IT Security Newsletter - 4/3/2020
FBI Warns of Attacks on Remote Work, Distance Learning Platforms
FBI's Internet Crime Complaint Center (IC3) issued a public service announcement today about the risk of attacks exploiting the increased usage of online communication platforms for remote working and distance learning caused by the SARS-CoV-2 pandemic. The FBI says that it's expecting an acceleration of exploitation attempts of virtual communication environments used by government agencies, private organizations, and individuals as a direct result of the COVID-19 outbreak. READ MORE...
44M Digital Wallet Items Exposed in Key Ring Cloud Misconfig
Key Ring, creator of a digital wallet app used by 14 million people across North America, has exposed 44 million IDs, charge cards, loyalty cards, gift cards and membership cards to the open internet, researchers say. The Key Ring app allows users to upload scans and photos of various physical cards into a digital folder on a user's phone. While Key Ring is primarily designed for storing membership cards for loyalty programs, users also store more sensitive cards on the app. READ MORE...
Google Squashes High-Severity Flaws in Chrome Browser
On Thursday, Google released security patches to stomp out high-severity vulnerabilities in its Chrome browser. Patches for all the bugs Google disclosed in its security advisory roll out over the next few days. Overall, eight security bugs were addressed in Chrome browser version 80.0.3987.162 for Windows, Mac, and Linux. The most severe of these flaws could allow for arbitrary code execution, according to the Center for Internet Security (CIS). READ MORE...
Security tips every teacher and professor needs to know about Zoom, right now
With the coronavirus pandemic forcing millions of people to work, learn, and socialize from home, Zoom conferences are becoming a default method to connect. And with popularity comes abuse. Enter Zoom-bombing, the phenomenon of trolls intruding into other people's meetings for the sole purpose of harassing attendees, usually by bombarding them with racist or explicit images or statements. READ MORE...
Krebs on Security: 'War Dialing' Tool Exposes Zoom's Password Problems
As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from Zoom. But without the protection of a password, there's a decent chance your next Zoom meeting could be "Zoom bombed" - attended or disrupted by someone who doesn't belong. And according to data gathered by a new automated Zoom meeting discovery tool dubbed "zWarDial," a crazy number of meetings at major corporations are not being protected by a password. READ MORE...
Bug bounty platforms buy researcher silence, violate labor laws, critics say
When Jonathan Leitschuh found a catastrophic security vulnerability in Zoom, the popular videoconferencing platform, the company offered him money to keep quiet in the form of a bug bounty and a non-disclosure agreement (NDA) through Bugcrowd. He declined the bounty payment because of the NDA, gave Zoom an industry-standard 90-day embargo to ship a patch, and when the company failed to do so, he published his research. READ MORE...
- ...in 1886, singer and actor Arthur "Dooley" Wilson, best known for singing "As Time Goes By" as Sam in the 1942 classic "Casablanca", is born in Tyler, TX.
- ...in 1968, the Rev. Martin Luther King, Jr. delivers his final speech, containing the phrase "I've been to the mountaintop." King was assassinated one day later.
- ...In 1973, the first mobile cellular phone call is placed by Motorola employee Martin Cooper in New York City, to Bell Labs in New Jersey.
- ...in 1974, A "Super Outbreak" of 178 tornadoes sweeps through the Midwest and South, including over 100 in Ohio alone.