Nightfall InfoSec Roundup: January 6 to January 13
Cyber Attacks & Breaches
Google Agrees to Pay US$ 7.5M Over Google+ Data Breaches(CISO Mag) January 10th
In a recent data leak incident, which exposed the private data of around 500,000 former Google+ users to outside developers, Google has agreed to pay US$7.5 million in a settlement to resolve a class-action lawsuit against the firm.
A Facebook Bug Exposed Anonymous Admins of Pages(Wired) January 10th
A recent Facebook update caused a bug that allowed anyone to easily reveal which accounts posted to Facebook Pages—including celebrities and politicians—for several hours.
Dixons Carphone fined £500,000 for massive data breach (The Guardian) January 9th
UK company Dixons Carphone has been hit with the maximum possible fine by the Information Commissioner’s Office (ICO) after its shops were compromised by a cyberattack that affected at least 14 million people.
Unpatched Citrix Flaw Now Has PoC Exploit(Threatpost) January 13th
Proof-of-concept (PoC) exploit code has been released for an unpatched remote-code-execution vulnerability in the Citrix Application Delivery Controller (ADC) and Citrix Gateway products. Over 25,000 servers globally are vulnerable to the critical Citrix remote code execution vulnerability (CVE-2019-19781).
PayPal Confirms ‘High-Severity’ Password Security Vulnerability(Forbes) January 10th
PayPal has confirmed that researcher Alex Birsan found a high-severity security vulnerability that could expose user passwords to an attacker. Birsan discovered the high-severity vulnerability when he was “exploring” the main authentication flow at PayPal.
Threat Actor Abuses Mobile Sensor to Evade Detection(PhishLabs Blog) January 9th
In a recent campaign, PhishLabs discovered a new and unique evasion technique that abuses an experimental feature available in select web browsers, device motion and orientation events.
Mozilla patches Firefox zero-day as attackers exploit flaw(Computer World) January 9th
On Wednesday, Mozilla issued Firefox 72.0.1, which included one change: A patch for the vulnerability identified as CVE-2019-17026. “We are aware of targeted attacks in the wild abusing this flaw,” Mozilla said in the short description of the flaw.
TikTok Riddled With Security Flaws (Threatpost) January 8th
Researchers say they have discovered several major vulnerabilities in the short form video app TikTok. The reported vulnerabilities come as scrutiny around the Chinese-owned platform increases. The most serious vulnerability in the platform could allow attackers to remotely take control over parts of victims’ TikTok account, such as uploading or deleting videos and changing settings on videos to make “hidden” videos public. Researchers also discovered a separate vulnerability that allowed them to obtain personal data of victims, such as email addresses and more.
Risks & Warnings
Why The Threat Of An Iranian Cyberattack Should Matter To Your Organization(Mondaq) January 10th
The ongoing Iran-US tensions, and potential for retaliatory cyberattacks, call attention to the need for all organizations to consider whether they are prepared to defend against a cyberattack. Of all the tools Tehran has to retaliate, including its large military, Iranian-backed proxies around the Middle East and robust disinformation operations, international experts believe there is a strong likelihood that Iran will utilize its well-known cyber-warfare capabilities to inflict further damage over time.
Protecting manufacturing from cyber breaches(TechRadar) January 7th
Manufacturing has been revolutionized by the development of increasingly sophisticated and connected operational technology (OT). But as with any integration, there are always going to be teething problems. The crucial bump in the road towards Industry 4.0 is cybersecurity. OT systems have rarely been subject to the same upgrade and replacement cycles as their IT systems and connecting OT to the wider network brings with it all of the security risks to which IT has been beholden for decades.
Join us next week for the next edition of Nightfall’s newsletter by subscribing here!
The realistic portrayal of hacking in the TV show Mr. Robot has been praised by cybersecurity experts for illustrating the threats and challenges companies face daily. Read this summary of some of the biggest hacks from the show and the cloud security lessons they provide audiences.
Galileo Health, an innovative healthcare technology startup, relies on Nightfall to secure their Slack channels and GitHub repositories. Michael Supon, Galileo’s Head of Security and Compliance, credits Nightfall’s ease of use, automation, and accurate results with improving his team’s productivity and helping maintain HIPAA compliance across Galileo’s data infrastructure.
Data discovery can sometimes be an overlooked component of many organizations’ approach to securing data, but its importance cannot be understated. Read about how data discovery can help your security team and how to choose the best data discovery tool.
Aaron’s, Inc., an omnichannel provider of lease-purchase solutions, protects against data loss using Nightfall’s easy-to-use Slack DLP integration. Stuart Lane, Information Security Engineer at Aaron’s, credits Nightfall in automating their DLP activity and helping enforce their company code of conduct among their employees.