Wyze... Ain't

Security camera startup Wyze leaked data on millions of customers.
Email addresses, wi-fi network IDs, and body metrics exposed.
Are you still seriously using this crap?


CNET's Data breach hall of shame for 2019
Great progress has been made - it's only up 33% overall.


US Coast Guard says Ryuk ramsomware took out a maritime facility. It was most likely phishing. 30 hours downtime.  We won't learn.


The year in security debacles




LINUX


Just in case it skipped your mind, ClamAV works well on Debian/Ubuntu, CLI or GUI.


Do as much research as possible before buying hardware to make sure it's linux-compatible.


Simulate linux commands without blowing anything up. Find out what it's going to do before you do it.

The Maze of Pensacola

The group behind the Maze ransomware that they stole from the city of Pensacola put out 2G of files to prove they were serious. In other words, the city has thus far refused to pay the ransom. And they don't have backups.


Multiple Chrome vulns exist in SQLite let hackers execute arbitrary code remotely.  Don't use Chrome.  Ok, don't use Chrome prior to 79.0.3945.79 (divided by pi, minus 13).


How orgs can defend against advanced persistent threats

1. disconnect everything from the internet
2. buy any antivirus company's advanced persistent threat module
3. don't worry about it - they're rare
4. the VP needs a new boat - maybe next year

Be careful of Christmas, Hanukkah, Kwaanza and New Years themed malware. The initial version comes via snail mail, with a phrase like Merry Christmas on it. DO NOT OPEN IT. Later versions come in the form of email, with similar phrases on the subject line. Don't open these either. The most virulent, nasty malware is marked by subject lines with emojis on them. Never open these. Jonathan McAfree, from McAfree Antivirus Division (MAD) explains that if you delete them immediately, the authors will get tired and not send anymore of them.

Zombie Cicso Vuln

It's back. An already-fixed Cisco vuln.
With 'how to check' demo.


Dropbox Zero Day gets short temp fix


Reverse engineering with Ghidra


NSA's backdoor key from Lotus Notes

Vivaldi Plays Beethoven

If your browser is having trouble getting in the front door, just tell the door you're not that browser. Vivaldi changed its user agent string so it can get through blocks.


Oops - Honda exposed 26k North American customers' data.
Are you ready? It was a misconfigured Elasticsearch cluster. Misconfigured as in Wide Open. This wasn't a big deal for Honda, because the exact problem occurred in July.

Honda: Yes, we seem to have a bit of a spill in the.. uh.. American market.
Customers: All of our personal info was open to the planet?
Honda: Yes, terribly sorry.
Customers: But you had the same thing happen earlier this year. Didn't you learn anything?
Honda: Yes, yes we did. We learned from our mistake, enough to repeat it again exactly.
[apologies to Peter Cook and Dudley Moore]


If you need a quick, industry-related laugh, and who doesn't, read this little ditty on Faceyspaces, lawmakers, location tracking, and 'certain security functions.' The sheer creativity, legalese, and attempts to appear innocently-stupid are breathtaking.



"Stupid design decisions made by engineers who had no idea how to create a secure system. And this, in a nutshell, is the problem with the Internet-of-Things."
Bruce Schneier speaks like he's in my head.



Wawa, the convenience store chain around the Philly area (not the guitar pedal), said all 850 stores were affected by PoS malware skimmers. It took from March to December to discover it. Notice was given on their webpage, because everybody goes to Wawa's web page.



Linux environment variable tips and tricks

Yes, We Stole it, Yes, We'll Sell it Back to You

Hackers stole data for 15 million people, sold it back to the lab that lost it.
Who says there's nothing new under the sun?


Gee, Mrs Lubner, we're awful sorry our Chrome update made your android data disappear. It's ok, though - the next upgrade will make it visible.


Over 1,000 US schools hit by ransomware in 2019.
Never thought I'd be saying it's worse than I thought....


With all the schools, businesses, and state governments not backing up and falling victim to ransomware, it's a great time to be in ITSec.


7 ways to remember linux commands


Faceyspaces' TOR site down for 2 weeks due to expired TLS cert.

Malware for the Moon?

The Air Force is seeking proposals for technologies "for operations far beyond geosynchronous Earth orbit, near the moon's orbit: payloads for providing space domain awareness from the lunar surface, lightweight sensors for space-based space domain awareness, and methodologies for orbit determination and catalog maintenance in cislunar space.

They don't usually leak this kind of information.
So if you have these skills, give them a call.
For those of us who can't understand more than 2 words of the above (me): ask someone to tell you what Space Force is up to.


A New Jersey hospital 'had to' pay a fee after they got hit with ransomware.
Because, you know, backups are soooo hard.



Chinese e-commerce site lightinthebox.com operated in the sharing spirit: it shared 1.3TB of data, including server logs, user data, and more.


Snatch and Zeppelin ransomware recap.



Plundervolt: stealing secrets by 'undervolting'


The city of New Orleans, Louisiana, got themselves some ransomware. The mayor declared a state of emergency. It appears to be the threat actors behind Ryuk. The city is still working to recover data from the attack.

Hmmm.....  the city's emergency preparedness campaign is managed by the Office of Homeland Security and Emergency Preparedness. From the way the article is worded, the city and Homeland Security don't think much of backups.


A WhatsApp bug could have let anyone crash WhatsApp of all group members.
I have one word for you: Signal.


The writers of Nginx were interrogated at gunpoint, in their homes, at 7am because a former employer claims it was developed while one of them worked there.


VISA warns that hackers are scraping card details from gas pumps.




LINUX


How to use the uniq command - a unique command.

Ring - Who's There?

A forum and associated livestream is behind a bunch of Ring camera hacks. These are the indoor cameras, not the doorbells. The cameras started 'talking' to people, making nasty comments, and demanding Bitcoin.

I'm having trouble typing (moreso) because of the laughter.


564 Siemens bugs that could allow hackers to pwn power plants.
Let's not speak only of these bugs... let's also speak of incredibly stupid to non-existent security designs.


If you think it's a good idea to replace your Ubuntu-provided VirtualBox installation with Oracle's, here's how. After the article, you might not want to.
In Ubuntu, you get whatever version is current when Ubuntu is released and you won't get an update til the next version. With Oracle, you'll get the regular updates, with the new features.



Google is now banning some linux browsers from their services.
Because they're 'not secure'.
What this means is that javascript is turned off, like the message I get when I try to access a Google site using Firefox, because I turn javascript off by default. Yay Google - help us some more!



7 ways to remember linux commands

Number 8: use all of them every day


Cigna uses AI to check if patients are taking their medications.
Gee, who has access to this data?
Another great push on the handcart to hell.