Security daily (16-10-2020)

Lawyer for alleged Methbot scammer refuses to visit jail over coronavirus concerns

A defense attorney for the head of an alleged cybercriminal conspiracy that defrauded American companies out of tens of millions of dollars is refusing to visit the defendant in a Brooklyn jail because of the COVID-19 pandemic. A lawyer for Aleksandr Zhukov, the accused boss of the Methbot/3ve advertising fraud conspiracy, informed a U.S. judge that they would no longer visit Zhukov behind bars to prepare for trial, according to a court filing submitted Friday. The attorney, who goes unnamed, cited unsafe conditions at the Metropolitan Detention Center, where Zhukov has been incarcerated for more than a year. Zhukov pleaded not guilty in January 2019 to charges that he functioned as the ringleader of the so-called Methbot fraud operation, which the U.S. Department of Justice described as an international scheme that bilked marketing companies out of $29 million. Zhukov allegedly led a group of eight accused scammers who used malicious software […] The post Lawyer for alleged Methbot scammer refuses to visit jail over coronavirus concerns appeared first on CyberScoop. (CyberScoop)

Google offers details on Chinese hacking group that targeted Biden campaign

Google on Friday offered new details on tactics used by alleged Chinese government-linked hackers who previously targeted Democratic presidential nominee Joe Biden’s campaign, while warning that multiple state-linked hacking groups continue to show an interest in the U.S. election. The Chinese state-linked group, known as APT31, has been using malicious code hosted on the open-source platform GitHub to upload and download files on networks in targeted attacks, Google said in a blog post. The use of legitimate services, including Dropbox, have made the attacks more difficult to detect. The tech giant did not specify which organizations or industries were targeted in the activity, or even if it affected political campaigns. Google did say it shares its election-related findings with the FBI and political campaigns to help protect them from the threat. “Overall, we’ve seen increased attention on the threats posed by [advanced persistent threats] in the context of the U.S. election,” […] The post Google offers details on Chinese hacking group that targeted Biden campaign appeared first on CyberScoop. (CyberScoop)

Twitter updates hacked materials policy following blowup over New York Post story

Twitter said it would modify its policy on hacked materials amid a controversy about a disputed news article about Democratic presidential nominee Joe Biden, clarifying it would only remove that kind of content if “directly shared by hackers or those acting in concert with them.” Additionally, Twitter pledged not to block related links from being shared and instead label tweets, said Vijaya Gadde, the company’s global lead for legal, policy, and trust and safety. Twitter’s late Thursday move came after outrage from conservatives over its handling of a dicey New York Post story about Biden’s son, Hunter. Twitter originally said it blocked links to the Post story based on its hacked materials policy. It never said how it came to the conclusion that anything was hacked in connection with the article. The article cites emails that were saved on a laptop that purportedly had been left in a computer repair shop. […] The post Twitter updates hacked materials policy following blowup over New York Post story appeared first on CyberScoop. (CyberScoop)

S3 Ep2: Creepy smartwatches, botnets and Pings of Death – Podcast

Listen to the latest episode of the Naked Security Podcast (Naked Security)

US Department of Justice reignites the Battle to Break Encryption

How strong is too strong? (Naked Security)

Twitter Softens Policy On Hacking Over NY Post Story

(News ≈ Packet Storm)

TikTok Launches Bug Bounty Program Amid Security Snafus

(News ≈ Packet Storm)

British Airways Fined $26 Million Over Data Breach

(News ≈ Packet Storm)

Adobe Patches Magento Code Execution, Customer Tampering Bugs

(News ≈ Packet Storm)

Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices

Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices. According to security engineer Andy Nguyen, the three flaws — collectively called BleedingTooth — reside in the open-source BlueZ protocol stack (The Hacker News)

Phishers Capitalize on Headlines with Breakneck Speed

Marking a pivot from COVID-19 scams, researchers track a single threat actor through the evolution from the pandemic to PayPal, and on to more timely voter scams -- all with the same infrastructure. (Threatpost)

Microsoft Fixes RCE Flaws in Out-of-Band Windows Update

The two important-severity flaws in Microsoft Windows Codecs Library and Visual Studio Code could enable remote code execution. (Threatpost)

Biden Campaign Staffers Targeted in Cyberattack Leveraging Antivirus Lure, Dropbox Ploy

Google's Threat Analysis Group sheds more light on targeted credential phishing and malware attacks on the staff of Joe Biden's presidential campaign. (Threatpost)

Phishing Lures Shift from COVID-19 to Job Opportunities

Fortinet researchers are seeing a pivot in the spear-phishing and phishing lures used by cybercriminals, to entice potential job candidates as businesses open up. (Threatpost)

Dickey’s BBQ Breach: Meaty 3M Payment Card Upload Drops on Joker’s Stash

After cybercriminals smoked out 3 million compromised payment cards on the Joker’s Stash marketplace, researchers linked the data to a breach at the popular barbecue franchise. (Threatpost)

TikTok Launches Bug Bounty Program Amid Security SNAFUs

The move is a distinct change in direction for the app, which has been criticized and even banned for its security practices. (Threatpost)

News Wrap: Barnes & Noble Hack, DDoS Extortion Threats and More

From a cyberattack on Barnes & Noble to Zoom rolling out end-to-end encryption, Threatpost editors break down the top security stories of the week. (Threatpost)


/security-daily/ 17-10-2020 23:44:24