Security News > 2022 > November
Programmer and lawyer Matthew Butterick has sued Microsoft, GitHub, and OpenAI, alleging that GitHub's Copilot violates the terms of open-source licenses and infringes the rights of programmers. GitHub Copilot, released in June 2022, is an AI-based programming aid that uses OpenAI Codex to generate real-time source code and function recommendations in Visual Studio.
Cybersecurity researchers have uncovered 29 packages in Python Package Index, the official third-party software repository for the Python programming language, that aim to infect developers' machines with a malware called W4SP Stealer. "The main attack seems to have started around October 12, 2022, slowly picking up steam to a concentrated effort around October 22," software supply chain security company Phylum said in a report published this week.
Microsoft is warning of an uptick in the nation-state and criminal actors increasingly leveraging publicly-disclosed zero-day vulnerabilities for breaching target environments. The tech giant, in its 114-page Digital Defense Report, said it has "Observed a reduction in the time between the announcement of a vulnerability and the commoditization of that vulnerability," making it imperative that organizations patch such exploits in a timely manner.
SolarWinds has agreed to pay $26 million to settle a shareholder lawsuit, and it's also expecting to be slapped with an enforcement action by Uncle Sam - both related to its infamous 2020 supply chain security fiasco, according to the software maker's most recent US regulatory filing. At the end of October, SolarWinds reached a deal with investors who sued the company, alleging they were misled about its security posture in advance of the Russian cyberattack on the business, according to an 8-K filing [PDF] with the US Securities and Exchange Commission.
In 1878, a 55-foot-long giant squid washed up on the shores of Glover's Harbour, Newfoundland. It's the largest giant squid ever recorded-although scientists now think that the size was an exaggeration or the result of postmortem stretching-and there's a full-sized statue of it near the beach where it was found.
The Federal Bureau of Investigation said on Friday that distributed denial-of-service attacks coordinated by hacktivist groups have a minor impact on the services they target. "Coinciding with the Russian invasion of Ukraine, the FBI is aware of Pro-Russian hacktivist groups employing DDoS attacks to target critical infrastructure companies with limited success," the agency said.
The Alliance for Creativity and Entertainment has shut down 42 websites for the pirated streaming of televised soccer games and live TV, seizing their domains and taking down the illegal streaming services. All 42 websites were operated by an Argentinian man and drew the majority of their traffic from the Latin American country, offering unauthorized streams of live matches of the Argentine Professional Soccer League, LaLiga, UEFA Champions League, and more.
It's only a week since Elon Musk's take-private of Twitter on 28 October 2022. There's been plenty to set the fur flying, starting with Musk's curious choice of metaphor in arriving at Twitter HQ on takeover day with a kitchen sink, as though the company's products and services were already so close to complete that they needed nothing more than the aforementioned dishwashing receptacle to finish things off.
The United Kingdom's National Cyber Security Centre, the government agency that leads the country's cyber security mission, is now scanning all Internet-exposed devices hosted in the UK for vulnerabilities. "These activities cover any internet-accessible system that is hosted within the UK and vulnerabilities that are common or particularly important due to their high impact," the agency said.
The cybercrime gang's business email compromise campaign is targeting marks in the US, Europe, Australia, and the Middle East using blind third-party impersonation tactics, via email addresses hosted on domains that closely resemble the firms' real domains, and sending emails that include the actual address and VAT number of the impersonated companies. The emails look real and if the targets were to search Google for the lawyers' or law firms' names, they would seem legitimate.