02-09-202104-09-2021

Security daily (03-09-2021)

Under fire from privacy advocates, Apple delays controversial photo scanning plan

Apple is delaying plans for a contentious U.S. update that the company said it would use to detect child sex abuse images as they’re uploaded to iCloud Photos from iPhones, the company announced on Friday. The reversal comes less than a month after Apple announced the change, during which the company came under heavy criticism from privacy advocates who contended it could enable government surveillance requests. Apple also delayed the rollout of a feature that would scan iMessage images sent or received by children for sexually explicit materials, and notify parents if the children are young enough. The plans stood to jeopardize Apple’s positioning as the tech giant that most valued privacy, but came as it faced pressure from governments and child advocacy groups to do more to combat child sex abuse materials. The update came more than five years after Apple refused to create new software that would have […] The post Under fire from privacy advocates, Apple delays controversial photo scanning plan appeared first on CyberScoop. (CyberScoop)

Cyber Command alerts US firms of 'ongoing' hacks targeting Atlassian enterprise software

U.S. Cyber Command is warning American organizations that hackers are exploiting software flaws in a popular project management tool, an indication that attackers could be preparing for a larger campaign that creates headaches throughout the private sector. Cyber Command — the Defense Department’s cyber unit — said in a tweet Friday that “mass exploitation” of the issue “is ongoing and expected to accelerate.” The issue exists in Atlassian Confluence, an enterprise application marketed as a means of enabling remote work in corporate environments. Atlassian, an Australian corporation, warned clients on Aug. 25 to update their systems to the latest version of Confluence. “Please patch immediately if you haven’t already — this cannot wait until after the weekend,” the Cyber Command warning stated. The message comes after the Department of Homeland Security’s cyber division, along with the FBI, warned firms to be on guard for ransomware attacks ahead of Labor Day, […] The post Cyber Command alerts US firms of 'ongoing' hacks targeting Atlassian enterprise software appeared first on CyberScoop. (CyberScoop)

FBI warns of 'large increase' in sextortion attacks, with $8 million in reported losses in 2021

Hackers and creeps extorted $8 million from Americans over the first seven months of the year by threatening to publish sexual images unless victims paid a fee, according to figures from the Federal Bureau of Investigation. The FBI bulletin published Thursday confirms what many cybercrime researchers may have already feared: Sextortion scams are prevalent, and profitable. More than 16,000 victims reported their issues to the FBI, with nearly half of the complaints coming from people between 20 and 39 years old. The 16,000 complaints almost certainly represent a fraction of the true figure, as victims of sex-related crimes often choose not to report issues to the police for a variety of reasons, including fears of retaliation or a belief that authorities won’t help resolve the issue. The bureau reports that the number of complaints in 2021 marks a “large increase,” though the precise size of the uptick remains unclear. The […] The post FBI warns of 'large increase' in sextortion attacks, with $8 million in reported losses in 2021 appeared first on CyberScoop. (CyberScoop)

S3 Ep48: Cryptographic bugs, cryptocurrency nightmares, and lots of phishing [Podcast]

Latest episode - listen now! (Naked Security)

Ransomware That Avoids Russian Speakers Gets 90% Of Payments

(News ≈ Packet Storm)

Apple Hits Pause On Controversial CSAM Detection Feature

(News ≈ Packet Storm)

Banksy Was Warned About Website Flaw Before NFT Hack Scam

(News ≈ Packet Storm)

FTC Orders SpyFone To Delete All Of Its Surveillance Data

(News ≈ Packet Storm)

This New Malware Family Using CLFS Log Files to Avoid Detection

Cybersecurity researchers have disclosed details about a new malware family that relies on the Common Log File System (CLFS) to hide a second-stage payload in registry transaction files in an attempt to evade detection mechanisms. FireEye's Mandiant Advanced Practices team, which made the discovery, dubbed the malware PRIVATELOG, and its installer, STASHLOG. Specifics about the identities of the (The Hacker News)

The State of Incident Response: Measuring Risk and Evaluating Your Preparedness

Grant Oviatt, director of incident-response engagements at Red Canary, provides advice and best practices on how to get there faster. (Threatpost)

FIN7 Capitalizes on Windows 11 Release in Latest Gambit

The financially motivated group looked to steal payment-card data from a California-based point-of-sale service provider. (Threatpost)

Brute-Force Attacks Target Inboxes for Gift Card Data

Cybercriminal enterprise is mass testing millions of usernames and passwords per day in a hunt for loyalty card data. (Threatpost)

02-09-202104-09-2021

/security-daily/ 04-09-2021 23:44:23