Ransomware, cloud leaks and AI — oh my! It was a year when both old and new cyber threats shared center stage, while cybersecurity teams also raced to meet creeping compliance deadlines.
Here is a roundup of 10 of SC Media’s most-viewed stories this year, including a mix of news, analysis and opinion, as well as “honorable mentions” that hit on the topics that mattered most to you.
1. 260K dating profiles leaked in publicly accessible ASW S3 storage
Sensitive data doesn’t get much more sensitive than the 340 GB of files leaked by an app called 419 Dating – Chat & Flirt. As we reported in July, a publicly accessible database was discovered in an Amazon Web Services S3 storage bucket by vpnMentor researcher Jeremiah Fowler, who believed the leak was most likely due to a misconfigured firewall. In addition to 260,000 user account email addresses, the database contained explicit photographs and Software Development Kit files for two other dating apps.
Honorable mentions – more on cloud security:
2. NPM software repository flooded with 15K phishing packages
This incident in February highlights dangers lurking in the open-source ecosystem. Thousands of software packages promising game cheats and increased followers on social media platforms like TikTok were uploaded to the NPM repository to lure users to phishing websites. Researchers from Checkmarx said they believed the phishing packages were distributed using an automated process and carried out through multiple user accounts, making it difficult to quickly detect and remove the malicious packages.
Honorable mentions – more on phishing:
3. Google details 0-click bug in Pixel 6 modem
This vulnerability — or rather, a combination of two critical vulnerabilities — could allow an adversary with the right resources to hijack a victim’s Android handset simply by initiating a phone call. Because the exploit relies on the ability to downgrade the Pixel 6’s cellular modem communication to 2G, the Android Red Team members who disclosed the bug at Black Hat in August recommended that all Android users disable 2G communication.
Honorable mentions – more on vulnerability management:
4. Cybercriminals are already using ChatGPT to own you
Within a month of the release of OpenAI’s game-changing large language model, ChatGPT was being leveraged by hackers to write phishing emails and develop malicious software tools. This is according to a report by Check Point Research published in early January 2023, which documented ChatGPT-related posts on dark web hacker forums. Their investigation revealed cybercriminals bragging about using the generative AI model to write Python and Java-based malware code and highlights how the tool makes cybercrime more accessible to hackers with limited coding experience (i.e. “script kiddies”).
Honorable mentions – more on generative AI:
5. CISO stress levels are out of control
In this Perspectives column, Cynet Chief Business Officer Daniel Klein discussed the results of Cynet survey that showed the vast majority of CISOs — 94% — suffer from work-related stress. Additionally, 65% of these stressed-out CISOs admitted their stress levels compromised their ability to do their job. Klein concluded that companies must do more to support their CISOs and cybersecurity staff as a whole, including by arming them with the right technical resources to do their jobs effectively.
Honorable mentions – more Perspectives:
6. FDA will refuse new medical devices for cybersecurity reasons on Oct. 1
Government regulatory agencies continue to adapt to the ever-expanding cyber landscape, keeping security teams on their toes with new rules designed to protect customers, investors and the public at large. In this case, medical device manufacturers were informed on March 29 that all new device submissions are required to come with detailed cybersecurity plans, as the FDA would begin refusing to accept devices on cybersecurity grounds on Oct. 1. The rule shifted responsibility for medical device security from healthcare delivery systems to device manufacturers themselves and was counted as a win by many healthcare stakeholders.
Honorable mentions – more on compliance:
7. The tail of the MOVEit hack may be longer than we realize
The MOVEit breach may be one of the most consequential of 2023 and comprises many factors — zero-day exploits, ransomware, supply chain security and more. By July 2023, nearly 370 organizations were confirmed to be victims of the attack on the file transfer service by ransomware group Cl0p. Additionally, supply chain risk management company Exiger told SC Media at least 73,000 entities have some meaningful relationship to MOVEit, further widening the pool of potential victims.
Honorable mentions – more on supply chain security:
8. Hospitals urged to tighten DDoS defenses after health data found on Killnet list
The healthcare sector was hammered by major cyberattacks in 2022, and 2023 was not much different with new patient data breaches hitting the headlines nearly every week. In January, the Department of Health and Human Services’ Cybersecurity Coordination Center warned healthcare providers of the Killnet hacktivist group’s targeting of hospitals with distributed denial-of-service (DDoS) attacks. Killnet’s campaign not only resulted in outages for the affected entities, but also involved the exfiltration of data from several hospitals.
Honorable mentions – more on health care cyberattacks:
9. ALPHV/BlackCat reporting to the SEC could become the ‘new normal’ for ransomware operators
The evolving tactics of ransomware groups were a hot topic for SC Media readers, with ransomware being the most-viewed site category this year. This Perspectives column gained attention after ALPHV/BlackCat reported one of its own victims to the SEC in November, adding an additional twist to the compliance race keeping many CISOs up at night. With cybergangs growing increasingly aggressive, organizations need to be prepared in advance for this ever-present threat, said Sean Deuby, principal technologist at Semperis.
Honorable mentions – more on ransomware:
10. 2023 SC Award winners announced
Finally, let’s take a look back at the winners of the 26th annual SC Awards — more than 30 cybersecurity stars that rightfully gained recognition from our judges and audience. The awards went to companies, executives, products and services across 36 categories, including 21 Trust Awards and 15 Excellence awards.
See the full list of 2023 SC Award winners here.
Keep up with SC Media in 2024 by registering for our newsletters and following us on Facebook, X (formerly Twitter) and LinkedIn.
