Categories
APT Breach Bug Cyber Security Data leak Espionage Hacking Malware Phishing Ransomware Scam Vulnerability Zero-day

Data breach hits 30,000 Now:Pensions customers, 21 Buttons exposes millions of users’ data, and more

Major cybersecurity events on 24th December 2020 (Morning Post): Nintendo conducts invasive surveillance operation against homebrew hacker. UK privacy watchdog warns SolarWinds victims to report data breaches. Lazarus group hits COVID-19 vaccine-maker in espionage attack.

Round Up of Major Breaches and Scams

ExamSoft Flags One-Third of California Bar Exam Test Takers for Cheating

One of EFF’s chief concerns about exam proctoring software is the risk that it will incorrectly flag students for cheating, called “false positives.” This can be due either to the software’s technical failures or to its requirements that students have relatively new computers and access to near-broadband speeds. Last week, the California Bar released data confirming our fear of false positives: during its use of ExamSoft for the October Bar exam, over one-third of the nearly nine-thousand online examinees were flagged by the software.

PSA: Active Chase phishing scam pretends to be fraud alerts

A large scale phishing scam is underway that pretends to be a security notice from Chase stating that fraudulent activity has been detected and caused the recipient’s account to be blocked. Today, numerous people have told BleepingComputer that they received the same fake Chase “Security Notice” scam attempting to steal their banking credentials. One recipient said they fell for the scam after their card was denied in a purchase online and thought the email was a legitimate Chase fraud alert.

Nintendo Conducted Invasive Surveillance Operation Against Homebrew Hacker

Projects to protect the intellectual property rights of corporations are underway all around the world on a continual basis but it is rare for operational details to leak out to the public. Unfortunately for Nintendo, leaked documents are now revealing how frightening things can get for console hackers in their crosshairs, even when those targets have already declared that their work isn’t designed for piracy purposes.

Data breach hits 30,000 signed up to workplace pensions provider

About 30,000 customers of Now:Pensions face an anxious Christmas after a serious data breach at the pensions provider led to their sensitive personal details being posted on the internet. In an email sent to affected customers, the workplace pensions firm warned that names, postal and email addresses, birth dates and National Insurance numbers all appeared in a public forum online. The company, which manages auto-enrolled and other workplace pensions for 1.8 million workers, said that less than 2% of its customers had been caught up in the incident.

Fashion marketplace giant 21 Buttons exposes millions of users’ data

An alarming aspect of the entire incident is that vpnMentor contacted both 21 Buttons and Amazon but no one responded nor cared to secure the data. There are different platforms that have carved out a niche for themselves on the internet. 21 Buttons with over 5 million downloads on Android happens to be one such social network that is primarily geared towards the fashion industry. It allows users to share their content and also features e-commerce capabilities to sell clothes.

UK privacy watchdog warns SolarWinds victims to report data breaches

United Kingdom’s Information Commissioner’s Office (ICO) has warned organizations that fell victim to the SolarWinds hack that they are required to report data breaches within three days after their discovery. The UK independent authority urged organizations using compromised versions of the SolarWinds Orion IT management platform to check for evidence of attackers infiltrating their network and gaining access to personal information.

Round Up of Major Malware and Ransomware Incidents

Microsoft, McAfee, Rapid7, and Others Form New Ransomware Task Force

Industry group wants to get a framework in the hands of the new administration’s cybersecurity officials by early spring 2021. High-profile security vendors and groups have teamed up with the Institute for Security and Technology (IST) to form the Ransomware Task Force (RTF), which plans to present some actionable legal, technical, and policy ideas to the new Biden administration by early spring.

Lazarus Group Hits COVID-19 Vaccine-Maker in Espionage Attack

The nation-state actor is looking to speed up vaccine development efforts in North Korea. The advanced persistent threat (APT) known as Lazarus Group and other sophisticated nation-state actors are actively trying to steal COVID-19 research to speed up their countries’ vaccine-development efforts. That’s the finding from Kaspersky researchers, who found that Lazarus Group recently attacked a pharmaceutical company, as well as a government health ministry related to the COVID-19 response. The goal was intellectual-property theft, researchers said.

Round Up of Major Vulnerabilities and Patches

Windows zero-day with bad patch gets new public exploit code

Back in June, Microsoft released a fix for a vulnerability in the Windows operating system that enabled attackers to increase their permissions to kernel level on a compromised machine. The patch did not stick. The issue, which advanced hackers exploited as a zero-day in May, is still exploitable but by a different method as security researchers demonstrate with publicly available proof-of-concept code.