{"id":8109,"date":"2021-02-24T21:06:00","date_gmt":"2021-02-24T20:06:00","guid":{"rendered":"https:\/\/kinit.sk\/weekly-overview-of-security-news1\/"},"modified":"2021-02-24T21:06:00","modified_gmt":"2021-02-24T20:06:00","slug":"weekly-overview-of-security-news1","status":"publish","type":"post","link":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/","title":{"rendered":"Security week 1"},"content":{"rendered":"
\n

Stay safe. We bring you our regular weekly overview of security news.<\/p>\n<\/div>\n\n

\n

Was the SolarWinds supply chain attack IT\u2019s Pearl Harbor?<\/h3>\n<\/div>\n\n
\n

The SolarWinds attack resulted in over 18,000 confirmed infiltrations of government and corporate networks. Data including user IDs, passwords, financial records and source codes were presumably leaked from many of these networks. A government agency in the USA (CISA) required all government institutions either to shut down their Orion systems or install a specific update that had been screened by the NSA, illustrating how serious the situation was. It was later discovered that, in addition to SunBurst, other malware programs were spreading through system vulnerabilities. One member of the senate intelligence committee noted <\/a>that the hack looked \u201cmuch much worse\u201d than he first feared. <\/p>\n<\/div>\n\n

\n

The list of compromised corporations<\/a> is long: Cisco, SAP, Intel, Deloitte, Nvidia, Fujitsu, Belkin, Amerisafe, Lukoil, Rakuten, Check Point, MediaTek (one of the world\u2019s largest semiconductor producers) and VMWare. <\/p>\n<\/div>\n\n

\n

The following American federal institutions <\/a>were also affected: National Institutes of Health, The Pentagon, Department of State, Department of Homeland Security, Department of Energy, Department of the Treasury, Department of Commerce, State and local governments, US nuclear weapons agency.<\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

Vancouver metro operator victim of ransomware attack<\/h3>\n<\/div>\n\n
\n

A Vancouver metro operator (TransLink) has been attacked by the ransomware Egregor. Although no customer data were leaked, employee details including wages and social insurance numbers were breached. Egregor\u2019s business plan is interesting\u2014the creators of the malware receive 30% of the paid ransom, while those who penetrate the victims\u2019 local network are awarded 70%. Attacks began in September 2020 and victims have included Ubisoft, Kmart, Cencosud and Crytek. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

Firm fined for attack on competitor<\/h3>\n<\/div>\n\n
\n

Ticketmaster has been fined $10 million for illegally accessing the network of their competitor CrowdSurge using the login details of a former employee. The goal of the attack was to eliminate or severely weaken their competition. The main perpetrators of the attack were fired and the company was forced to implement a compliance and ethics program to prevent employees from breaking the law again.<\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

FBI warns against noval abuse of vulnerabilities in smart homes<\/h3>\n<\/div>\n\n
\n

The FBI has warned consumers of a new trend in which poorly secured elements of smart homes (cameras, microphones, controllers) have been hacked. The attackers use the devices to report a serious crime at the address and then watch, or even livestream, as police arrive at the homes of unsuspecting people. In other, darker cases, devices are used to watch children in the house and even talk to them through speakers. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

Russian hacker convicted<\/h3>\n<\/div>\n\n
\n

A Russian hacker has been sentenced to 12 years in prison for his role in an international hacking campaign targeting several financial institutions and financial news publishers, including JPMorgan Chase and Dow Jones. He was expedited to the USA from Georgia. He was a key organizer of the largest data breach ever carried out at a single institution, with close to 80 million victims. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

Swift fall of extremist social network<\/h3>\n<\/div>\n\n
\n

The extremist social network Parler has recorded a precipitous decline, partly because Amazon removed the application from its web services platforms. The FBI is currently investigating whether the social network influenced supporters of Donald Trump in their recent attacks in Washington DC. To make things worse, hackers stole and subsequently published the personal details of many users. It is likely the social network had lamentably poor security. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

Source code leak and admin\/admin<\/h3>\n<\/div>\n\n
\n

Nissan North America failed to configure one of their Git servers correctly, resulting in leaked source codes of their mobile application and internal tools used by Nissan. They made a grave mistake by using default login details: admin\/admin. The consequences are being investigated, but Nissan are certain that no personal details were leaked. The article contains a list of applications with relevant download links. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

DDoSecrets – A less ethical WikiLeaks<\/h3>\n<\/div>\n\n
\n

The portal DDoSecrets aspires to be the heir of Wikileaks by publishing business secrets gained through ransomware campaigns. They defend their actions by claiming they bring transparency. WikiLeaks themselves, who also publish data gained through hacks, must bear at least some of the blame for this development. DDoSecrets also argue that the leaked data could be used to accelerate development in certain industrial segments. The case presents a huge ethical dilemma. Is the behavior of DDoSecrets morally defensible? Most experts answer in the negative, but a number of angles must be considered. The details uncovered by the attacks are usually only accessible for a short time, but DDoSecrets leaves them permanently visible, which raises the risk of damage. On the other hand, details published by the portal have been used to prove that a certain firm was engaging in unfair practices. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

DarkSide ransomware can now be decrypted without any ransom<\/h3>\n<\/div>\n\n
\n

Bitdefender have released a new tool that allows victims of DarkSide ransomware to restore their encrypted files without paying any ransom. DarkSide functions as a RaaS (ransomware as a service). Admittedly, several months have passed since the malware has been used in any attacks, so most victims have probably resolved their issues with encrypted files. Nonetheless, they may find it useful to access the last good version of their details. Such a tool may spell the end for DarkSide, as has happened with other ransomwares, because its reputation as a ransomware has been undermined and its creators will have to rework the entire encoding part of the program, which will require considerable effort.   <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

SolarWinds – How was the Orion system compromised?<\/h3>\n<\/div>\n\n
\n

The third malware discovered during the SolarWinds supply chain attack, after Sunburst and TearDrop, was Sunspot, which scans servers for MsBuild.exe\u2014an MS visual studio program used in compiling the Orion tool. If it finds the file and determines that Orion is running on that server, it replaces the source code in InventoryManager.cs with the source code Sunburst. The chief innovation of Sunspot was that it could insert itself into the process of compiling and building. The malware was created in February 2020, but the system had probably already been compromised before then\u2014estimates suggest summer 2019\u2014 because the perpetrators already had considerable knowledge. Programmers usually require greater access privileges than regular users, and servers that run compiling and building of the whole product are adapted to this need. For example, some security features may be missing because they can negatively impact the process. This allows the malware to cause greater damage. It follows that similar attacks can be expected in future. <\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

Attack on European Medicines Agency and vaccine disinformation<\/h3>\n<\/div>\n\n
\n

Hackers have attacked<\/a> the European Medicines Agency and stolen details related to the Pfizer\/Biontech vaccine, some of which they have published. Some of the published details had been tampered with to spread disinformation and erode trust in the vaccine. The attack only targeted one IT application and information related to COVID-19 and the vaccine.<\/p>\n<\/div>\n\n

\n
\"\"
Darkmarket has been taken down. Source: Europol<\/a><\/figcaption><\/figure>\n<\/div>\n\n
\n

Full Article<\/a><\/p>\n<\/div>\n\n

\n

End of DarkMarket<\/h3>\n<\/div>\n\n
\n

Germany, Australia, Denmark, Moldova, Ukraine, UK, USA and Europol have co-operated to shut down the portal DarkMarket, which had more than 50,000 users and more than 2400 sellers of drugs, falsified bank notes, stolen or falsified credit cards, anonymous SIM cards and malware. The portal had hosted more than 320,000 transactions, trading 4650 bitcoins and 12,800 monero. An infrastructure of more than 20 servers in Moldova and Ukraine was also disabled.<\/p>\n<\/div>\n\n

\n

Full Article<\/a><\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

Stay safe. We bring you our regular weekly overview of security news. Was the SolarWinds supply chain attack IT\u2019s Pearl Harbor? The SolarWinds attack resulted in over 18,000 confirmed infiltrations…<\/p>\n","protected":false},"author":4,"featured_media":5452,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[88,143],"tags":[],"class_list":["post-8109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-pop-science-sk","category-2020-sk"],"acf":[],"yoast_head":"\nSecurity week 1 - KInIT<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/\" \/>\n<meta property=\"og:locale\" content=\"sk_SK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security week 1 - KInIT\" \/>\n<meta property=\"og:description\" content=\"Stay safe. We bring you our regular weekly overview of security news. Was the SolarWinds supply chain attack IT\u2019s Pearl Harbor? The SolarWinds attack resulted in over 18,000 confirmed infiltrations...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/\" \/>\n<meta property=\"og:site_name\" content=\"KInIT\" \/>\n<meta property=\"article:published_time\" content=\"2021-02-24T20:06:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kinit.sk\/wp-content\/uploads\/2021\/02\/darkmarket.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1260\" \/>\n\t<meta property=\"og:image:height\" content=\"709\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Peter Pi\u0161tek\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@kinit\" \/>\n<meta name=\"twitter:site\" content=\"@kinit\" \/>\n<meta name=\"twitter:label1\" content=\"Autor\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter Pi\u0161tek\" \/>\n\t<meta name=\"twitter:label2\" content=\"Predpokladan\u00fd \u010das \u010d\u00edtania\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 min\u00fat\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/\"},\"author\":{\"name\":\"Peter Pi\u0161tek\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/#\\\/schema\\\/person\\\/74ec3190528eeebc0c678213e65313de\"},\"headline\":\"Security week 1\",\"datePublished\":\"2021-02-24T20:06:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/\"},\"wordCount\":1233,\"image\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kinit.sk\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/darkmarket.jpg\",\"articleSection\":[\"Pop science\",\"2020\"],\"inLanguage\":\"sk-SK\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/\",\"url\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/\",\"name\":\"Security week 1 - KInIT\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kinit.sk\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/darkmarket.jpg\",\"datePublished\":\"2021-02-24T20:06:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/#\\\/schema\\\/person\\\/74ec3190528eeebc0c678213e65313de\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#breadcrumb\"},\"inLanguage\":\"sk-SK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"sk-SK\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kinit.sk\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/darkmarket.jpg\",\"contentUrl\":\"https:\\\/\\\/kinit.sk\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/darkmarket.jpg\",\"width\":1260,\"height\":709},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/weekly-overview-of-security-news1\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kinit.sk\\\/sk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Pop science\",\"item\":\"https:\\\/\\\/kinit.sk\\\/category\\\/pop-science\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Security week 1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/#website\",\"url\":\"https:\\\/\\\/kinit.sk\\\/\",\"name\":\"KInIT\",\"description\":\"Vyu\u017e\u00edvame v\u00fdskum pre \u013eud\u00ed a priemysel\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kinit.sk\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sk-SK\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kinit.sk\\\/#\\\/schema\\\/person\\\/74ec3190528eeebc0c678213e65313de\",\"name\":\"Peter Pi\u0161tek\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security week 1 - KInIT","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/","og_locale":"sk_SK","og_type":"article","og_title":"Security week 1 - KInIT","og_description":"Stay safe. We bring you our regular weekly overview of security news. Was the SolarWinds supply chain attack IT\u2019s Pearl Harbor? The SolarWinds attack resulted in over 18,000 confirmed infiltrations...","og_url":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/","og_site_name":"KInIT","article_published_time":"2021-02-24T20:06:00+00:00","og_image":[{"width":1260,"height":709,"url":"https:\/\/kinit.sk\/wp-content\/uploads\/2021\/02\/darkmarket.jpg","type":"image\/jpeg"}],"author":"Peter Pi\u0161tek","twitter_card":"summary_large_image","twitter_creator":"@kinit","twitter_site":"@kinit","twitter_misc":{"Autor":"Peter Pi\u0161tek","Predpokladan\u00fd \u010das \u010d\u00edtania":"6 min\u00fat"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#article","isPartOf":{"@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/"},"author":{"name":"Peter Pi\u0161tek","@id":"https:\/\/kinit.sk\/#\/schema\/person\/74ec3190528eeebc0c678213e65313de"},"headline":"Security week 1","datePublished":"2021-02-24T20:06:00+00:00","mainEntityOfPage":{"@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/"},"wordCount":1233,"image":{"@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#primaryimage"},"thumbnailUrl":"https:\/\/kinit.sk\/wp-content\/uploads\/2021\/02\/darkmarket.jpg","articleSection":["Pop science","2020"],"inLanguage":"sk-SK"},{"@type":"WebPage","@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/","url":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/","name":"Security week 1 - KInIT","isPartOf":{"@id":"https:\/\/kinit.sk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#primaryimage"},"image":{"@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#primaryimage"},"thumbnailUrl":"https:\/\/kinit.sk\/wp-content\/uploads\/2021\/02\/darkmarket.jpg","datePublished":"2021-02-24T20:06:00+00:00","author":{"@id":"https:\/\/kinit.sk\/#\/schema\/person\/74ec3190528eeebc0c678213e65313de"},"breadcrumb":{"@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#breadcrumb"},"inLanguage":"sk-SK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/"]}]},{"@type":"ImageObject","inLanguage":"sk-SK","@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#primaryimage","url":"https:\/\/kinit.sk\/wp-content\/uploads\/2021\/02\/darkmarket.jpg","contentUrl":"https:\/\/kinit.sk\/wp-content\/uploads\/2021\/02\/darkmarket.jpg","width":1260,"height":709},{"@type":"BreadcrumbList","@id":"https:\/\/kinit.sk\/sk\/weekly-overview-of-security-news1\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kinit.sk\/sk\/"},{"@type":"ListItem","position":2,"name":"Pop science","item":"https:\/\/kinit.sk\/category\/pop-science\/"},{"@type":"ListItem","position":3,"name":"Security week 1"}]},{"@type":"WebSite","@id":"https:\/\/kinit.sk\/#website","url":"https:\/\/kinit.sk\/","name":"KInIT","description":"Vyu\u017e\u00edvame v\u00fdskum pre \u013eud\u00ed a priemysel","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kinit.sk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sk-SK"},{"@type":"Person","@id":"https:\/\/kinit.sk\/#\/schema\/person\/74ec3190528eeebc0c678213e65313de","name":"Peter Pi\u0161tek"}]}},"_links":{"self":[{"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/posts\/8109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/comments?post=8109"}],"version-history":[{"count":0,"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/posts\/8109\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/media\/5452"}],"wp:attachment":[{"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/media?parent=8109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/categories?post=8109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kinit.sk\/sk\/wp-json\/wp\/v2\/tags?post=8109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}