October 25, 2020

this week in security — october 25 edition

|MC_PREVIEW_TEXT|

~this week in security~ a cybersecurity newsletter by @zackwhittaker (https://twitter.com/zackwhittaker)

volume 3, issue 41

View this email in your browser (|ARCHIVE|)

~ ~

** THIS WEEK, TL;DR

U.S. indicts Sandworm, Russia’s most destructive cyberwar unit (https://www.wired.com/story/us-indicts-sandworm-hackers-russia-cyberwar-unit/) Wired ($): The Justice Dept. announced this week charges against six alleged Russian intelligence officers for their role in a number of high-profile hacks, including the downing of the Ukrainian power grid during Christmas in 2016 and the release of the NotPetya worm in 2017. The group of hackers, known as Sandworm, was also accused of targeting the 2018 Winter Olympics and targeting organizations investigating the Novichok poisoning in the U.K. in 2018. FireEye’s @johnhultquist (https://twitter.com/JohnHultquist/status/1318242481058742272) called the group the “most aggressive actor” he’s encountered. Bellingcat researchers later found the hackers in plain sight (https://twitter.com/AricToler/status/1319300242706206720) . Now on the FBI’s most wanted list, the hackers remain in Russia. The indictments are expected to serve to “name and shame” not just the hackers themselves, but also their tactics and techniques. More: Justice Dept. (https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and) | Ars Technica (https://arstechnica.com/tech-policy/2020/10/six-russians-accused-of-the-worlds-most-destructive-hacks-indicted/) | @johnhultquist tweets (https://twitter.com/JohnHultquist/status/1318242481058742272) U.S. government concludes Iran was behind threatening emails sent to Democrats (https://www.washingtonpost.com/technology/2020/10/20/proud-boys-emails-florida/) Washington Post ($): The U.S. government also accused Iran this week of spoofing emails from a far-right group, the Proud Boys, to intimidate voters in the upcoming presidential election. In a bizarre and hurried press conference on Thursday, U.S. chief spy John Ratcliffe accused Iran of stealing voter registration records (which are largely public in the U.S.) with menacing emails that urged them to “vote for Trump, or else.” The video (https://www.vice.com/en/article/qjpdgd/threatening-voter-emails-included-highly-suspicious-hacking-video) included a video that claimed it was possible to cast fraudulent ballots — even if the scheme was unlikely to work. Iran denied involvement. More: Motherboard (https://www.vice.com/en/article/qjpdgd/threatening-voter-emails-included-highly-suspicious-hacking-video) | NBC News (https://www.nbcnews.com/tech/tech-news/fbi-says-iran-behind-threatening-emails-sent-florida-democrats-n1244228)

The unsinkable Maddie Stone, Google’s bug-hunting badass (https://www.wired.com/story/maddie-stone-project-zero-reverse-engineering/) Wired ($): A double-whammy from Wired this week. @lilyhnewman (https://twitter.com/lilyhnewman) dropped her profile of @maddiestone (https://twitter.com/maddiestone) just as this newsletter went to print. Stone, for those who don’t know (where have you been?) is one of Google’s security bug-hunting powerhouses and a member of its Project Zero team, which finds, reports and discloses some of the world’s most dangerous bugs. Not only as an incredible hacker, she’s breaking ground on the perceptions of who can be a hacker. This profile is well worth the read. More: @lilyhnewman (https://twitter.com/lilyhnewman/status/1320353842618372096)

Adblockers installed 300,000 times are malicious and should be removed now (https://arstechnica.com/information-technology/2020/10/popular-chromium-ad-blockers-caught-stealing-user-data-and-accessing-accounts/) Ars Technica: Two ad-blockers with more than 300,000 uses should be removed as soon as possible, as they were quietly scraping browsing data and tampering with users’ social media accounts. The extensions, Nano Adblocker and Nano Defender, were bought by new developers which added malicious code. Google removed the extensions from the Chrome Web Store. More: Nano Adblocker (Github) (https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210) | ZDNet (https://www.zdnet.com/article/google-removes-two-chrome-ad-blockers-caught-collecting-user-data/)

Moxie Marlinspike has a plan to take back our privacy (https://www.newyorker.com/magazine/2020/10/26/taking-back-our-privacy) New Yorker ($): A long read this week on the founder of Signal, Moxie Marlinspike. The profile focuses on the end-to-end encryption app’s founder who wants to bring “normality” back to the internet by bringing security and privacy to messaging and conversations. The story focuses on Signal’s claim to fame, it’s rise to prominence during the Trump administration (many of whom are also users) as the government continues to push back against “warrant-proof” encryption. More: @marciahofmann (https://twitter.com/marciahofmann/status/1318340729563799553) | @yaelwrites (https://twitter.com/yaelwrites/status/1319533690301472770)

Twitter hack investigation says hackers spoofed VPN page (https://www.dfs.ny.gov/Twitter_Report) New York Dept. of Financial Affairs: You might not think that New York State’s tax department would have anything enlightening to say about the Twitter hack back in July but, turns out it did a full investigation (because the hackers used the attack to spread a cryptocurrency scam, putting the incident in its purview). The hackers stole credentials and used a spoofed VPN page to trick an unsuspecting Twitter employee into entering their password — and two-factor notification. The hackers scraped the two-factor code and logged in as the employee. This is one of the most comprehensive insights into what actually went down on that July afternoon. More: @zackwhittaker (https://twitter.com/zackwhittaker/status/1318600687832485889) ~ ~ SUPPORT THIS NEWSLETTER

A huge thanks to everyone who reads this newsletter! If you can spare $1/month (or more for perks! (https://www.patreon.com/posts/mugs-are-on-way-32666051) ), it helps to maintain its upkeep. You can contribute to the Patreon (https://www.patreon.com/thisweekinsecurity) or send a one-time donation via PayPal (http://paypal.me/thisweekinsecurity) or Venmo (https://mcusercontent.com/e1ad6038c994abec17dafb116/images/9686ed69-9c8a-4787-9b13-758569be85e4.png) . ~ ~

** THE STUFF YOU MIGHT’VE MISSED

Face ID and Touch ID coming to the web (https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/) WebKit: Face ID and Touch ID, Apple’s biometric unlocking feature, is coming to the web. First announced at its WWDC conference in June, the fingerprint and face unlocking feature will allow users to login to websites without entering passwords. Researcher founds remote code execution bug in Discord Desktop (https://mksben.l0.cm/2020/10/discord-desktop-rce.html) Masato Kinugawa: @kinugawamasato (https://twitter.com/kinugawamasato) found a RCE in Discord Desktop, built on Electron, by chaining together several vulnerabilities. In this detailed writeup, Kinugawa said he received over $5,000 for the vulnerabilities. ~ ~

** OTHER NEWSY NUGGETS

NSS Labs shuttered due to COVID-19 (https://www.darkreading.com/vulnerabilities—threats/nss-labs-shuttered/d/d-id/1339220) Security testing firm NSS Labs has “ceased operations,” per a notice in its site, due to the ongoing coronavirus pandemic. The company was sold to a private equity firm last year for an undisclosed sum, and has reportedly been struggling since. Former employees told me (https://techcrunch.com/2020/10/20/nss-labs-ceases-operations-coronavirus/) that they had been laid off as a result of the company’s closure. @kjhiggins (https://twitter.com/kjhiggins/status/1318330734499762195?s=20) first broke the news.

Mysterious ‘Robin Hood’ hackers donating stolen money (https://www.bbc.com/news/technology-54591761) Here’s an interesting one. Why is a hacker group donating stolen money to charity? To say that the move is “strange and troubling” is an understatement — and it’s left several charities wondering if they should keep the money. The hackers allegedly target big profitable companies with ransomware attacks and share some of the proceeds of those ransom payments to charities.

The police can probably break into your phone (https://www.nytimes.com/2020/10/21/technology/iphone-encryption-police.html) At least 2,000 law enforcement agencies in the U.S. have access to phone-cracking equipment, allowing police into encrypted devices, reports The New York Times ($) (https://www.nytimes.com/2020/10/21/technology/iphone-encryption-police.html) , based on new findings from a Washington non-profit. These tools have “served as a kind of a safety valve for the encryption debate,” per @Riana_Crypto (https://twitter.com/Riana_Crypto) , yet police continue to demand more tools and access to encrypted devices. ~ ~

** THE HAPPY CORNER

And now for some good news.

Last week, @jaysonstreet (https://twitter.com/jaysonstreet/status/1317529072789049344) , @thestump3r (https://twitter.com/thestump3r) , @adam_915 (https://twitter.com/adam_915) and @grifter801 (https://twitter.com/grifter801) casually saved a bloke from a burning truck. Absolute heroes. A big congrats to @InfoSecHoudini (https://twitter.com/InfoSecHoudini/status/1318544511493165056) , who joins Dragos as its director of R&D. Great company — a frontrunner in ICS research.

And this BSOD face mask (https://twitter.com/jenmsft/status/1318292505285201920?s=21) is perfect and where can I get one? If you want to nominate some good news from the week, feel free to reach out (mailto:this@weekinsecurity.com?subject=Good%20news%20for%20your%20newsletter) . ~ ~

** THIS WEEK’S CYBER CAT

This week’s cyber cat is Mao, unwinding after a long day defending against hackers. We’re proud of you Mao. Thanks to Freek d.M. for the submission! Please keep sending in (mailto:this@weekinsecurity.com?subject=Cyber%20Cat%20submission&body=Please%20include%20a%20JPG%20of%20your%20cyber%20cat%2C%20their%20name%2C%20and%20also%20your%20name%20and%20Twitter%20handle%20if%20you%20want%20credit.) your cyber cats! They will always be featured. ~ ~

** SUGGESTION BOX

That’s it for this week. Back next Sunday as usual. If you have any feedback or comments, please drop it in the suggestion box (https://docs.google.com/forms/d/e/1FAIpQLSebkpf8z8TvMJoixuSzmrR-CTLcOv_ufF7voso1HZBI_f5zrw/viewform) . Thanks for reading and see you next week!

============================================================ |IFNOT:ARCHIVE_PAGE| |LIST:DESCRIPTION|

Our mailing address is: |LIST_ADDRESS| |END:IF| You can update your preferences (|UPDATE_PROFILE|) or unsubscribe from this list (|UNSUB|) .