On this week’s show Patrick and Adam discuss the week’s security news, including:
- Iowa app falls over, social and mainstream media chaos ensues
- Twitter acknowledges state-backed API abuse
- CDA 230 under review. Uh oh.
- Toll Group ransomware
- ICS-compatible ransomware spotted in wild
- UN got owned pretty hard
- Is Joshua Schulte The Shadow Brokers? A theory
- Much, much more.
This week’s show is brought to you by Okta.
Okta’s Simon Thorpe will be along this week to talk about a new trend they’re seeing and obviously encouraging – enterprises ditching Microsoft’s Active Directory. It’s a cloud, cloud, cloud, cloud, world these days. and in the year 2020, you might want to actually ask yourself – do you still need to be using AD?
Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
Show notes
- The Iowa Caucus Tech Meltdown Is a Warning | WIRED
- Democrats’ Iowa Caucus Voting App Stirs Security Concerns - WSJ
- Twitter says an attacker used its API to match usernames to phone numbers | ZDNet
- Google Guilty Of ‘Big Screw Up’ That May Have Leaked Your Videos To A Random Stranger
- Department of Justice to Hold Workshop on Section 230 of the Communications Decency Act | OPA | Department of Justice
- The EARN IT Act: How to Ban End-to-End Encryption Without Actually Banning It | Center for Internet and Society
- Encryption laws not used to fight terrorism - InnovationAus
- Toll Group confirms "targeted" ransomware attack - Security - iTnews
- Toll IT Systems Update | Toll Group
- (24) Bad Packets Report on Twitter: "@riskybusiness @rycrozier Their Citrix server, https://t.co/66XQWpiFyF, was vulnerable to CVE-2019-19781 on 2020-01-11T06:30:06Z." / Twitter
- (24) MalwareTech on Twitter: "A day prior to the Travelex hack, its parent company was worth $2.1 Billion. A month later it is now worth $764 Million. The CEO owns 63% of the shares, which puts his personal loss around $850 Million." / Twitter
- Dozens of companies have data dumped online by ransomware ring seeking leverage | Ars Technica
- Mysterious New Ransomware Targets Industrial Control Systems | WIRED
- The New Humanitarian | EXCLUSIVE: The hack the UN tried to keep under wraps
- UN didn't patch SharePoint, got mega-hacked, covered it up, kept most staff in the dark, finally forced to admit it • The Register
- Iranian hackers target US government workers in new campaign | ZDNet
- As Vault 7 trial begins, Joshua Schulte's attorneys will argue he's a whistleblower
- Trial of Accused 'Vault 7' Leaker Opens in New York
- Senior Adviser To The Operator Of The “Silk Road” Website Pleads Guilty In Manhattan Federal Court | USAO-SDNY | Department of Justice
- Three suspects arrested in Maltese bank cyber-heist | ZDNet
- Raytheon engineer arrested for taking US missile defense data to China | ZDNet
- DOD contractor suffers ransomware infection | ZDNet
- Hackers are hijacking smart building access systems to launch DDoS attacks | ZDNet
- Iowa Prosecutors Drop Charges Against Men Hired to Test Their Security — Krebs on Security
- FCC Confirms 'One or More' Carriers Broke the Law Selling Location Data - VICE
- Anti-virus firm Avast shuts down its data-selling subsidiary
- Department of Interior grounding drone fleet over cybersecurity concerns
- Google open-sources the firmware needed to build hardware security keys | ZDNet
- Apple wants to standardize the format of SMS OTPs (one-time passcodes) | ZDNet
- Why direct-memory attacks on laptops just won't go away
- Facebook settles facial recognition lawsuit for $550 million
- Remember FindFace? The Russian Facial Recognition Company Just Turned On A Massive, Multimillion-Dollar Moscow Surveillance System
- London to deploy live facial recognition to find wanted faces in a crowd | Ars Technica
- (15) DC3 VDP on Twitter: "Happy Friday hackers! Nitesh @ideaengine007 found a critical RCE vulnerability in Jenkins that led us to discover a Bitcoin mining service running on a DoD website 😲. Head over to the disclosed report to see all the details! Thanks for being 🔥 Nitesh https://t.co/YywrVZu2Uc" / Twitter
- (15) HD Moore on Twitter: "Flamingo is a new open source tool from @Atredis for capturing credentials sprayed by IT and security products: https://t.co/NDmCfA0qvA (h/t to @4lex for HTTP NTLM support!) https://t.co/V2jKi3Enpg" / Twitter
- Spotlight shone on Microsoft Azure vulnerability | The Daily Swig
- Magento fixes trio of critical security flaws | The Daily Swig
- Serious flaw that lurked in sudo for 9 years hands over root privileges | Ars Technica
- An Artist Used 99 Phones to Fake a Google Maps Traffic Jam | WIRED
- Google cuts Chrome 'patch gap' in half, from 33 to 15 days | ZDNet
- Researcher: Backdoor mechanism still active in devices using HiSilicon chips | ZDNet
