Security and Windows TCO
-
Krebs On Security ☛ Okta: Breach Affected All Customer Support Users
When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised that impact statement, saying the attackers also stole the name and email address for nearly all of its customer support users.
-
Windows TCO
-
Blackwing Intelligence ☛ A Touch of Pwn - Part I
Microsoft’s Offensive Research [sic] and Security [sic] Engineering (MORSE) asked us to evaluate the security of the top three fingerprint sensors embedded in laptops and used for Windows Hello fingerprint authentication. Our research revealed multiple vulnerabilities that our team successfully exploited, allowing us to completely bypass Windows Hello authentication on all three laptops.
-
India Times ☛ Japan space agency hit with cyberattack, rocket and satellite info not accessed
The space agency learned of the possibility of the unauthorised access after receiving information from an external organisation and conducting an internal investigation, the spokesperson said, declining to identify the organisation's name.
-
Blender ☛ Cyberattack – November 2023
Between 18 and 22 November 2023, the blender.org website was affected by a DDoS attack, executed by a botnet with hundreds of IP addresses sending over 1.5 billion malicious request, at a peak rate of 100 thousand rps (request per second). The website was intermittently available for a few days until going offline on November 21. The issue was resolved by moving behind a dedicated DDoS mitigation service, and the attack stopped at the end of the day. Besides the main blender.org website, a few other services were made unavailable – they are actively being restored.
Responsibility for the attack has not been claimed, and motives are unknown. The attack was focused on denial of service. Project and user data have not been affected.
-
[Old] TechCrunch ☛ A newly-wormable Windows botnet is ballooning in size
It appears to be working. Purple Fox infections have rocketed by 600% since May 2020, according to data from Guardicore’s own network of internet sensors. The actual number of infections is likely to be far higher, amounting to more than 90,000 infections in the past year.
-
Data Breaches ☛ Ransomware group ‘Black Basta’ has raked in more than $100 million -researchers
A cyber extortion gang suspected of being an offshoot of the notorious Russian Conti group of hackers has raked in more than $100 million since it emerged last year, researchers said in a report published on Wednesday.
-
[Repeat] Reuters ☛ Ransomware group 'Black Basta' has raked in more than $100 million -researchers
The Elliptic-Corvus report said it had also uncovered evidence tying Black Basta to the defunct Russian group "Conti."
-
The Register UK ☛ Uncle Sam probes cyberattack on Pennsylvania water system by suspected Iranian crew
The compromised Aliquippa system, a Unitronics Vision Series PLC, displayed a warning that the intruders would be targeting Israeli-made gear because of the ongoing Israel-Hamas war.
-
[Repeat] Data Breaches ☛ A cyberattack hit thousands of people in Louisiana. They’re still in the dark months later. (1)
(Update: the post was removed from the URL post-publication. We understand that it was posted prematurely and will be re-uploaded after the editing process is completed.)
-
NOLA ☛ A cyberattack hit thousands of people in Louisiana. They're still in the dark months later.
The school district told the public in August that its [breached] computer servers did not contain any sensitive information, but an analysis of the files that were published online following the attack tells a different story.
-
New York State ☛ DFS Announces $1 Million Cybersecurity Settlement With First American Title Insurance Company
The New York State Department of Financial Services (DFS) today announced that First American Title Insurance Company (First American) will pay a $1 million penalty to New York State for violations of DFS’s Cybersecurity Regulation (23 NYCRR Part 500) stemming from a large-scale cybersecurity breach in May 2019. The breach contributed to the exposure of consumers’ nonpublic information. In addition to penalties, the company has agreed to implement significant remedial measures to better secure consumer data.
-