Welcome to This Week’s [in]Security. This week: Major update on PCI SSF and SLC standards, Magecart, POS malware, ATM shimmers, 300M EA Games breach, Attunity AWS breach, Desjardins insider breach, cloud breaches at PCM, Fujitsu, Tata, NTT Data, Dimension Data, CSC and DXC, 10 years breached Equifax CIO jailed, everyone's spying: NSA, MySpace, and Spanish Scoer League, ballot security, NIST IoT, NTS (Secure Time), DoH, Huawei full of holes, NASA Pi hack, 10 years vulnerable, multiple nation-state hacks, more ransomware, multiple crypto-currency frauds and hacks, USB-sniffing dogs, Perception gaps, Boeing's terrible week, logic puzzles, the world's largest human Maple Leaf, and more.
Now here's this week’s selection of news, opinions, and research. Quickly skim annotated links organized by topic: compliance and payment security, breaches, regulation, bugs, privacy, hacking/malware, other security & risk, and more. We hope you enjoy and find them useful.
PCI Compliance and Payments
News and announcements relating to Payment Security, Payments, PCI, and Card Brands.
Breaches / Leaks
Covering breaches, leaks, data exposures, and their fallout.
Privacy
Articles about privacy related news, risks, and trends.
Laws & Regulations / Standards
News about laws, regulations, and standards affecting security, privacy, technology, and public interest.
Defense / Techniques / Solutions
Covering developments and opportunities that may help improve security.
Bugs / Design Flaws / Vulnerabilities / Research
Articles about newly discovered vulnerabilities and research.
Hacking / Malware / Cybercrime / Exploitation
News covering active trends and events.
- The Cybersecurity 202: U.S. businesses are preparing for Iranian hacks after American cyber attack https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2019/06/24/the-cybersecurity-202-u-s-businesses-are-preparing-for-iranian-hacks-a
- China hacked 8 major technology firms in elaborate ‘Cloud Hopper’ attack: report https://globalnews.ca/news/5432525/china-cyberattack-computer-services-cloud-hopper/
- Cloud Hopper breach victims named: Fujitsu, Tata, NTT Data, Dimension Data, CSC and DXC https://www.bankinfosecurity.com/cloud-hopper-major-cloud-services-victims-named-a-12695
- A Likely Chinese Hacker Crew Targeted 10 Phone Carriers to Steal Metadata https://www.wired.com/story/chinese-hackers-carrier-metadata/ and https://www.forbes.com/sites/zakdoffman/2019/06/25/chinese-government-suspected-of-major-hack-on-10-global-phone-companies-reports/
- US cyber attack on Iran exploited flaw in heavily-guarded network, experts say https://www.timesofisrael.com/us-cyber-attack-on-iran-exploited-flaw-in-heavily-guarded-network-experts-say/
- Russian internet giant Yandex reportedly hacked by Western intelligence agency https://www.cnet.com/news/russian-internet-giant-yandex-reportedly-hacked-by-western-intelligence-agency/
- Google – Android vendor hit with supply chain attack https://krebsonsecurity.com/2019/06/tracing-the-supply-chain-attack-on-android-2/
- Tracing the Supply Chain Attack on Android https://krebsonsecurity.com/2019/06/tracing-the-supply-chain-attack-on-android-2/
- SIM swapping - a trivial cell phone hack is ruining lives https://www.engadget.com/2019/06/28/cell-phone-hack-is-ruining-lives-identity-theft/
- MacOS Gatekeeper vulnerability has now been exploited https://9to5mac.com/2019/06/25/macos-gatekeeper-vulnerability-2/
- NASA hacked because of unauthorized Raspberry Pi connected to its network https://www.zdnet.com/article/nasa-hacked-because-of-unauthorized-raspberry-pi-connected-to-its-network/Senate bill would make companies put a price on personal data https://www.engadget.com/2019/06/24/senate-dashboard-bill-data/
- Second US town pays up to ransomware hackers https://www.bbc.com/news/technology-48770128
- Florida LAN: Someone clicks link, again, giving Key Biscayne ransomware https://arstechnica.com/information-technology/2019/06/is-there-something-in-the-water-third-florida-city-hit-by-ransomware/
- Thousands of IoT Devices Bricked By Silex Malware https://threatpost.com/thousands-of-iot-devices-bricked-by-silex-malware/146065/
- New ransomware infections are the worst drive-by attacks in recent memory https://arstechnica.com/information-technology/2019/06/new-ransomware-infections-are-the-worst-drive-by-attacks-in-recent-memory/
- Ex-Senate Aide Sentenced to 4 Years in Prison for Data Leak https://www.securityweek.com/ex-senate-aide-sentenced-4-years-prison-data-leak
- Anonymous and stupid? Hacker threw Molotov cocktail, dropped USB drive of his DDoS deeds http://nakedsecurity.sophos.com/2019/06/26/hacker-threw-molotov-cocktail-dropped-usb-drive-of-his-ddos-deeds/
- Hackers Used Two Firefox Zero Days to Hit a Crypto Exchange https://www.wired.com/story/firefox-vulnerability-coinbase-ransomware-border-hack/
- Hackers Steal Millions from Cryptocurrency Exchange Bitrue https://www.securityweek.com/hackers-steal-millions-cryptocurrency-exchange-bitrue
- Police deploy USB sniffing dogs and arrest 6 in $28M Cryptocurrency Typosquatting Fraud Probe https://www.bankinfosecurity.com/police-arrest-6-in-28-million-cryptocurrency-fraud-probe-a-12691
- Crypto Exchange And XRP Refuge Bitsane Vanishes, Scamming As Many As 246,000 Users https://www.forbes.com/sites/hanktucker/2019/06/27/crypto-exchange-and-xrp-refuge-bitsane-vanishes-scamming-as-many-as-246000-users/
- QuadrigaCX founder used aliases, moved assets into personal accounts: report https://www.cbc.ca/1.5182984
- Nearly 20 Pct Of Bitcoin Traders Have Been Hacked https://www.pymnts.com/blockchain/bitcoin/2019/bitcoin-traders-hacked/
Other Security / Risk
Articles covering other types of risks.
Off-Topic / Science & Tech / Lighter Side
A variety of scientific, technical, historical, and more light-hearted news.