Breaches and leaks
- Doordash confirmed that they were breached, impacting 4.9 million customers and employees: link.
- Mattress company Verlo Mattress leaks data of 387.000 customers in an unsecured database: link.
- Payment card details stolen from eight US cities through the Click2Gov software: link.
- Lot's of Youtube creators falling victim to phishing, even with 2fa enabled: link.
- Cafepress have finally acknowledged that over 23 million emails and passwords were stolen from them: link.
Someone publicly shared a remote code execution exploit for the forum software vBulletin. It's being actively exploited, with over 10.000 servers found to be vulnerable.
There's a critical remote code execution vulnerability in Internet Explorer 9, 10 and 11, causing Microsoft to push this out of band patch. Make sure you have the latest updates on your Windows machines.
It's a result of Facebook's promise to investigate apps that have access to large amounts of user data. Not all of those apps were in production, and some just didn't respond to the audit request. Some companies are being sued by Facebook as a result of what they found.
DDoS attacks aren't unusual, unfortunately, but this article contained a bit of infosec jargon that I didn't know yet: "carpet-bombing DDoS", where amplified DDoS traffic is sent to random IP's in an ISP's network to circumvent regular DoS protection systems.
I don't know much about Office 365 but it looks like a great guide of sensible security measures, which might be worth diving into. You can find the pdf itself here.
Cloudflare showing once again why I like em so much. (No they aren't a sponsor, I wish).
The blogpost details a new "Bot fighter" feature, where they not only detect and block bots, but also try and "tarpit" it by challenging it with a CPU-intensive roadblock. And quite surprisingly, they'll then plant trees to compensate for the CO2 emissions of those extra CPU cycles.
Really good and detailed talk about the hack involving the NPM package eventstream of a few months back, which got hijacked to capture private keys from online Bitcoin wallets.
Long but great read on the NotPetya attack and its aftermath. It really brings home some of the real-world implications of a cyberattack of that scale, the massive costs, and the interconnectedness of our world. A single vulnerability in some Ukrainian accounting software affected world-wide shipping capabilities, supplies of medicine, and so much more, in a single day.