Merck settled with insurers over $700 million claim. Stuxnet planted by Dutch engineer. China claims to have cracked Airdrop privacy.  12th January 2024

Merck settles with insurers who denied $700 million NotPetya claim

This court battle was watched, with popcorn in (somewhat nervous) hands, by many folks in this industry. To refresh your memory: Merck's cyber security insurance provider denied $700 million in coverage because they deemed the NotPetya attack an "act of war", because it was most likely created by Russian nation-state hackers.

This was ruled to be invalid by the courts, and again when appealed. There was another appeal, but right before the case spun up again they reached an undisclosed settlement.

It's interesting to read that one of the main reasons given by the courts that the coverage still applied was that the fine print defining "act of war" was never changed, even though over the years it's become very clear that the role that nation-state actors play in the cybersecurity scene has. So when it's time for you to choose or renew your cybersecurity insurance, make sure to read that fine print.

Dutch engineer used water pump to get Stuxnet into Iranian nuclear facility

Speaking of nation-state actors, Stuxnet! This has been quite the story to see in my local Dutch newspaper. It seems that the engineer was recruited by the Dutch intelligence services without anyone else in the governement knowing about it. It's also unclear if the intelligence services really knew what they were recruiting him for. Also, he died two years later (not two weeks later, like the article says) in a motorbike accident. Plenty of news to raise eyebrows.

China claims it cracked Apple's AirDrop to find numbers and email addresses

A Chinese state-backed research institute claims to have discovered how to decrypt device logs for Apple's AirDrop feature, allowing the government to identify phone numbers or email addresses of those who shared content. The researchers say that this data is hashed in the iOS device logs, and that it can be retrieved using rainbow tables.

API landscape insights: Analysis of 6,000+ public APIs.

Dive by into key insights on security, design, performance, and reliability of public APIs revealed through Escape’s extensive scanning process. (Sponsored)

Authy desktop app will be discontinued in August

Heads up if you use Authy on desktop, you have until August to switch to the mobile apps, or another solution. Although the iOS app will also be available to M1/M2 Apple users, which I guess can run the app natively.

Bitwarden adds passkey support to log into web password vaults

Bitwarden has announced that all users can now log in to their web vaults using a passkey instead of the standard username and password pairs.

There are some interesting technical details in the article that I hadn't read before, namely that deriving an encryption key from passkeys to encrypt user data is not possible, because the third party would receive a different value for each authentication. But encrypting user data requires a single, static key that remains the same across different authentication sessions. That's why there is an extension to the standard, called the PRF WebAuthn extension, which allows you to create a fixed value key. TIL.

White House moves to ease education requirements for federal cyber contracting jobs

They're working to remove the requirement for four-year degrees for some federal cybersecurity contracting jobs, in order to see a more diverse cybersecurity workforce and more positions filled. Couldn't agree more. I've yet to see any correlation between degree and how well someone performs in this industry.

Explained: SMTP smuggling

Researchers have found flaws in the way SMTP servers handle messages, allowing them to send spoofed emails to and from targets even if security measures like SPF/DMARC/DKIM are in place. It takes advantage of inconsistencies in the way that proxy servers and firewalls handle SMTP traffic.

Implement passwordless logins into your app in seconds

Solid security shouldn't have to come at the expense of a great user experience. That's why Passage by 1Password is building a passwordless auth service that allows you to implement passkey logins in your app or website with just a few lines of code. (Sponsored)