Voici le rapport de veille de la semaine faisant le tour des actualités les plus intéressantes. Certaines d’entre elles seront développées dans les prochains articles. Bonne lecture et merci pour le café 😉
Vol / perte de données
Chinese Adult Site Leaking 14 Million User Details – and It’s Increasing!
Hjedd, an infamous Chinese adult content platform has been exposing a treasure trove of user data online since at least July 2022.
Twitter confirms zero-day used to access data of 5.4M accounts
At the end of July, a threat actor leaked data of 5.4 million Twitter accounts that were obtained by exploiting a now-fixed vulnerability in the popular social media platform.
Congress Warns of US Court Records Data Breach
Lawmakers on the Hill revealed last week that a cyber-attack on the US justice system had compromised a public document management system. Jerrold Nadler (D-NY), chairman of the House Judiciary Committee, revealed the discovery at a hearing on oversight in the Justice Department.
Greek intelligence spied on journalist with a surveillance spyware
The head of the Greek intelligence told a parliamentary committee that they had spied on a journalist with surveillance malware, Reuters reported citing two sources present. The revelation comes while media and journalists are making pressure on the government to reveal the use of surveillance software.
Cyberattaques / fraudes
EU missile maker MBDA confirms data theft extortion, denies breach
MBDA, one of the largest missile developers and manufacturers in Europe, has responded to rumors about a cyberattack on its infrastructure saying that claims of a breach of its systems are false. A statement from the company clarifies that it was the target of a criminal group who spread the false news of hacking its information systems in an attempt to blackmail the organization into paying a ransom.
BlackCat ransomware claims attack on European gas pipeline
The ALPHV ransomware gang, aka BlackCat, claimed responsibility for a cyberattack against Creos Luxembourg S.A. last week, a natural gas pipeline and electricity network operator in the central European country. Creos’ owner, Encevo, who operates as an energy supplier in five EU countries, announced on July 25 that they had suffered a cyberattack the previous weekend, between July 22 and 23.
Taiwan Hit By Multiple DDoS Attacks Following Arrival of Pelosi
Several government websites in Taiwan suffered intermittent outages due to multiple distributed denial of service (DDoS) attacks yesterday following the arrival of senior US lawmaker, Nancy Pelosi. The visit has angered Beijing, which claims Taiwan as its own. Pelosi reportedly met the Taiwanese President Tsai Ing-wen and reiterated Washington’s support for the democratic island nation, with a population of 24 million.
Ukrainian Law Enforcement Shut Down Large Russian Bot Farm
Law enforcement in Ukraine claim to have dismantled a large bot farm used by the Russian special services to spread disinformation and propaganda within the country. The Secret Service of Ukraine (SSU) said that an audience of over 400,000 Ukrainians were receiving misinformation from the million-strong bot farm.
North Korean Hackers Use Malicious Extensions on Chromium-based Web Browsers to Spy on User Accounts
Cybersecurity firm Volexity spotted new activity from a threat actor (TA) allegedly associated with North Korea and deploying malicious extensions on Chromium-based web browsers. The threat has been dubbed SharpTongue by security researchers, despite it being publicly referred to under the name Kimsuky.
Des hackers pouvaient accéder en douce à 140 000 terminaux de paiement
Des administrateurs d’un réseau de terminaux de paiements se sont fait voler leurs mots de passe. Et ils n’avaient pas activé de second facteur d’authentification. Oups. Ce n’est pas parce qu’on gère des dizaines de milliers de terminaux de paiement que l’on est forcément au taquet sur la sécurité informatique.
Victimes d’un piratage, près de 8.000 portefeuilles de la cryptomonnaie Solana ont été siphonnés
Des utilisateurs ont indiqué sur les réseaux sociaux avoir perdu l’intégralité de leur portefeuille crypto détenu en ligne sur la blockchain Solana. La société américaine a indiqué mener des investigations mais elle n’en est pas à sa première déconvenue technique.
Clestra dépose le bilan après une cyberattaque
En redressement judiciaire, la société de cloisons de bureaux a besoin de 10 millions d’euros pour se relancer. Terrassé par une cyberattaque, Clestra, le roi alsacien des cloisons de bureaux, est au bord de la faillite.
Failles / vulnérabilités
Post-quantum encryption contender is taken out by single-core PC and 1 hour
In the US government’s ongoing campaign to protect data in the age of quantum computers, a new and powerful attack that used a single traditional computer to completely break a fourth-round candidate highlights the risks involved in standardizing the next generation of encryption algorithms. Last month, the US Department of Commerce’s National Institute of Standards and Technology, or NIST, selected four post-quantum computing encryption algorithms to replace algorithms like RSA, Diffie-Hellman, and elliptic curve Diffie-Hellman, which are unable to withstand attacks from a quantum computer.
VMWare Urges Users to Patch Critical Authentication Bypass Bug
Vulnerability-for which a proof-of-concept is forthcoming-is one of a string of flaws the company fixed that could lead to an attack chain. VMware and experts alike are urging users to patch multiple products affected by a critical authentication bypass vulnerability that can allow an attacker to gain administrative access to a system as well as exploit other flaws.
Cryptocoin « token swapper » Nomad loses $200 million in coding blunder
Cryptocurrency protocol Nomad (not to be confused with Monad, which is what PowerShell was called when it first came out) describes itself as « an optimistic interoperability protocol that enables secure cross-chain communication, » and promises that it’s a « security-first cross-chain messaging protocol. »
Nomad (⤭⛓🏛) on Twitter: « Update: We are working around the clock to address the situation and have notified law enforcement and retained leading firms for blockchain intelligence and forensics. Our goal is to identify the accounts involved and to trace and recover the funds.1/2 / Twitter »
Update: We are working around the clock to address the situation and have notified law enforcement and retained leading firms for blockchain intelligence and forensics. Our goal is to identify the accounts involved and to trace and recover the funds.1/2
GitHub blighted by « researcher » who created thousands of malicious projects
Just over a year ago, we wrote about a « cybersecurity researcher » who posted almost 4000 pointlessly poisoned Python packages to the popular repository PyPI.
Un problème de cybersécurité retarde le vote sur la succession de Boris Johnson
L’envoi de bulletins de vote aux membres du Parti conservateur britannique qui choisiront le remplaçant du Premier ministre Boris Johnson a été retardé pour des raisons de cybersécurité, a rapporté le Telegraph mercredi. Selon le journal, le parti au pouvoir a agi sur les conseils du Centre national de cybersécurité (NCSC), sur fond d’inquiétudes quant au risque de piratage.
Slack resets passwords for about 0.5% of its users due to the exposure of the salted password hashes
Slack announced that it is resetting passwords for about 0.5% of its users after a bug exposed salted password hashes when creating or revoking shared invitation links for workspaces. This issue was reported by an independent security researcher and disclosed to Slack on 17 July 2022.
Justice / police / réglementation
Bientôt des backdoors dans les messageries ? Non, disent les CNIL européennes
Le projet de loi de la Commission européenne pour lutter contre la pédopornographie est vertement critiqué par les gendarmes européens de la protection des données personnelles. C’est un revers cinglant pour la Commission européenne. En mai dernier, celle-ci avait présenté un nouveau projet de loi pour lutter contre la pédopornographie.
Un youtubeur disparaît avec des millions d’euros en cryptomonnaies, le parquet ouvre une enquête
Alors que les législateurs français et européen tentent de réguler un marché jeune, le monde des cryptomonnaies laisse encore des opportunités pour les fraudeurs de s’épanouir. Dernière en date, l’ouverture par le parquet de Paris d’une enquête pour escroquerie visant un internaute soupçonné de s’être volatilisé avec les investissements en cryptomonnaies d’une centaine de particuliers.
Un ex-employé de Twitter jugé pour espionnage en faveur de l’Arabie saoudite
Un jury en Californie doit juger du sort d’un ancien employé de Twitter, accusé par la justice des Etats-Unis d’avoir extrait de la plate-forme des données personnelles au profit de l’Arabie saoudite, qui cherchait à connaître l’identité de critiques du régime.
Suisse
GovCERT.ch on Twitter: « La Confédération fait l’acquisition d’une plateforme destinée aux Bug Bounties. Sur mandat du NCSC, en collaboration avec @bugbounty_ch, des pirates éthiques passeront au crible les systèmes de l’administration fédérale à la recherche de vulnérabilités.https://t.co/lgONg0yf8k pic.twitter.com/8uXV0K1fXh / Twitter »
La Confédération fait l’acquisition d’une plateforme destinée aux Bug Bounties. Sur mandat du NCSC, en collaboration avec @bugbounty_ch, des pirates éthiques passeront au crible les systèmes de l’administration fédérale à la recherche de vulnérabilités.https://t.co/lgONg0yf8k pic.twitter.com/8uXV0K1fXh
Martin von Muralt et le « millefeuille de crises »
Retour au calme, avant les prochaines tempêtes. Au cinquième étage d’un bâtiment qui ne paie pas de mine à deux pas de la gare de Berne, le nouveau délégué du Réseau national de sécurité (RNS), Martin von Muralt, dévoile les futurs défis à surmonter: « Ce qui nous attend, c’est un chevauchement de crises, un millefeuille en quelque sorte », prévient-il.
Divers
Gaming Cyberattacks Increase by 167% in Last Year
Research by cybersecurity firm Akamai shows that Cyberattacks in the gaming sector have increased by 167% in the last year. The report, titled Gaming Respawned, found that the US is the main target for attackers, followed by Switzerland, India, Japan, and the UK, alongside other European and Asian countries.
Traffic Light Protocol for cybersecurity responders gets a revamp
The word « protocol » crops up all over the place in IT, usually describing the details of how to exchange data between requester and replier.
Hackers Return $9M to Nomad Bridge After $190M Exploit
Oliver Knight is a CoinDesk reporter based between London and Lisbon. He does not own any crypto. Hackers sent back $9 million to Nomad a day after the cross-chain bridge was exploited for $190.4 million. Blockchain security company PeckShield said the amount returned equates to around 4.75% of the total loss.
