Security Leftovers

posted by Roy Schestowitz on Sep 14, 2023

• FBI Hacker Dropped Stolen Airbus Data on 9/11

  In December 2022, KrebsOnSecurity broke the news that a cybercriminal using the handle “USDoD” had infiltrated the FBI‘s vetted information sharing network InfraGard, and was selling the contact information for all 80,000 members. The FBI responded by reverifying InfraGard members and by seizing the cybercrime forum where the data was being sold. But on Sept. 11, 2023, USDoD resurfaced after a lengthy absence to leak sensitive employee data stolen from the aerospace giant Airbus, while promising to visit the same treatment on top U.S. defense contractors.

• UN Cybercrime Treaty Talks End Without Consensus on Scope And Deep Divides About Surveillance Powers

  “Imagine a scenario where a particular national residing in another country continues to use the influence of social media to spread propaganda and hateful messages and incite violence that leads to fatal clashes with security forces,” Sierra Leone said.

• Bolstering web application security

  Invicti Security’s Chief Technology Officer, Frank Catucci, emphasizes the need for a comprehensive understanding of potential attack scenarios, especially in dealing with legacy systems. Rigorous testing is essential to identifying vulnerabilities accurately as more applications move online and become exposed to threats.

• How Three Letters Brought Down UK Air Traffic Control

  The UK bank holiday weekend at the end of August is a national holiday in which it sometimes seems the entire country ups sticks and makes for somewhere with a beach. This year though, many of them couldn’t, because the country’s NATS air traffic system went down and stranded many to grumble in the heat of a crowded terminal. At the time it was blamed on faulty flight data, but news now emerges that the data which brought down an entire country’s air traffic control may have not been faulty at all.

• Windows TCO

  • Sri Lankan government loses months of data following ransomware attack

    The attack, which started at the end of August, affected nearly 5,000 email addresses using the gov.lk email domain. The victims include Sri Lanka’s council of ministers which forms the central government of the country.

  • Ransomware attack hits Sri Lanka government, causing data loss

    The attackers likely gained access to government systems using phishing schemes targeting civil servants, and took advantage of the use of outdated software. The government was using Microsoft Exchange 2013, for which its maker stopped support on April 11 this year.

  • New ‘3AM’ ransomware strain used in place of failed LockBit attack

    Detailed today by researchers from the Symantec Threat Hunting team, 3AM is written in the Rust programming language and is believed to be a completely new malware family. The ransomware attempts to stop multiple services on the infected computer before it begins encrypting files. Once encryption is complete, it attempts to delete Volume Shadow copies.