What a wild week it’s been. There have been assaults on researchers (ok, just one that I know of), there’s a great look into changing company cultures, and RDP has a flaw.
All this and more, in this week’s action-packed edition of things I hearted this week.
Assaulting Researchers
The short version is that researchers found a significant vulnerability in a vendor’s Casino app, they reported it, and for their troubles, were assaulted by the COO.
Probably not the bounty any researcher wants in return for trying to do the right thing.
It reads out as a mixture between a good novel, and something you’d imagine playing out on Jerry Springer. There’s not enough popcorn for this.
Analyzing the 2019 RSA Innovation Sandbox Finalists
With RSA fast approaching, Kelly Shortridge dons her analyst hat and gets to work. This time examining the innovation sandbox finalists and their finding status.
- Analyzing the 2019 RSA Innovation Sandbox Finalists | Medium, Kelly Shortridge
Related, Kelly’s 2018 BlackHat USA 2018 business hall analysis
- Analyzing the Black Hat USA 2018 Business Hall | Medium, Kelly Shortridge
And while it’s a couple of years old now, I can’t talk about analysing RSA without Cyentia Institute’s brilliant analysis of 15,000 RSAC CFP submissions to uncover trends and evolution.
How Hackers and Scammers Break Into iCloud-Locked iPhones
In a novel melding of physical and cybercrime, hackers, thieves, and even independent repair companies are finding ways to “unlock iCloud” from iPhones.
Changing Cultures
These days in infosec, we hear a lot about culture change, in particular how it relates to security awareness and training.
But one has to sometimes look far and wide for examples of where a culture has been successfully changed that has benefited the people as much as the company.
This is a fantastic and insightful article into how Satya Nadella tackled the culture challenge within Microsoft.
How do you turn around the culture of a 130,000-person company? Ask Satya Nadella | Quartz
Accidental Personal Info Disclosure Hit Australians 260,000 Times Last Quarter
The latest quarterly report on Australia’s Notifiable Data Breaches (NDB) scheme has revealed around 269,621 separate cases of individuals having their personal information impacted as a result of a human error. The report [PDF] says that during the period covering October 1, through to December 31, 2018, 262 notifications of data breaches were received by the Office of the Australian Information Commissioner (OAIC), with 85 being put down to human error.
WhatsApp ‘Deleting 2m Accounts a Month’ to Stop Fake News
WhatsApp says it is deleting 2m accounts per month as part of an effort to blunt the use of the world’s most popular messaging app to spread fake news and misinformation. The Facebook-owned service published the data as part of a white paper on “stopping abuse” that was launched on Wednesday in India, the biggest market for the company with more than 200m users.
The Nightmare on Service Desk Street
Many “ITIL aligned” service desk tools have flawed incident management. The reason is that incidents are logged with a time association and some related fields to type in some gobbledygook. The expanded incident life cycle is not enforced and as a result trending and problem management is not possible.
- The nightmare on service desk street | Medium, Ronald Bartels
Remote Desktop Protocol Flaws Could Be Exploited to Attack RDP Clients
A research firm has disclosed multiple vulnerabilities in the Remote Desktop Protocol that, if left unpatched, could allow compromised or infected machines to attack the RDP clients that remotely connect to them.
In a blog post, Check Point Software Technologies researcher Eyal Itkin refers to this scenario as a reverse RDP attack because the RDP servers installed on the compromised machines essentially reverse the normal direction of RDP communication in order to control and execute code on the client device.
- Reserve RDP attack | Checkpoint
Google’s New Chrome Extension Warns You If Your Passwords Have Been Exposed
Google has rolled out two new tools to help the password-challenged beef up their security game. The first is a Chrome extension called Password Checkup that can identify if you’re using a password that’s been exposed in a third-party data breach. The second is a feature called Cross Account Protection, which helps protect apps you’ve signed into with your Google account.
Other Stories I Hearted This Week
- Apps you’ve never heard of that your teen is already using | CNN
- When Bad Behavior Goes Viral | Medium, James Rush
The post Things I Hearted This Week, 8th February 2019 appeared first on Cybersecurity Insiders.
February 08, 2019 at 09:09PM
0 comments:
Post a Comment