And here comes another Sunday Weekly… On Mondays!
Ghost Pro, a blogging platform, confirmed yesterday that CVE-2020-11651 and CVE-2020-11652 were used in an attempt to mine cryptocurrency in their servers. They reacted swiftly and corrected the issue. It is also good how transparent they have been communicating every step. Kudos to that!
But they were not alone. Saltstack vulnerabilities were also exploited to attack LineageOS, a free and open-source operating system for various devices, based on the Android mobile platform. We might see some more companies with the same issue. It is a bit ironic that Saltstack software is used, among other things, to perform automated, orchestrated, and audited patching and configuration across our Windows and Linux infrastructure. But again, a great action they came clear and communicated the incident.
Le Figaro, the oldest French newspaper, has suffered an enormous data leak, with more than 8 TB of data containing PII. A Security Research team found information. It is an exciting story worth reading it.
A new phishing campaign, targetting high-rank officers in Europe and the United States, has been detected recently. Named PerSwaysion, it uses Microsoft File Sharing services like Sway, Sharepoint, and OneNote, to spread. Remember taking a look at the post I wrote about phishing? Maybe it is worth re-reading it!
Mozilla has announced an interesting feature for Firefox: unique email aliases that can be used when filling in online forms. They will forward the emails received to your real mailbox. Still in beta, but something interesting to test.
Forbes has published an excellent investigation about how Xiaomi tracks private browsing and phone usage. Xiaomi states it does the tracking for telemetry, although it seems they get way much more information. In my opinion, this is not different from what Google or Apple do with Android and iOS, but the fact that it was not entirely written in the EULA might not have been the smartest move.
Do you remember all the discussions regarding Zoom meetings and its security? Well, as we all know, security bugs can hit anyone. This time it is Teams, from Microsoft. I read on BBC about CyberArk researchers discovering a problem that meant viewing a Gif could let hackers compromise an account and steal data. Of course, the bug is already patched, but it allows us to understand how complicated things are. A Gif can compromise a whole enterprise! Just amazing.
Stay safe!
2 thoughts on “Sunday Weekly 5”