Security

Link

Elcomsoft Can Now Download iCloud Data With Trusted Device Authentication

Andrew Orr ·

Elcomsoft has announced an update to its Phone Breaker, a forensic tool used to extract data from iPhones. A trusted iOS device can now be used to authenticate into iCloud. This will let the tool decrypt data protected by end-to-end encryption.

By using a trusted device, experts benefit from unrestricted access to all kinds of information stored in the user’s iCloud account including cloud backups produced by all Apple devices sharing the same Apple ID, photos, synchronized data, as well as end-to-end encrypted data such as the user’s passwords, browsing history, and health information.

Link

'REvil' Ransomware Group Taken Down Through Multi-Country Effort

Andrew Orr ·

The FBI, working with Cyber Command, the Secret Service, and other countries, took down REvil.

According to three people familiar with the matter, law enforcement and intelligence cyber specialists were able to hack REvil’s computer network infrastructure, obtaining control of at least some of their servers. After websites that the hacker group used to conduct business went offline in July, the main spokesman for the group, who calls himself “Unknown,” vanished from the internet.

Link

WhatsApp Rolls Out Support for End-To-End Encrypted Backups

Andrew Orr ·

WhatsApp is rolling out support for end-to-end encrypted backups for Google Drive and iCloud. Here’s how to enable the feature.

Make sure you’ve got the latest version of WhatsApp.
Open Settings.
Tap Chats > Chat Backup > End-to-end Encrypted Backup.
Click Continue, then follow the prompts to create your password or 64-digit encryption key.
Hit Done, and wait for your end-to-end encrypted backup to be prepared. You may need to connect to a power source.

Link

NFT Marketplace 'OpenSea' Has Serious Security Flaws

Andrew Orr ·

OpenSea, one of the biggest marketplaces for NFTs, has security flaws that leave user wallets open to attack.

The researchers stated that the vulnerability allowed hackers to steal users’ entire crypto wallets. As said, OpenSea has been the biggest marketplace for buying, selling, and trading NFTs and other digital collectibles.

CheckPoint came across the vulnerability for the first time following reports of stolen crypto wallets triggered by airdropped NFTs. The Check Point researchers later discovered critical security issues “that, if exploited, could have led hackers to hijack user accounts and steal entire crypto wallets of users, by sending malicious NFTs”.

Link

Anonymous Hacker Shares Twitch Source Code and Payout Data

Andrew Orr ·

An anonymous hacker shares data claimed to be Twitch source code. That’s right, not just Twitch data but Twitch itself, its source code and user payout data.

The user posted a 125GB torrent link to 4chan on Wednesday, stating that the leak was intended to “foster more disruption and competition in the online video streaming space” because “their community is a disgusting toxic cesspool”.

VGC can verify that the files mentioned on 4chan are publicly available to download as described by the anonymous hacker.

I have to chuckle about the part where they go on 4chan to complain about toxic websites. Update: Twitch has confirmed the incident.

Link

Researcher Discloses Telegram Bug After Disappointing Response From Company

Andrew Orr ·

A security researcher has shared a bug with Telegram’s auto-delete feature. But the company has seemingly ignored him.

The researcher contacted Telegram in early March. And after a series of emails and text correspondence between the researcher and Telegram spanning months, the company reached out to Dmitrii in September, finally confirming the existence of the bug and collaborating with the researcher during beta testing.

Since then, the researcher claims he has been ghosted by Telegram, which has given no response and no reward.

Link

SMS Routing Company 'Syniverse' Admits it was Hacked in 2016

Andrew Orr ·

Syniverse provides backbone services to wireless carriers like AT&T, Verizon, T-Mobile, and several other carriers. It discovered the breach in May 2021 but it began in May of 2016.

Syniverse repeatedly declined to answer specific questions from Motherboard about the scale of the breach and what specific data was affected, but according to a person who works at a telephone carrier, whoever hacked Syniverse could have had access to metadata such as length and cost, caller and receiver’s numbers, the location of the parties in the call, as well as the content of SMS text messages.

Link

Twitch Adds Verification Tool as a Way to Fight Bots

Andrew Orr ·

Starting today, Twitch will let streamers require their viewers to verify their phone number via SMS before they can start chatting.

Twitch’s approach so far has been to offer streamers more control over who can and can’t chat. Streamers already have the option to make their chats subscriber-only, or slow down their chat so moderators can approve messages. There’s also the option to force all chatters to verify their email on Twitch. That hasn’t been enough, though.