November 8, 2020

this week in security — november 8 edition

|MC_PREVIEW_TEXT|

~this week in security~ a cybersecurity newsletter by @zackwhittaker (https://twitter.com/zackwhittaker)

volume 3, issue 43

View this email in your browser (|ARCHIVE|)

~ ~

** THIS WEEK, TL;DR

Polls close on Election Day with no apparent cyber interference (https://www.nbcnews.com/tech/security/polls-close-election-day-no-apparent-cyber-interference-n1246277) NBC News: The election is done and a presidential winner is clear. And the whole thing went down without any significant cyberattacks or interference, reports @kevincollier (https://twitter.com/kevincollier) . Gears quickly shifted to social media firms trying to halt the spread of misinformation that tried to cast doubt (https://www.cyberscoop.com/election-night-cybersecurity-cisa-results/) on the results. Looks like all that election preparedness and resilience training since 2016 paid off. More: Cyberscoop (https://www.cyberscoop.com/election-night-cybersecurity-cisa-results/) | Wired ($) (https://www.wired.com/story/joe-biden-wins-president-election-voter-fraud-myths/)

California’s Proposition 24 on consumer privacy passes (https://www.sfchronicle.com/politics/article/California-s-Proposition-24-which-would-expand-15699663.php) San Francisco Chronicle: Speaking of elections, California’s Prop 24 also passed, which would expand the state’s Consumer Protection Act (CCPA) to create a new state agency to enforce privacy rights. CCPA brought Europe’s GDPR-style rights to California residents. It’s far from perfect but better than what they had. Where Prop 24 got complicated was the pushback — not from tech companies, but privacy groups, who argued lower-income people could find it harder to exercise their privacy rights. @Gizmodo (https://gizmodo.com/heres-how-californias-prop-24-could-better-or-break-our-1845484701) explains what the law does (and doesn’t do). More: Gizmodo (https://gizmodo.com/heres-how-californias-prop-24-could-better-or-break-our-1845484701) | Vox (https://www.vox.com/2020/11/4/21534746/california-proposition-24-digital-privacy-results)

Justice Dept. says it’s seized $1 billion in bitcoin from Silk Road (https://www.vice.com/en/article/akdgz8/us-feds-seize-1-billion-in-bitcoin-from-wallet-linked-to-silk-road) Motherboard: After seven years, some $1 billion worth of bitcoin (as of this week) changed hands (https://www.vice.com/en/article/g5bbaj/someone-emptied-out-bitcoin-wallet-with-964000000-million) . Who was behind the apparent theft? Mystery over — it was the U.S. government, the Justice Dept. confirmed (https://www.justice.gov/usao-ndca/pr/united-states-files-civil-action-forfeit-cryptocurrency-valued-over-one-billion-us) . The bitcoin came from the Silk Road dark web marketplace, seized in 2013 and its founder, Ross Ulbricht, arrested and later jailed for two life sentences. The government said it seized the $1 billion in bitcoin this week after an unnamed hacker agreed to forfeit the wallet, after the hacker — identified only as Individual X — hacked into Silk Road before its shut down and stole the bitcoin. A wild story with a lot more to come, no doubt. More: Justice Dept. (https://www.justice.gov/usao-ndca/pr/united-states-files-civil-action-forfeit-cryptocurrency-valued-over-one-billion-us) | The Guardian (https://www.theguardian.com/technology/2020/nov/04/silk-road-bitcoins-worth-1bn-change-hands-after-seven-years) | TechCrunch (https://techcrunch.com/2020/11/05/justice-department-silk-road-billion-bitcoin/) FBI says hackers stole source code from U.S. government agencies and private companies (https://www.zdnet.com/article/fbi-hackers-stole-source-code-from-us-government-agencies-and-private-companies/) ZDNet: An FBI alert sent out last month but made public this week says hackers are abusing misconfigured SonarQube apps to access and steal source code belonging to the U.S. government and private businesses. SonarQube lets its users scan and check for security bugs before pushing source code to production. But these systems are frequently left unprotected and exposed or with default credentials. The FBI’s IC3 alert said the hacks date back to April. More: IC3 [PDF] (https://www.ic3.gov/Media/News/2020/201103-3.pdf) | @mayhemdayone (https://twitter.com/MayhemDayOne/status/996767433007550466)

Maze, a notorious ransomware group, says it’s shutting down (https://techcrunch.com/2020/11/02/maze-ransomware-group-shutting-down/) TechCrunch: The ransomware group known as Maze, which began the trend of stealing victim data before encrypting it, says it’s shutting down. But security experts aren’t so sure that they believe them, and are convinced the individuals involved in the group will likely reemerge under a different name. Maze hit major companies, including Cognizant, Canon, and Pitney Bowes. (Disclosure: I wrote this story.) More: Bleeping Computer (https://www.bleepingcomputer.com/news/security/maze-ransomware-shuts-down-operations-denies-creating-cartel/) ~ ~ SUPPORT THIS NEWSLETTER

Thank you to everyone who reads this newsletter! If you can spare $1/month (or more for perks! (https://www.patreon.com/posts/mugs-are-on-way-32666051) ), it helps to maintain its upkeep. You can contribute to the Patreon (https://www.patreon.com/thisweekinsecurity) or send a one-time donation via PayPal (http://paypal.me/thisweekinsecurity) or Venmo (https://mcusercontent.com/e1ad6038c994abec17dafb116/images/9686ed69-9c8a-4787-9b13-758569be85e4.png) . ~ ~

** THE STUFF YOU MIGHT’VE MISSED

WhatsApp now lets you post ephemeral messages that disappear after a week (https://techcrunch.com/2020/11/05/whatsapp-now-lets-you-post-disappearing-messages-which-go-away-after-7-days/) TechCrunch: WhatsApp, which sends some 100 billion messages a day, will now let user messages (including photos and videos) expire after seven days. There’s little flexibility on that — it’s a set time unlike Signal, which allows disappearing messages under more granular periods of time. Users can turn on the feature for direct messages, but in groups it’s the admin that has to enable disappearing messages for it to work. Apple patches iOS against three zero-days under active attacks (https://arstechnica.com/information-technology/2020/11/apple-patches-ios-against-3-actively-exploited-0days-found-by-google/) Ars Technica: Google’s Project Zero has been busy this past couple of weeks. Following its latest disclosures, Apple fixed three zero-days found in iOS, affecting iPhone 6s and iPad Air 2s and later. The bugs could have allowed attackers to run malicious code, as well as steal data from an affected device. Worse, both Google and Apple confirmed that the bugs were under active attack. The attacks were unrelated (https://twitter.com/ShaneHuntley/status/1324431104187670529?s=20) to the election, but you should still update to iOS 14.2 as soon as possible.

Google patches third Chrome zero-day in two weeks (https://www.zdnet.com/article/google-patches-second-chrome-zero-day-in-two-weeks/) ZDNet: Google has patched its third zero-day vulnerability in Chrome in as many weeks. Google said little about the bugs, but said in a changelog that the bug was found in V8, the Chrome component that handles JavaScript, while the other only affected Chrome for Android users. Google’s Threat Analysis Group, which focused on government-backed hacking, was involved — which @dangoodin (https://arstechnica.com/information-technology/2020/11/google-fixes-two-more-chrome-zerodays-that-were-under-active-exploit/) said the flaws may be the work of a nation state. Don’t delay, update today! ~ ~

** OTHER NEWSY NUGGETS

Portland, Maine has voted to ban facial recognition (https://www.theverge.com/2020/11/4/21536892/portland-maine-facial-recognition-ban-passed-surveillance) In more election news, Maine’s largest city Portland has banned facial recognition. That means private citizens are entitled to a minimum of $1,000 in fines if they are subjected to facial scanning by police or another government agency. The private sector, however, can still use the technology. The measure passed after a city council vote, and Portland joins a ton of other cities across the U.S., including San Francisco, Boston, and the other Portland in Oregon.

Deloitte’s “Test your Hacker IQ” site basically hacks itself (https://www.theregister.com/2020/11/05/deloitte_hacker_test/) Well this is awkward. A website set up by global consultant Deloitte to quiz people on hacking tactics left a database configuration file exposed, allowing anyone to access the site’s backend database. Classic.

Capcom hacked in latest cyber-attack on game-makers (https://www.bbc.co.uk/news/technology-54840768) The Japanese video games giant behind resident Evil and Street Fighter has been hacked. Capcom confirmed “unauthorized access” but said there was no sign “at present” that data had been accessed or stolen. It comes just days after Watch Dogs: Legion, a game about hacking no less, was itself targeted (https://www.engadget.com/watch-dogs-legion-source-code-leak-151022835.html) by hackers, after ransomware group Egregor claims to have leaked the game’s source code. ~ ~

** THE HAPPY CORNER

CERT/CC, the vulnerability disclosure center at Carnegie Mellon University, has launched a bot (https://www.zdnet.com/article/certcc-launches-twitter-bot-to-give-security-bugs-random-names/) that assigns random bugs with neutral names. Some have turned their noses up at “branded” bugs, but having an assigned name can be helpful for remembering (https://insights.sei.cmu.edu/cert/2020/10/vulnonym-stop-the-naming-madness.html) what’s what. To be fair, you probably never would have heard of CVE-2020-4483 (https://nvd.nist.gov/vuln/detail/CVE-2020-4483) if CERT/CC didn’t call it Tidal Pitchfork (https://twitter.com/vulnonym/status/1324761256247627778) . (How metal is that?)

And — no matter who you voted for, I think we can all agree that the ballot counters, election officials, and the cyber-defenders in government did a pretty solid job this time around. It’s an enormous, largely thankless job — and credit where credit’s due. And @jkosseff (https://twitter.com/jkosseff/status/1325236389290651650) said as much in tweets this weekend. If you want to nominate some good news from the week, feel free to reach out (mailto:this@weekinsecurity.com?subject=Good%20news%20for%20your%20newsletter) . ~ ~

** THIS WEEK’S CYBER CAT

Meet Space, this week’s cybercat. Space is blind but her human tells me that she has a great memory. (She could be our hacker historian!) Big thanks to @ignacykas (https://twitter.com/ignacykas) for the submission! Keep sending in your cyber cats (mailto:this@weekinsecurity.com?subject=Cyber%20Cat%20submission&body=Please%20include%20a%20JPG%20of%20your%20cyber%20cat%2C%20their%20name%2C%20and%20also%20your%20name%20and%20Twitter%20handle%20if%20you%20want%20credit.) ! They will be featured in upcoming newsletters. ~ ~

** SUGGESTION BOX

That’s it for now. Thanks for reading! It’s been an intense week. I hope you stay safe and healthy. As always, please drop any feedback in the suggestion box (https://docs.google.com/forms/d/e/1FAIpQLSebkpf8z8TvMJoixuSzmrR-CTLcOv_ufF7voso1HZBI_f5zrw/viewform) . See you next Sunday.

============================================================ |IFNOT:ARCHIVE_PAGE| |LIST:DESCRIPTION|

Our mailing address is: |LIST_ADDRESS| |END:IF| You can update your preferences (|UPDATE_PROFILE|) or unsubscribe from this list (|UNSUB|) .