This week in cybersecurity with the Code Curmudgeon February 28, 2020
Five interesting things that happened in cybersecurity this week: A report shows the cost of cloud misconfiguration, PayPal hacks are becoming scary, SlickWraps shows how not to manage a cybersecurity incident, information about the effectiveness of anonymized data, and some password advice from the FBI. All on this week in cybersecurity with the Code Curmudgeon.
Skip ahead:
Cloud misconfiguration 00:38 • This week in cybersecurity with the Code C...
Paypal 04:32 • This week in cybersecurity with the Code C...
SlickWraps 07:13 • This week in cybersecurity with the Code C...
Anonymized data 09:55 • This week in cybersecurity with the Code C...
FBI password advice 12:00 • This week in cybersecurity with the Code C...
References:
Cloud misconfigurations cost companies nearly $5 trillion
Report finds 196 data breaches exposed 33 billion records
https://www.techrepublic.com/article/...
full report: https://divvycloud.com/misconfigurati...
Ponemon report: https://databreachcalculator.mybluemi...
PayPal hacks – Auth, Login and Google Pay integration
If you’ve fished credentials, you can bypass authentication. Or you can buy credentials for $1.50 on the dark web and completely bypass the whole authentication process. Some researchers say they reported it, but PayPal was unresponsive Bug in the Google Pay integration doesn’t require CVC. Maybe it’s a vulnerability in the contactless payment, so an attacker “near your phone” can deduct money from your paypal account.
https://www.forbes.com/sites/zakdoffm...
https://www.zdnet.com/article/paypal-...
https://www.forbes.com/sites/zakdoffm...
SlickWraps data leak 850,000 users
Someone hacked them and took credentials for 850k user accounts and posted them on medium, Apparently the hacker had reported the vulnerability, and this was his way of being responsible. He or she.
and then someone else used them to spam the users with scary email. In theory you’re ok if you checked out using the “guest” option… according to them
https://nakedsecurity.sophos.com/2020...
https://www.androidcentral.com/slickw...
https://securityaffairs.co/wordpress/...
https://www.androidpolice.com/2020/02...
https://www.theverge.com/2020/2/25/21...
Anonymized data is less anonymous than we thought
we talked avast in a previous video, they were hacked and said “no big deal, the data was anonymized” but some students at Harvard have built a tool that sweeps through data from breaches and re-attaches it. Their paper hasn’t been published yet, we’ll cover it when it is. I’m not surprised.
https://www.vice.com/amp/en_ca/articl...
Avast free antivirus: https://www.pcmag.com/news/the-cost-o...
Previously mentioned by me: • This week in cybersecurity with the Code C...
FBI recommends passphrase instead of complex passwords
(it’s about time – longer, not crazier)
““Require everyone to use longer passwords or passphrases of 15 or more characters without requiring uppercase, lowercase, or special characters.”
https://securityaffairs.co/wordpress/...
See also
SQLi Hall-of-shame http://sqlihallofshame.com for SQL Injection
IoT Hall-of-shame http://iothallofshame.com
IoT Hall-of-shame Reddit / iothallofshame
My blog: http://codecurmudgeon.com
Twitter: @Codecurmudgeon / codecurmudgeon
Facebook: / codecurmudgeon
My photography channel: / @backsideofblue3163