Security Leftovers

posted by Roy Schestowitz on Feb 06, 2023

• Finland’s Most-Wanted Hacker Nabbed in France

  Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding since October 2022, when he failed to show up in court and Finland issued an international warrant for his arrest.

• Italy warns [crackers] targeting known server vulnerability

  Thousands of computer servers have been targeted by a global ransomware hacking attack targeting VMware (VMW.N) ESXi servers, Italy's National Cybersecurity Agency (ACN) said on Sunday, warning organisations to take action to protect their systems.

• Ransomware [cracking] campaign targets Europe and North America, Italy warns

  The attack targets vulnerabilities in VMware ESXi technology that were previously discovered but that still leave many organizations vulnerable to intrusion by hackers.

• Italy warns [crackers] targeting known server vulnerability

  Italy’s national cybersecurity agency says thousands of computer systems worldwide exposed to ransomware attack

• Massive [cracker] attack, Italy also affected: "Dozens of national systems compromised"

  The attack targeted VMware ESXi servers. The vulnerability exploited by [crackers] has already been corrected in the past by the manufacturer but, [ACN] points out, "not all those who use the currently affected systems have solved it" and the targeted servers, if lacking the adequate corrections, "can open the doors to [crackers] busy exploiting it in these hours after the strong growth of attacks recorded over the weekend" .

• Weakening TLS protection, South Korean style

  This is achieved by means of a protocol called Transport Layer Security (TLS). It relies on a number of trusted Certification Authorities (CAs) to issue certificates to websites. These certificates allow websites to prove their identity.

  When investigating South Korea’s so-called security applications I noticed that all of them add their own certification authorities that browsers have to trust. This weakens the protection provided by TLS considerably, as misusing these CAs allows impersonating any website towards a large chunk of South Korean population. This puts among other things the same banking transactions at risk that these applications are supposed to protect.