bad privacy practices, (2) bad security practices, and (3) bad user configurations.
14. New federal guidelines could ban internet in voting machines (POLITICO, Mar 30 2020)
The new rules would represent a landmark development in voting technology oversight.
15. Coalition of nonprofits push to secure remote workforce (SC Media, Mar 31 2020)
While work from home (WFH) ostensibly protects workers safe from COVID-19, it has exposed them and their companies to a bevy of cybersecurity risks – now a coalition of 13 nonprofit organizations are offering if not a cure, then a treatment, through a Work From Home. Secure Your Business campaign.