Pixelating Info, Pilfer Or Report, Digital Credit Unions, & Airtag Abuse – PSW #728

"Software engineer Jay Freeman (who goes by Saurik online) didn’t leverage the exploit. Instead, he reported the issue to Optimism’s dev team, who paid him a $2-million bug bounty." - Interesting, if the bug bounty is high enough, people may not steal...

Print bombing: "Another characteristic of BlackByte, Red Canary said, was its use of “print bombing.” This feature caused all printers connected to an infected network to print ransom notes at the top of each hour that said, “Your [sic] HACKED by BlackByte team. Connect us to restore your system.”"

"Today, we’re focusing on one such technique – pixelation – and will show you why it’s a no-good, bad, insecure, surefire way to get your sensitive data leaked. To show you why, I wrote a tool called Unredacter that takes redacted pixelized text and reverses it back into its unredacted form. There’s plenty of real-world examples of this in the wild to redact sensitive information, but I won’t name names here. " - Black bars are the way to go...(just don't distribute the PPT LOL)

"The vulnerability is an improper input validation issue, described by the Common Weakness Enumeration (CWE) category system as a bug that occurs when a "product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." - Well yea, this is so many bugs... Curious to see the exploit.

Interesting: "The most prominent case involving Elephant centers around Maoist activist Rona Wilson and a group of his associates who, in 2018, were arrested by India security services and accused of plotting to overthrow the government. Evidence for the supposed plot—including a word document detailing plans to assassinate the nation’s prime minister, Narendra Modi—was found on Wilson’s laptop. However, later forensic analysis of the device showed that the documents were actually fake and had been planted using malware. According to Sentinel researchers, it was Elephant that put them there."

Used for clustering. "The TIPC module must be loaded for the system to be vulnerable. In addition, for the system to be targeted remotely, it needs to have a TIPC bearer enabled."

Or is it a group that wants to make it look like Russia? (Adorns tin foil hat): "Their ransomware code is written to prevent it from damaging files if it detects the victim's computers are located in Russia or a CIS country, The gang operates in Russian on Russian-speaking forums, The gang is linked to Evil Corp - an alleged cyber-crime group wanted by the US"

Yea, a stern warning, that'll work: "As part of the changes to make misuse harder, Apple said every user setting up their AirTag for the first time will see a message warning that using the device to track people without consent is a crime in many regions around the world." So, if you don't have an air tag, you still need to install the app: "Currently, iPhone users (and Android users who download an app) receive "unwanted tracking" alerts if an unknown AirTag moves with them."

The NFL's San Francisco 49ers team is recovering from a cyberattack by the BlackByte ransomware gang who claims to have stolen data from the team. Blackbyte operators have previously exploited Microsoft Exchange servers via the “ProxyShell” vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 16 new CVE identifiers to its list of known exploited vulnerabilities, including HiveNightmare and the Apple WebKit vulnerabilities.

Attack on retailer HKTVmall that resulted in the exposure customers' delivery addresses, names, and contact numbers.

Cryptocurrency and digital assets and platforms created through blockchain technology are poised to create major disruptions in the delivery of financial services, CUNA wrote to the Senate Banking, Housing, and Urban Affairs Committee Tuesday.

Experts uncovered a mass Magecart campaign that compromised over 500 e-store running the Magento 1 eCommerce platform. Magento 1 is unsupported. Move to Magento 2 based versions of the platform, or a commercial product.

Apple has issued security patches for its macOS, iOS and iPadOS to address CVE-2022-22620, a use after free flaw. The flaw is fixed in macOS 12.2.1, Safari 15.3, Watch OS 8.4.2 and iOS/iPadOS 15.3.1. https://support.apple.com/en-us/HT201222