Security News
SELKS is a free, open-source, turnkey solution for Suricata-based network intrusion detection and protection, network security monitoring, and threat hunting. Since all the data in SELKS is generated by the Suricata engine, it is popular among network security practitioners who explore the capabilities of Suricata IDS/IPS/NSM and analyze the network protocol monitoring logs and alerts it generates.
Louisiana and Oregon warn that millions of driver's licenses were exposed in a data breach after a ransomware gang hacked their MOVEit Transfer security file transfer systems to steal stored data. The agency says there is no indication that Clop used, sold, shared, or released any of that data, so the stolen data may have been deleted as the ransomware actors promised in their announcement to delete any stolen government data.
In a previous TechRepublic article, I wrote about how you can customize and maintain Apple IDs on multiple devices; but, what about using multiple Apple IDs on the same Mac within the same user account? This comes in handy when using two Apple IDs: one for personal use and another for business purposes. There are several reasons why you might want to use two Apple IDs on the same Mac.
A lawsuit filed against eufy security cam maker Anker Tech claims the biz assigns "Unique identifiers" to the faces of any person who walks in front of its devices - and then stores that data in the cloud, "Essentially logging the locations of unsuspecting individuals" when they stroll past. All three suits allege Anker falsely represented that its security cameras stored all data locally and did not upload that data to the cloud.
11,200,000 user records with name, date of birth, mobile nmber and ID 4,232,652 records included some sort of ID document number 3,664,598 of the IDs were from driving licences 10,000,000 address records with email, date of birth, ID and more 3,817,197 had ID document numbers 3,238,014 of the IDs were from driving licences The seller wrote, "Optus if you are reading! Price for us to not sale [sic] data is 1,000,000$US! We give you 1 week to decide." If the attacker's claim to have retrieved a total of more than 20,000,000 database records from two databases is to be believed, we're assuming [a] that Optus userid codes were easily computed or guessed, and [b] that no "Database access has hit unusual levels" warnings went off.
India's government last week released a draft telco law that defines all over-the-top services as telecoms providers and therefore makes them subject to the same regulations imposed on carriers. The draft Indian Telecommunication Bill, 2022 [PDF] defines a telecommunications service as including "Broadcasting services, electronic mail, voice mail, voice, video and data communication services" delivered over fixed or mobile networks.
An international law enforcement operation has seized the website and domains for WT1SHOP, a criminal marketplace that sold stolen credit cards, I.D. cards, and millions of login credentials. WT1SHOP was one of the largest criminal marketplaces of PII data commonly used by threat actors to buy credentials for account takeovers, credit cards used for online purchases, and government I.D. cards for identity theft.
Just employees circumventing regulation using, well, Shadow IT. Not because they tried to obfuscate or hide anything, simply because it was a convenient tool that they preferred over any other sanctioned products. Gartner has identified External Attack Surface Management, Digital Supply Chain Risk, and Identity Threat Detection as the top three trends to focus on in 2022, all of which are closely intertwined with Shadow IT. "Shadow IDs," or in other words, unmanaged employee identities and accounts in third-party services are often created using a simple email-and-password-based registration.
An ongoing phishing campaign targeting Facebook users may have already netted hundreds of millions of credentials and a claimed $59 million, and it's only getting bigger. Identified by security researchers at phishing prevention company Pixm in late 2021, the campaign has only been running since the final quarter of last year, but has already proven incredibly successful.
Digital identification is the focus of two reports by the European Union Agency for Cybersecurity: an analysis of self-sovereign identity and a study of major face presentation attacks. The technologies falling under the name of self-sovereign identity consist in giving identity holders greater control over their identity.