Voici le rapport de veille de la semaine faisant le tour des actualités les plus intéressantes. Certaines d’entre elles seront développées dans les prochains articles. Bonne lecture et Merci pour le café !
Vol / perte de données
Indian supply-chain giant Bizongo exposed 643GB of sensitive data
Bizongo, an online packaging marketplace has suffered a data leak in which the company left highly sensitive customer information unsecured and potentially exposed to hackers and other malicious individuals. The reason behind the incident is the company’s misconfigured AWS S3 data bucket.
Upstox suffers data breach of over 2.5 million users – Cybersecurity Insiders
Upstox, an Indian stock brokering company is trending on Google for a data breach that is reported to have impacted over 2.5 million of its users. News is out that the company has now upgraded its IT architecture on recommendation given by an internationally recognized Cybersecurity firm.
Facebook will not notify more than 530m users exposed in 2019 breach
Facebook has not notified the more-than 530m users whose details were exposed on a hacker forum in 2019 and has no plans to do so, according to company representatives. Business Insider reported last week that phone numbers and other details from Facebook user profiles were available in a public database.
A hacker claims to be selling sensitive data from OTP generating firm
A hacker appears to be selling sensitive data they claim to have stolen from an OTP-generating company. This particular company has some of the most popular tech and business giants on its list of customers including Google, Facebook, Amazon, Emirates, Apple, Microsoft, Signal, Telegram, and Twitter accounts, etc.
Clubhouse: des critiques suite à la diffusion en ligne d’enregistrements d’utilisateurs | WeLiveSecurity
L’annonce d’un nouveau vol de données d’utilisateurs s’ajoute aux récentes difficultés de populaires plateformes de médias sociaux. Il semble que les acteurs de la menace aient de plus en plus pour objectif d’extraire de vastes quantités de données utilisateur des plateformes de médias sociaux.
Cyberattaques / fraudes
Major BGP leak disrupts thousands of networks globally
A large BGP routing leak that occurred last night disrupted the connectivity for thousands of major networks and websites around the world. Although the BGP routing leak occurred in Vodafone’s autonomous network (AS55410) based in India, it has impacted U.S. companies, including Google, according to sources.
Ransomware attack causes supermarket cheese shortage in the Netherlands
Company hit with ransomware was unable to deliver food to supermarkets * Firm’s director says he suspects hackers exploited Microsoft Exchange Server flaw Shoppers at Dutch supermarkets may have noticed that some cheeses were in short supply last week, and it was cybercriminals who are to blame.
Le FBI autorisé à nettoyer à distance des serveurs Exchange compromis – Le Monde Informatique
Un tribunal américain a validé l’opération du FBI visant à nettoyer à distance des serveurs Exchange infectés par les dramatiques failles Proxylogon. Sans l’aval des organisations, l’agence s’est servie d’une commande pour supprimer le web shell compromis. Aux grands maux les grands remèdes.
FBI nuked web shells from hacked Exchange Servers without telling owners
A court-approved FBI operation was conducted to remove web shells from compromised US-based Microsoft Exchange servers without first notifying the servers’ owners. On March 2nd, Microsoft released a series of Microsoft Exchange security updates for vulnerabilities actively exploited by a hacking group known as HAFNIUM.
Le FBI a enregistré une explosion du phishing ces deux dernières années
Le phénomène est tout sauf nouveau mais il s’amplifie. Le hameçonnage, cette attaque informatique qui consiste à faire croire à une personne qu’elle échange avec un tiers de confiance afin de lui soutirer des données sensibles, est en pleine explosion.
6 out of 11 EU agencies running Solarwinds Orion software were hacked
European Commissioner for Budget and Administration Johannes Hahn confirmed the hack of some EU agencies as result of the SolarWinds supply chain attack in a response to a question filed by an EU Parliament member in February 2021. The EU official response is based on the results of an investigation conducted by the EU Computer Emergency Response Team (CERT-EU).
Les pirates du laboratoire Pierre Fabre diffusent des données internes
Gestion des cookies Nous utilisons des cookies sur notre site web pour vous offrir l’expérience la plus pertinente en mémorisant vos préférences et vos visites répétées. En cliquant sur « Accepter », vous consentez à l’utilisation de ces cookies.
Biden Races to Shore Up Power Grid Against Hacks
A 100-day race to boost cybersecurity will rely on incentives rather than regulation, the White House said. President Biden is putting the final details on a plan to encourage American electric utilities to strengthen their cybersecurity protections against hackers in the next 100 days, amid increasing cyberattacks.
Failles / vulnérabilités
NSA says it found new critical vulnerabilities in Microsoft Exchange Server – CyberScoop
The National Security Agency on Tuesday said it alerted Microsoft to a fresh batch of critical vulnerabilities that hackers could exploit to remotely compromise the Exchange Server email software program. Microsoft said that it hadn’t see any hacks using the vulnerabilities on its customers, but the news comes at a time of heightened concern over bugs in Exchange Server.
Plus d’un demi-million de terminaux Huawei piratés par un cheval de Troie
Les utilisateurs ont été infectés par un malware spécialisé dans les abonnements frauduleux, qui s’est répandu au travers de l’AppGallery, la boutique applicative du fournisseur chinois.
Des millions d’objets connectés sont exposés à de graves failles de sécurité
D’année en année, les objets connectés continuent de se démultiplier et de conquérir les consommateurs. Pour imager cette tendance, le marché des vêtements et accessoires connectés a par exemple connu une croissance de 70 % en 2020 par rapport à l’année 2019. Cependant, les dispositifs connectés sont aujourd’hui de plus en plus touchés par des problèmes de sécurité.
WhatsApp : une faille de sécurité permet à n’importe qui de bloquer définitivement votre compte
C’est une découverte effrayante qui a été faite par deux chercheurs en sécurité relayée par . Avec un simple numéro de téléphone, n’importe quelle personne malintentionnée peut bloquer définitivement un compte WhatsApp et ce, sans aucune connaissance particulière en matière de piratage ou de cybersécurité.
Justice / police / réglementation
Nigerian email scammer sent down for 40 months in the US, ordered to pay back $2.7m to victims
A Nigerian email scammer based in New York was on Tuesday sentenced to 40 months in prison, and ordered to pay back $2.7m in stolen money. Ifeanyi Eke, who also went by the name Luther Mulbah Doley, had pleaded guilty to one count of conspiracy to commit wire fraud, and will serve three years of supervised release following his stretch in the big house.
Man Arrested After Failed AWS Bomb Plot
A Wichita Falls man has been charged after allegedly planning to blow up an Amazon Web Services (AWS) datacenter in Virginia. Seth Aaron Pendley, 28, was arrested last Thursday after procuring what he thought was an explosive device from an undercover FBI officer in Fort Worth.
Lawsuit Filed After Facial Recognition Tech Leads to Wrongful Arrest
Detroit officials are being sued by a Michigan man who claims the city’s use of facial recognition technology led to his wrongful arrest. Attorneys representing Robert Julian-Borchak Williams filed a federal lawsuit on April 13 against the city, its police chief James Craig, and Detroit police detective Donald Bussa for « the grave harm caused by the misuse of, and reliance upon, facial recognition technology. »
Divers
1 Comment
Comments are closed.
Pingback: L’hebdo des cyber-menaces (18 avril 2021) – Ken Gilmour