Danny Palmer reports: A hacking and cyber espionage operation is going after victims around the world in a widespread campaign designed to snoop on targets and steal information. Identified victims of the cyber attacks include organisations in government, law, religious groups, non-governmental organisations (NGOs), the pharmaceutical sector and telecommunications. Multiple countries have been targeted, including…
Category: Commentaries and Analyses
Audit of the Connecticut Health Insurance Exchange Uncovers 44 Unreported Data Breaches
HIPAA Journal reports: An audit of Connecticut’s Health Insurance Exchange, Access Health CT, by the state auditor has revealed Access Health CT suffered 44 data breaches over the last 3.5 years that had not been fully reported and that sufficient steps had not been taken to safeguard sensitive data. The Connecticut Health Insurance Exchange acts…
Ledger users file a class-action lawsuit against Shopify over a data breach
Ali Raza reports: Shopify, a leading global eCommerce platform, faces a class-action lawsuit filed by users of the Ledger hardware wallet. The lawsuit stems from a major data breach that happened in 2020. The class-action lawsuit was filed at the US District Court of Delaware on April 1. The lawsuit states that Shopify failed to protect the…
Honda’s Keyless Access Bug Could Let Thieves Remotely Unlock and Start Vehicles
Ravie Lakshmanan reports: A duo of researchers has released a proof-of-concept (PoC) demonstrating the ability for a malicious actor to remote lock, unlock, and even start Honda and Acura vehicles by means of what’s called a replay attack. The attack is made possible, thanks to a vulnerability in its remote keyless system (CVE-2022-27254) that affects…
GitLab issues critical update after hard-coding passwords into accounts
Thomas Claburn reports: GitLab on Thursday issued security updates for three versions of GitLab Community Edition (CE) and Enterprise Edition (EE) software that address, among other flaws, a critical hard-coded password bug. The cloud-hosted software version control service released versions 14.9.2, 14.8.5, and 14.7.7 of its self-hosted CE and EE software, fixing one “critical” security…
Blockchains Have a ‘Bridge’ Problem, and Hackers Know It
Lily Hay Newman reports: This week, the cryptocurrency network Ronin disclosed a breach in which attackers made off with $540 million worth of Ethereum and USDC stablecoin. The incident, which is one of the biggest heists in the history of cryptocurrency, specifically siphoned funds from a service known as the Ronin Bridge. Successful attacks on “blockchain bridges” have…