Security News > 2021

South Africa's information regulator has protested WhatsApp's plans to share user data with Facebook, vowing to engage directly with the popular messaging app to ensure its compliance to national privacy laws. In January, WhatsApp asked all its users to accept new terms allowing it to share more private information with its parent company Facebook for advertising and e-commerce purposes.

A Dutch government report identifying "10 high data protection risks" for users of Google Workspace, formerly known as G Suite, has been revised after Google's response, and now says eight high risk issues still remain. Despite the name, this is not an offshoot of Google's Redmond-based rival, but a government department which manages vendor relations with the company, and which undertook to assess the risks of deploying Google Workspace instead of Office 365, in a process called a DPIA. It has conducted similar studies into privacy risks with Microsoft's services.

Since the beginning of this year, an unknown threat actor has been hacking cybercrime forums and leaking user data publicly or offering it for sale. In January, a threat actor announced on underground forum Raid Forums that they breached Verified, an established Russian-language cybercrime forum.

Cybersecurity researchers on Thursday disclosed two distinct design and implementation flaws in Apple's crowdsourced Bluetooth location tracking system that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, thereby deanonymizing users. Apple devices come with a feature called Find My that makes it easy for users to locate other Apple devices, including iPhone, iPad, iPod touch, Apple Watch, Mac, or AirPods.

In what's a case of hackers getting hacked, a prominent underground online criminal forum by the name of Maza has been compromised by unknown attackers, making it the fourth forum to have been breached since the start of the year. The intrusion is said to have occurred on March 3, with information about the forum members - including usernames, email addresses, and hashed passwords - publicly disclosed on a breach notification page put up by the attackers, stating "Your data has been leaked" and "This forum has been hacked."

Microsoft got an early start on Patch Tuesday, releasing a series of out-of-band security updates this week to address four zero-day vulnerabilities in Exchange Server. Early reports from the field indicate the updates apply smoothly following Microsoft's directions, with a reboot required.

Since the COVID-19 pandemic drove workforces home, we've seen an increase in security risk across the board: from an increase in phishing and spear phishing attacks to an increase in reliance on third-party DNS-over-HTTPS resolver use and sophisticated nation-state attacks like the one that hit SolarWinds. That means not only looking at their security stack, but at their organization-wide policies, processes, controls, and so on, to reduce risk based on their organization-specific risk framework.

For users with more than one password collected last year, researchers found that 60% of the credentials were reused across multiple accounts, making them ripe for account takeovers and password spraying attacks. This password reuse rate, which is unchanged from last year, reflects how easy it is for an attacker to use one stolen password to compromise more than one account.

The Biden administration has named China as the most threatening nation the United States faces, on grounds that it can combine its technological and other capabilities like no other. That assessment was offered in a new Interim National Security Guidance [PDF] issued on Wednesday, in which the administration also outlines plans to seek more regulation of advanced technologies and an intention to strike back after cyberattacks.

Cybercriminals have wasted little time in capitalizing on the vulnerabilities that come with remote work, and their attacks have been highly targeted, with a focus on business-related apps, according to GreatHorn. These attacks are increasingly difficult to detect as cybercriminals become more sophisticated and targeted in their attacks - advancing beyond the 'batch and blast' methodology to social engineering phishing campaigns.