Proprietary Software and Security Leftovers

posted by Roy Schestowitz on May 17, 2023

• Discord suffers data breach after third-party agent was compromised

  The popular messaging platform service Discord Inc. has suffered a data breach after a third-party agent was compromised. In a message to affected users first shared May 11 on Reddit,

• Re-Victimization from Police-Auctioned Cell Phones

  Countless smartphones seized in arrests and searches by police forces across the United States are being auctioned online without first having the data on them erased, a practice that can lead to crime victims being re-victimized, a new study found. In response, the largest online marketplace for items seized in U.S. law enforcement investigations says it now ensures that all phones sold through its platform will be data-wiped prior to auction.

• Wikipedia Grapples With Chatbots: Should It Allow Their Use For Articles? Should It Allow Them To Train On Wikipedia?

  We know Kevin McAleer best for his robots, but a big birthday in his family inspired him to pivot to greetings cards. He has created what we’re loosely billing as the world’s first Raspberry Pi Pico-powered birthday card. This interactive build guides the recipient to press buttons and play their personalised greeting.

• Malicious code in PDF Toolbox extension

  The PDF Toolbox extension for Google Chrome has more than 2 million users and an average rating of 4,2 in the Chrome Web Store. So I was rather surprised to discover obfuscated code in it that has apparently gone unnoticed for at least a year.

  The code has been made to look like a legitimate extension API wrapper, merely with some convoluted logic on top. It takes a closer look to recognize unexpected functionality here, and quite some more effort to understand what it is doing.

  This code allows serasearchtop[.]com website to inject arbitrary JavaScript code into all websites you visit. While it is impossible for me to tell what this is being used for, the most likely use is injecting ads. More nefarious uses are also possible however.

• Vulnerability in Telegram for macOS lets malware access user mic and camera — Meduza

  Telegram messenger has confirmed that a vulnerability has been detected in its macOS app available via the App Store. The desktop app that can be downloaded from the company’s website doesn’t have this problem, Telegram clarified in a tweet.

• Windows TCO

  • Ransomware-as-a-service groups rain money on their affiliates

    Researchers with cybersecurity firm Group-IB infiltrated the Qilin gang in March and this week analyzed its operations in a report that detailed its inner workings and the economic model that keeps it churning.

  • New York audit: School districts unprepared for cyber attacks

    The Education Department “has not taken the fundamental steps or improved the technical controls needed to secure its own critical systems,” the auditors said.

    Auditors also went to four school districts and scanned their systems for vulnerabilities. What they found was so concerning that the districts took immediate action, they said.

  • Russian man charged over ransomware attacks, including against D.C. police

    The 30-year-old Mikhail Matveev, who is based in Kaliningrad, Russia, is also charged with ransomware incidents affecting law enforcement in New Jersey, as well as several victims in the health care sector, according to newly unsealed indictments from the Justice Department. Along with the criminal charges, the Treasury announced sanctions barring Matveev from conducting financial transactions in the United States, and the State Department issued a $10 million reward for his arrest.

    The investigation into Matveev involved the FBI, IRS and local law enforcement in D.C. and New Jersey, as well as authorities from Japan, the U.K., France, Germany and the European Union.

  • Ransomware group claims 2.5 terabytes of stolen data less than a month after emerging online

    A new cybercrime outfit calling itself RA GROUP is just the latest to take advantage of leaked Babuk ransomware source code.

    The post Ransomware group claims 2.5 terabytes of stolen data less than a month after emerging online appeared first on CyberScoop.

  • 5.8M records stolen in ransomware attack on pharmacy company PharMerica

    Fortune 1000 company and pharmacy services provider PharMerica Corp. has been struck by a ransomware attack, with data from 5.8 million patients stolen and published online. The theft of data was first disclosed in a breach notice filed with the Office of the Maine Attorney General.

  • Russian Hacker “Wazawaka” Indicted for Ransomware

    A Russian man identified by KrebsOnSecurity in January 2022 as a prolific and vocal member of several top ransomware groups was the subject of two indictments unsealed by the Justice Department today. U.S. prosecutors say Mikhail Pavolovich Matveev, a.k.a. “Wazawaka” and “Boriselcin” worked with three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies.