news
Security Leftovers
-
SANS ☛ Online Services Again Abused to Exfiltrate Data, (Tue, Apr 15th)
-
Security Week ☛ Insurance Firm Lemonade Says API Glitch Exposed Some Driver’s License Numbers
Lemonade says the incident is not material and that its operations were not compromised, nor was its customer data targeted.
-
Security Week ☛ Kidney Dialysis Services Provider DaVita Hit by Ransomware
DaVita has not named the ransomware group behind the incident or share details on the attacker’s ransom demands.
-
OpenSSF (Linux Foundation) ☛ What’s in the SOSS? Podcast #27 – S2E04 Enterprise to Open Source: Steve Fernandez’s Journey to the OpenSSF
-
Bryan Lunduke ☛ The Gov Defunded the CVE! And Then it Didn't! (It Gets Weirder.)
This story of how the Common Vulnerabilities & Exposures Database almost (supposedly) went offline is truly bizarre.
-
Security Week ☛ Apple Quashes Two Zero-Days With iOS, MacOS Patches
The vulnerabilities are described as code execution and mitigation bypass issues that affect Apple’s iOS, iPadOS and macOS platforms.
-
Hacker News ☛ New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks
Cybersecurity researchers have unearthed a new controller component associated with a known backdoor called BPFDoor as part of cyber attacks targeting telecommunications, finance, and retail sectors in South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024.
-
Windows TCO / Windows Bot Nets
-
The Register UK ☛ Ransomware crooks search for 'insurance' 'policy' right away
Ransomware operators jack up their ransom demands by a factor of 2.8x if they detect a victim has cyber-insurance, a study highlighted by the Netherlands government has confirmed.
For his PhD thesis [PDF], defended in January, Dutch cop Tom Meurs looked at 453 ransomware attacks between 2019 and 2021. He found one of the first actions intruders take is to search for documents with the keywords "insurance" and "policy." If the crooks find evidence that the target has a relevant policy, the ransom more than doubles on average.
-
Fortra LLC ☛ RansomHouse Ransomware: What You Need To Know | Fortra
Not quite. Many ransomware operations encrypt and steal your data, demanding a ransom for a decryption key and a promise not to sell or publish the exfiltrated data on the dark web.
RansomHouse, however, appears to often skip the step of encrypting victims' data entirely - preferring to just steal the data instead, making threats to release it if a cryptocurrency ransom is not paid.
-