Daily NCSC-FI news followup 2020-11-16

Verkkorikolliset yrittävät nyt kiristää varastetulla datalla tuplasti Yhä useampi raportoi, ettei tietoja ole palautettu lunnaiden maksun jälkeen

www.kauppalehti.fi/uutiset/verkkorikolliset-yrittavat-nyt-kiristaa-varastetulla-datalla-tuplasti-yha-useampi-raportoi-ettei-tietoja-ole-palautettu-lunnaiden-maksun-jalkeen/5d70090b-104d-4950-a751-0… Esimerkiksi Revil-kiristysohjelmaa käyttäneet hakkerit olivat lähestyneet uhreja uudelleen viikkoja sen jälkeen, kun lunnaat oli vastaanotettu. Kun uhri saa lunnaat maksettuaan salausavaimen, sitä ei voida häneltä ottaa pois. Varastettujen tietojen avulla rikolliset sen sijaan voivat palata toiseen maksuun milloin tahansa tulevaisuudessa.

Tanskan yleisradio: USA vakoili tanskalaisministeriöitä ja Ruotsin hävittäjäyhtiötä – urkinnassa hyödynnettiin ilmeisesti Tanskan omaa tiedustelua

yle.fi/uutiset/3-11649117?origin=rss DR perustaa tietonsa nimettömiin tiedustelulähteisiin, jotka ovat nähneet nimettömän tietovuotajan asiasta laatiman raportin. Tietovuotaja oli varoittanut mahdollisesta laittomasta toiminnasta ja siitä, että NSA käyttää hyväkseen tanskalaisia merikaapeleita tiedustelutiedon keräämiseen. Vakoilussa on DR:n tietojen mukaan käytetty apuna Xkeyscore-tietokonejärjestelmää, jonka avulla on seulottu kiinnostavaa dataa. Alun perin NSA:n Xkeyscoren avulla tekemä vakoilu nousi yleiseen tietoisuuteen tietovuotaja Edward Snowdenin ansiosta.

How the U.S. Military Buys Location Data from Ordinary Apps

www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x Through public records, interviews with developers, and technical analysis, Motherboard uncovered two separate, parallel data streams that the U.S. military uses, or has used, to obtain location data

Retail giant Cencosud hit by Egregor Ransomware attack, stores impacted

www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/ Cencosud is one of the largest retail companies in Latin America, with over 140, 000 employees and $15 billion in revenue for 2019. Cencosud manages a wide variety of stores in Argentina, Brazil, Chile, Colombia, and Peru. This weekend, Cencosud was hit with a ransomware attack that encrypted devices throughout their retail outlets and impacted the company’s operations.

Lazarus supplychain attack in South Korea

www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/ ESET telemetry data recently led our researchers to discover attempts to deploy Lazarus malware via a supply-chain attack in South Korea. In order to deliver its malware, the attackers used an unusual supply-chain mechanism, abusing legitimate South Korean security software and digital certificates stolen from two different companies. Also:

www.zdnet.com/article/lazarus-malware-strikes-south-korean-supply-chains/

Heartbleed, BlueKeep and other vulnerabilities that didn’t disappear just because we don’t talk about them anymore

isc.sans.edu/diary/rss/26798

You might be interested in …

Daily NCSC-FI news followup 2019-12-17

Visa Security Alert – CYBERCRIME GROUPS TARGETING FUEL DISPENSER MERCHANTS click.broadcasts.visa.com/xfm/?30761/0/0624013ddc6f39785bf56d504f3b812e/lonew In summer 2019, Visa Payment Fraud Disruption (PFD) identified three unique attacks targeting merchant point-of-sale (POS) systems that were likely carried out by sophisticated cybercrime groups. Two of the attacks targeted the POS systems of North American fuel dispenser merchants. PFD recently reported on […]

Read More

Daily NCSC-FI news followup 2020-01-10

Why is a 22GB database containing 56 million US folks’ personal details sitting on the open internet using a Chinese IP address? Seriously, why? www.theregister.co.uk/2020/01/09/checkpeoplecom_data_exposed/ The information silo appears to belong to Florida-based CheckPeople.com, which is a typical people-finder website: for a fee, you can enter someone’s name, and it will look up their current […]

Read More

Daily NCSC-FI news followup 2019-11-30

How is NordVPN unblocking Disney+? It might be through YOUR own computer. Even if youve never used Disney+ or NordVPN. medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 New Chrome Password Stealer Sends Stolen Data to a MongoDB Database www.bleepingcomputer.com/news/security/new-chrome-password-stealer-sends-stolen-data-to-a-mongodb-database/ A new trojan has been discovered that attempts to steal passwords stored in the Google Chrome browser. While this is nothing unique, […]

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.