FFT news digest — 18 August 2023
FFT news digest — 18 August 2023
Breached - part 2
Yet more data breaches at British police forces following last week’s calamitous incident at the police service of Northern Ireland which continues to have serious impacts . The Norfolk, Suffolk, and Cumbria constabularies all admitted they had inadvertently published sensitive information. In Norfolk and Suffolk, a freedom of information response included the personal information of 1,230 suspects, victims and witnesses. The constabularies (which are closely linked) said a technical issue led to the data being included. In Cumbria’s case, the names, salaries and allowances of its entire staff were published on the force’s website. It did not say how long the information had been there before someone spotted it and it was removed. The factor linking the incidents in Northern Ireland and in Norfolk and Suffolk is the (not so humble) spreadsheet. There’s a long and ignoble record of toe-curling incidents in which spreadsheets have been responsible for revealing what should have been confidential. In one case, A Boeing employee sent a spreadsheet to his wife for help with a “formatting issue.” Unfortunately, it included the details of all 36,000 of the aerospace giant’s workforce. As anyone who has used spreadsheets will know, it’s all too easy to overlook hidden cells and sheets; original copies containing sensitive information should never, ever be sent anywhere without exhaustive checks.
Threats
Chrome: Fake updates for Google’s web browser are being used to install a remote administration tool which enables fraudsters to access information on infected machines. Trellix LinkedIn: A concerted campaign is targeting the platform with reports of people being locked out of their accounts or having them taken over. The Microsoft subsidiary has yet to comment despite rising fury among affected users. Cyberint Abandoned: Abandoned websites are being used to host phishing pages. Analysis by Kaspersky identified 22,400 WordPress sites that had been compromised. C-Suite: A credential-stealing campaign has been targeting senior executives at more than 100 organisations around the world. It uses a kit called EvilProxy that’s designed to bypass multi-factor authentication. The initial step uses emails that impersonate trusted brands such as DocuSign and Concur. proofpoint Testers: The FBI is warning about a campaign that tries to lure victims into installing beta (or trial) apps purportedly to test them. The aim is to bypass Apple’s official App Store and the protections it affords. Doing so is a horribly bad idea (with a very few exceptions which would never involve a random invitation.) Bored: We do our best to make cybersecurity interesting but, let’s be realistic, people are bombarded with so many alerts and cautions that it’s hardly surprising they’re thoroughly tired of them. Cyjax examines the problem and rounds up some mitigations.
In brief
Cloudy : A comprehensive survey of cloud security found sensitive data exposed in more than 30% of assets. Meanwhile, cloud security is to be the subject of only the third investigation to be conducted by the US cybersecurity agency. A key reason for the inquiry is the calamitous breach of Microsoft email systems, including those used by US government agencies. Although details remain unclear, it is known that Microsoft managed to allow attackers to obtain a master cryptographic key that, together with a vulnerability, provided access to the company’s cloud email platform. The US has blamed China for the attack. ISPs : Internet service providers have an awful lot of power and in Belarus it appears to have been used to spy on foreign diplomats. ESET says attackers seem to have used a lawful intercept tool to redirect victims to a fake Windows Update website. Bluetooth : A reminder that to turn off Bluetooth on an iPhone, you have to use the Settings app rather than the quick-access Control Centre. This comes courtesy of the DefCon hacker conference where despite attendees thinking they’d disabled Bluetooth, their iPhones started showing prompts to connect to a fake Apple TV…and share their Apple ID with it. TechCrunch Airplane mode : Researchers have demonstrated a way to make an iPhone look like it’s in Airplane Mode when it’s not. It’s part of a theoretical - and highly convoluted - technique that could be used to spy on the user. Jamf