You Have One Week to Opt Out of Amazon’s ‘Sidewalk’ Network Service

· Andrew Orr · Link

Amazon Sidewalk is the company’s network mesh service that shares your internet bandwidth with Amazon devices. You must opt out by June 8 if you don’t want this because the setting is turned on by default.

The new wireless mesh service will share a small slice of your Internet bandwidth with nearby neighbors who don’t have connectivity and help you to their bandwidth when you don’t have a connection.

By default, Amazon devices including Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers will enroll in the system.

Postal Workers Targeted With Phishing Campaign

· Andrew Orr · Link

woman with email problem

Postal workers returning to the office after COVID-19 restrictions may find themselves targeted by a new phishing campaign.

The email-based campaign, observed by Cofense, is targeting employees with emails purporting to come from their CIO welcoming them back into offices.

The email looks legitimate enough, sporting the company’s official logo in the header, as well as being signed spoofing the CIO. The bulk of the message outlines the new precautions and changes to business operations the company is taking relative to the pandemic.

Meat Supplier JBS Hit With Cyber Attack, Data Not Affected

· Andrew Orr · Link

Supermicro server Ethernet ports hacked by China

JBS SA shut down its computer networks for its operations in Australia and North America due to a cyberattack.

Backup servers were not affected, and the company is actively working to restore systems as soon as possible, according to a statement from JBS USA Monday. The processor said it’s not aware of any customer, supplier or employee data being compromised or misused.

‘Have I Been Pwned’ Open Sourced, Partners With FBI

· Andrew Orr · Link

Have i been pwned website

The popular service Have I Been Pwned has made its code open source, and it’s also partnering with the FBI. The agency will send compromised passwords discovered during investigations.

Why is the FBI getting involved? Because Bryan A. Vorndran, the FBI’s Assistant Director, Cyber Division, said, “We are excited to be partnering with HIBP on this important project to protect victims of online credential theft. It is another example of how important public/private partnerships are in the fight against cybercrime.”

DHS Releases Cybersecurity Rules for Pipeline Operators

· Andrew Orr · Link

Pipeline

Today, the Department of Homeland Security’s Transportation Security Administration (TSA) announced a Security Directive for critical pipeline companies.

The Security Directive will require critical pipeline owners and operators to report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency (CISA) and to designate a Cybersecurity Coordinator, to be available 24 hours a day, seven days a week.

It will also require critical pipeline owners and operators to review their current practices as well as to identify any gaps and related remediation measures to address cyber-related risks and report the results to TSA and CISA within 30 days.

WebKit Flaw Crashes Safari, Could Lead to Further Exploits

· Andrew Orr · Link

Safari icon in mac dock

A WebKit flaw on iOS and macOS can cause Safari to crash and could lead to further malicious attacks.

The vulnerability stems from what security researchers call a type confusion bug in the WebKit implementation of AudioWorklet, an interface that allows developers to control, manipulate, render, and output audio and decrease latency. Exploiting the vulnerability gives an attacker the basic building blocks to remotely execute malicious code on affected devices.

LastPass Introduces Improved Multi-Factor Authenticator App

· Andrew Orr · Link

Lastpass on App Store

LastPass by LogMeIn announced on Wednesday that it enhanced its mobile authenticator app and integrates with VPN providers Cisco, Palo Alto Networks, and OpenVPN for businesses. However, the authenticator app is available to all LastPass users.

With this update, the LastPass Authenticator will offer a refreshed user interface that now offers search functionality to reduce user complexity and streamline the authentication experience.

President Biden Signs Order to Improve U.S. Cybersecurity

· Andrew Orr · Link

The white house

After the attack on Colonial Pipeline, President Biden has signed an executive order to improve the nation’s cybersecurity.

The executive order requires IT service providers to share certain breach information with the government, modernizes and implements stronger cybersecurity standards in the federal government, establishes security standards for development of software sold to the government and will create an “energy star” label so that consumers can better determine whether software was developed securely.

Security Researcher Hacks Apple’s ‘Find My’ Network

· Andrew Orr · Link

Apple find my app logo

Researcher Fabian Bräunlein found that Apple’s Find My location network can be used to “upload arbitrary data to the internet.”

Being inherent to the privacy and security-focused design of the Find My Offline Finding system, it seems unlikely that this misuse can be prevented completely.

CIDA Warns of New Ransomware ‘FiveHands’

· Andrew Orr · Link

FiveHands has been around since January but was recently used in a successful attack against an unknown organization.

Attackers were targeting unpatched SonicWall Secure Mobile Access SMA 100 remote access products, for which patches were released in February. The publicly available tools the group users including the SoftPerfect Network Scanner for Discovery and Microsoft’s own remote administration program, PsExec.exe and its related ServeManager.exe.

Amazon Data Breach Exposes 200,000 Fake Reviewers

· Andrew Orr · Link

Fake Amazon reviewers data breach

Security researchers at SafetyDetectives found an insecure ElasticSearch database that potentially uncovers over 200,000 fake Amazon reviewers.

These Amazon vendors send to reviewers a list of items/products for which they would like a 5-star review. The people providing the ‘fake reviews’ will then buy the products, leaving a 5-star review on Amazon a few days after receiving their merchandise.

Upon completion, the provider of the fake review will send a message to the vendor containing a link to their Amazon profile, along with their PayPal details.

Tor Exit Nodes Were Attacked in February 2021

· Andrew Orr · Link

A new report from Hacker News says that an unknown attacker managed to control over 27% of Tor exit nodes in February 2021.

“The entity attacking Tor users is actively exploiting tor users since over a year and expanded the scale of their attacks to a new record level,” an independent security researcher who goes by the name nusenu said in a write-up published on Sunday. “The average exit fraction this entity controlled was above 14% throughout the past 12 months.”

GitHub Adds Support for Security Keys Over SSH

· Andrew Orr · Link

GitHub logo

GitHub announced on Monday that it enabled support for two-factor authentication security keys when members use them over SSH.

When used for SSH operations, security keys move the sensitive part of your SSH key from your computer to a secure external security key. SSH keys that are bound to security keys protect you from accidental private key exposure and malware. You perform a gesture, such as a tap on the security key, to indicate when you intend to use the security key to authenticate. This action provides the notion of “user presence.”