Security Leftovers
-
Hacker Charged With Extorting Online Psychotherapy Service - Krebs on Security
-
Samsung Breach Slams Consumers
"Samsung recently discovered a cybersecurity incident that affected some of your information," the breach notification read. Samsung addressed the email to me and other customers involved in the breach.
On Sept. 2, Samsung notified specific U.S. customers that a late July breach affected some of their data inside U.S. systems. According to the breach notification, customers had differing combinations of their names, contact and demographic data, birthdays, and product registration information stolen. The breach only involved Samsung's servers, according to AppleInsider; Samsung consumer devices and in-app control interfaces remained untouched.
"We want to assure our customers that the issue did not impact Social Security numbers or credit or debit card numbers," the Samsung email continued. We know little about the late July breach, which Samsung confirmed internally by early August, though it didn't disclose it until September.
Litigants in a class action suit against Samsung Electronics of America asserted that the July breach, together with one in March, affected more than half of U.S. Samsung customers, according to Dark Reading.
That's a lot of people to leave in the dark. All my emails to the Samsung address generated automated responses about the breach, with no new information. We can surmise as much from what we don't know about the breach as what we know.
-
NSA on Supply Chain Security - Schneier on Security
The NSA (together with CISA) has published a long report on supply-chain security: “Securing the Software Supply Chain: Recommended Practices Guide for Suppliers.“:
-
Security updates for Friday [LWN.net]
Security updates have been issued by Debian (clickhouse, distro-info-data, and ntfs-3g), Fedora (firefox), Oracle (kernel), Slackware (mozilla), and SUSE (python-Flask-Security-Too).