Security, Outages, and Vulnerabilities

Most recent stories in Security, Outages, and Vulnerabilities

• 

  Tim Johnsen

  

  Scam authenticator app advertising on App Store: Sends all your QR codes to the developer

  9to5Mac - Ben Lovejoy

  Twitter’s latest bonehead move has led to a flurry of scam authenticator apps, with at least one of them using App Store advertising to figure prominently in search results – and then sending all scanned QR codes to the developer’s analytics service. There’s a whole array of others that appear to be …

• 

  Tim Johnsen

  

  Bob Lord 🔐 :donor: (@boblord@infosec.exchange)

  infosec.exchange

  This is a fascinating FTC blog post by Alex Gaynor: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/02/security-principles-addressing-underlying-causes-risk-complex-systems "Of these, only security keys are resistant to phishing and other social engineering attacks: If a user can be tricked into typing in their username and password, they can be tricked into typing in a code from their phone.""Therefore, recent FTC orders have included provisions that: 1. Require companies to offer consumers the ability to enable MFA for their accounts 2. Require companies to use phishing-resistant MFA, such as security keys, for their own employees."This last part is important. On a regular basis I'm shocked that in 2023 companies have not yet mandated FIDO security keys for 100% staff, when accessing 100% of company resources. I recognize that it's a (potentially long) journey, but too few organizations have made meaningful progress on such an important control.

• 

  Tim Johnsen

  

  GoTo says hackers stole customers' backups and encryption key

  bleepingcomputer.com - Bill Toulas

  GoTo (formerly LogMeIn) is warning customers that threat actors who breached its development environment in November 2022 stole encrypted backups …

• 

  Tim Johnsen

  

  Twitter GodMode still available to all engineers, following hack of Apple and other accounts

  9to5Mac - Ben Lovejoy

  Twitter GodMode – an internal tool that hackers used to tweet from high-profile accounts, including Apple, back in 2020 – remains available to all of the company’s engineers, according to a new report today. Twitter had previously said that the security hole had been fixed, but a whistleblower said …

• 

  Tim Johnsen

  

  20:20

  Password Cracking - Computerphile

  Computerphile on YouTube

  'Beast' cracks billions of passwords a second, Dr Mike Pound demonstrates why you should probably change your passwords... Please note,at one point during th...

• 

  Tim Johnsen

  

  RIP, Passwords. Here’s What’s Coming Next.

  Wirecutter - Thorin Klosowski

  Sign up for Wirecutter's newsletters to get independent reviews, expert advice, and the very best deals sent straight to your inbox. Thinking of new passwords and then keeping them organized and secure is a pain, even with a password manager. But Apple, Google, and Microsoft are working together to …