October 1, 2022

Cmocheat Sheets

Technology application website

Top 10 cyber security stories of 2020

7 min read
&#13

The Covid-19 pandemic essentially changed the earth of technological innovation in 2020, and the cyber security sector was by itself profoundly influenced.

But that is not to say a microscopic virus had the headlines all to alone, with developments all-around data privateness and safety, cloud protection, vulnerability and considerably far more, all seizing their share of the spotlight. And as typical, we’ve not even started to take into consideration the impact of cyber crime.

Listed here are Pc Weekly’s best 10 cyber stability stories of 2020:

1. Warning above surge in Zoom security incidents

Cyber criminals are targeting buyers of popular videoconferencing application Zoom as millions of place of work personnel flip to collaboration instruments to preserve in contact with every other in the course of the Covid-19 pandemic.

Check out Point’s threat investigate workforce stated it has witnessed a continual rise in new Zoom domains, with 1,700 created because January, but this has ramped up in the past several times, with 425 new domains registered in the earlier 7 times on your own.

Out of these, 70 have now been determined as faux internet sites, which are impersonating genuine Zoom domains with the intention of capturing and stealing private info. The quantities strengthen a trend for cyber criminals to get gain of household operating by way of Zoom, which is used by over 60% of the Fortune 500 and has been downloaded a lot more than 50 million situations from the Google Play app retail store.

2. Broadcom flogs Symantec organization security device to Accenture

Considerably less than 12 months following acquiring Symantec’s enterprise protection company for $10.7bn, and scarcely two months after the deal was finished, Broadcom is advertising the protection solutions device on to Accenture for an undisclosed sum.

Accenture explained the deal would make its protection device a top managed safety companies service provider, enhancing its potential to help organisations “rapidly foresee, detect and react to cyber threats”.

It will get on a wide-ranging portfolio including world danger monitoring and analysis through a worldwide network of safety procedure centres, serious-time adversary and sector-precise danger intel and incident response.

3. Cosmetics organization Avon faces new cyber protection incident

Avon, the cosmetics brand that suffered an alleged ransomware attack in June 2020, has discovered itself at the centre of a new and significant stability incident following inadvertently leaving a Microsoft Azure server exposed to the general public online without having password protection or encryption.

Found by Anurag Sen of security device comparison service SafetyDetectives, the vulnerability meant that any one who possessed the server’s IP deal with could have accessed an open databases of data.

The latest incident arrives a small about a thirty day period right after Avon confirmed a important protection incident, whilst not verified to have been a ransomware attack, that took its back again-end units offline and remaining numerous of its renowned representatives unable to put any orders.

4. Belgian security researcher hacks Tesla with Raspberry Pi

Electrical automaker Tesla has rolled out an over-the-air patch for its Product X automobiles after remaining knowledgeable of a major vulnerability in its keyless entry method, recognized by Belgian academics, which could have enabled criminals to circumvent the $100,000 car’s onboard protection methods.

The Tesla Model X’s crucial fob lets its proprietors automatically unlock their motor vehicle when approaching it, or by urgent a button, using the Bluetooth Lower Electricity communications regular to chat to the vehicle via a smartphone application.

This approach was bypassed by PhD university student Lennert Wouters of the College of Leuven’s Pc Stability and Industrial Cryptography research team in a evidence of notion using a self-made system crafted from a Raspberry Pi, a modified vital fob and engine manage unit from a salvaged Model X, and other elements costing a total of $195.

5. EU moves nearer to encryption ban after Austria, France attacks

The European Union is inching closer to formally ending the use of end-to-close encryption by net platforms this sort of as Signal and WhatsApp, next a spate of Islamist terror attacks in Austria and France.

In a draft resolution document leaked to Austrian Television network ORF, which can be examine in entire listed here, the EU said it recognised the value of encryption as a “necessary signifies of guarding elementary rights”, but at the similar time “competent authorities in the area of security and legal justice” desired to be in a position to training their lawful powers in the program of their do the job.

Earlier European Council conclusions sent at the commencing of October declared that the bloc prepared to “leverage its tools and regulatory powers to support shape world-wide policies and standards”, and that funds from its Restoration and Resilience Facility are to be used to improve the EU’s capability to secure against cyber threats, to supply for a safe comms natural environment – possibly by quantum encryption – and, crucially, “to guarantee accessibility to data for judicial and regulation enforcement processes”.

6. Uncovered AWS buckets yet again implicated in several information leaks

The lack of treatment currently being taken to correctly configure cloud environments has after all over again been highlighted by two severe data leaks in the Uk triggered by misconfigured Amazon Very simple Storage Company (S3) bucket storage.

As a default environment, Amazon S3 buckets are non-public and can only be accessed by people today who have explicitly been granted entry to their contents, so their continued publicity factors to the relating to actuality that reliable messaging around cloud stability plan, implementation and configuration is failing to get through to several IT gurus.

The initially leak related to quite a few British isles consulting corporations. This was uncovered by Noah Rotem and Ran Locar, scientists at vpnMentor, who uncovered info such as passport scans, tax paperwork, qualifications checks, position programs, expense promises, contracts, e-mails and wage specifics relating to countless numbers of consultants working in the United kingdom.

7. GDPR lawsuit versus Oracle and Salesforce moves ahead

The data processing guidelines and practices of two of the world’s largest software businesses, Salesforce and Oracle, will appear underneath scrutiny in the Substantial Court docket of England and Wales in the major electronic privateness course motion lawsuit at any time filed.

The go well with, submitted by privateness campaigner and info defense professional Rebecca Rumbul, is looking for damages that have been approximated in excess of £10bn, which could conceivably guide to awards of £500 for just about every world-wide-web consumer in the British isles. A parallel go well with in the Netherlands backed by a Dutch group called The Privacy Collective Foundation could acquire the overall damages to a lot more than €15bn.

“Enough is adequate,” mentioned Rumbul. “I am worn out of tech giants behaving as if they are over the law. It is time to just take a stand and demonstrate that these businesses cannot unlawfully and indiscriminately hoover up my personal info with impunity. The world wide web is not optional any additional, and I really should be equipped to use it without large tech tracking me with no my consent.

8. Coronavirus: Researcher finds safety vulnerability in Slack

The stability threats related with unified communications and collaboration (UCC) software Zoom have turn out to be a person of the large tales of the Covid-19 coronavirus pandemic, but other UCC platforms are not immune from problems. According to AT&T’s Alien Labs, a vulnerability in cloud-native messaging service Slack could go away meetings open to disruption by destructive actors.

The vulnerability centres on Slack’s incoming webhooks, which enable customers put up messages from numerous apps to Slack. If the person specifies a special URL, a message system text and a desired destination channel, they can send a information to any webhook that they know the URL of in any workspace, irrespective of their membership.

The Slack vulnerability was uncovered by Alien Labs cloud protection researcher Ashley Graves, who reported that whilst webhooks are regarded a reduced-threat integration – the user will have to select a concentrate on channel, which reduces the scope of abuse, the webhook URL is key, and webhooks only settle for data, so can not, on their personal, expose data – this is not solely exact.

9. Qualcomm chip vulnerability puts thousands and thousands of phones at threat

Smartphone equipment from the likes of Google, LG, OnePlus, Samsung and Xiaomi are in threat of compromise by cyber criminals after 400 vulnerable code sections were uncovered on Qualcomm’s Snapdragon digital signal processor chip, which operates on over 40% of the world wide Android estate.

The vulnerabilities were uncovered by Check Issue, which mentioned that to exploit the vulnerabilities, a destructive actor would simply need to have to persuade their concentrate on to put in a uncomplicated, benign application with no permissions at all.

The vulnerabilities leave impacted smartphones at possibility of being taken in excess of and used to spy on and keep track of their customers, obtaining malware and other destructive code mounted and concealed, and even being bricked outright, mentioned Yaniv Balmas, Check out Point’s head of cyber study.

10. Vital SaltStack vulnerability influences thousands of datacentres

A sequence of crucial vulnerabilities in SaltStack’s open source Salt distant endeavor and configuration framework will let hackers breeze past authentication and authorisation safeguards to consider in excess of hundreds of cloud-centered servers if left unpatched.

Salt is employed in infrastructure, network and stability automation answers and is broadly applied to retain datacentres and cloud environments. The framework includes a “master” server acting as a central repository, with manage around “minion” brokers that have out tasks and collect details.

The two vulnerabilities, which are assigned designations CVE-2020-11651 and CVE-2020-11652, ended up uncovered by F-Secure scientists in March 2020 though doing the job on a client engagement.