Nov 19, 2022
Malware…
Authorities Arrest Developer of Malware Service - Was Your Credit Card or Other Personal Information Stolen? And How He Was Captured
According to the U.S. Justice Department, FBI agents have identified more than 50 million unique credentials and forms of identification (email addresses, bank accounts, cryptocurrency addresses, credit card numbers, etc.) stolen.
Raccoon was essentially a Web-based control Crime-as-a-Service panel, where — for $200 a month — customers could get the latest version of the Raccoon Infostealer malware and interact with infected systems in real-time. Security experts say the passwords and other data stolen by Raccoon malware were often resold to groups engaged in deploying ransomware.
U.S. authorities zeroed in on a mistake that the Raccoon developer made early on in his posts to the crime forums, connecting a Gmail account for a cybercrime forum identity used by the Raccoon developer ("Photix") to an Apple iCloud account belonging to Sokolovsky.
Authorities soon tracked Sokolovsky's phone through Germany and eventually to The Netherlands, with his female companion helpfully documenting every step of the trip on her Instagram account.
Check If You Were Compromised:
++++++++
Former Uber Chief Found Guilty of Hiding Hack From Authorities.
https://www.nytimes.com/2022/10/05/technology/uber-security-chief-joe-sullivan-verdict.html
Joe Sullivan, the former Uber security chief, was found guilty by a jury in federal court on charges that he did not disclose a breach of customer and driver records to government regulators.
The case — believed to be the first time a company executive faced criminal prosecution over a hack — could change how security professionals handle data breaches.
Airbnb…
Throwing the spotlight on hidden cameras in Airbnb
https://www.welivesecurity.com/2022/11/01/spy-who-rented-to-me-hidden-cameras-airbnbs/
In recent years, some travelers have had their dream vacations ruined by one particularly creepy privacy risk – covert cameras in rental properties, which are often booked via platforms such as Airbnb. Ours is also a time when all sorts of surveillance gadgets are increasingly affordable; what's more, these gadgets are often tiny and/or designed to look like everyday objects – they are intended to be challenging to spot.
Airbnb's policy on the matter is pretty unequivocal. Security cameras and noise-monitoring devices are allowed "as long as they are clearly disclosed in the listing description and don't infringe on another person's privacy."
How to Find a Hidden Security Camera:
- Physically check the room: Look for cameras hiding in plain sight, perhaps in clocks, smoke detectors, speakers, or even light bulbs
- Use a flashlight: Camera lenses are made of glass, meaning they're reflective. So turn the lights down and shine a flashlight around the property.
- Check for night vision lights: Turning the lights down or off will also help you spot the tell-tale red or green LEDs, which may illuminate night vision cameras.
- Use an app: Researchers have been working on a mobile application that uses phones' Time-of-Flight (ToF) sensor to find spy cams hidden in everyday objects.
- Detect RF signals: A final tell-tale sign of a hidden camera is to monitor for radio frequencies (RF) that the camera may use to connect to a secret network. In addition, a hidden camera may interfere with your phone signal, so stop and investigate.
Baby Monitors…
Hacking baby monitors can be child's play: Here's how to stay safe
https://www.welivesecurity.com/2022/11/07/hacking-baby-monitors-childs-play-how-stay-safe/
We've probably all read horror stories online: a parent is woken in the middle of the night by strange noises coming from their child's bedroom. They open the door, only to find a stranger "talking" to their baby through the monitor. While rare, such cases do happen from time to time.
How to Stay Safer:
- Research your options well, and aim to go with a well-regarded manufacturer with a strong emphasis on security and good reviews.
- Install any updates to the device's software (or firmware)
- If possible, choose a model that does not allow remote communication via an app. If it does, turn off remote access, especially when not in use.
- I am setting up a solid and unique password and enabling two-factor authentication if possible.
- Review monitor logs regularly to check for any suspicious activity, such as individuals accessing it from a unique IP or at strange times.
- Secure your wireless router with a strong, unique password. Also, disable remote access to it and port forwarding or UPnP. Finally, make sure the router is kept updated with any firmware patches.
Apple…
Apple Tracks You Even With Its Own Privacy Protections on, Study Says
https://gizmodo.com/apple-iphone-analytics-tracking-even-when-off-app-store-1849757558
For all of Apple's talk about how private your iPhone is, the company vacuums up a lot of data about you. But, of course, iPhones have a privacy setting that is supposed to turn off that tracking. According to a new report by independent researchers, though, Apple collects highly detailed information on you with its apps even when you turn off tracking, an apparent direct contradiction of Apple's own description of how their privacy protection works.
Security researchers at the software company Mysk looked at the data collected by several Apple iPhone apps—the App Store, Apple Music, Apple TV, Books, and Stocks. They found the analytics control and other privacy settings had no noticeable effect on Apple's data collection—the tracking remained the same whether iPhone Analytics was switched on or off.
"The level of detail is shocking for a company like Apple," Mysk told Gizmodo.
++++++++
Apple clarifies security update policy: Only the latest OSes are fully patched.
Despite providing security updates for multiple versions of macOS and iOS at any given time, Apple says that only devices running the most recent major operating system versions should expect to be fully protected.
In other words, while Apple will provide security-related updates for older versions of its operating systems, only the most recent upgrades will receive updates for every security problem Apple knows about. For example, apple currently provides security updates to macOS 11 Big Sur and macOS 12 Monterey alongside the newly released macOS Ventura. In addition, in the past, it has released security updates for older iOS versions for devices that can't install the latest upgrades.
Most Macs still receive six or seven years of upgrades, plus another two years of security updates.