Equifax a utilisé admin-admin pour protéger ses données sensibles et BlackHat piraté #veille (27 oct 2019)

Voici le rapport de veille de la semaine faisant le tour des actualités les plus intéressantes. Vous retrouverez un développement de certaines d’entre elles dans les prochains articles. Bonne lecture et belle semaine à vous !

L'essentiel Cybersécurité, IA & Tech

Rejoignez la communauté. 3 fois par semaine, recevez l'analyse des tendances par Marc Barbezat. Pas de spam, juste de l'info.

Ou suivez le flux temps réel

Vol / perte de données

Major Carding Forum BriansClub Suffers Data Breach
Stolen data is stolen again as hackers turn on each other

7.5 Million Records of Adobe Creative Cloud User Data Exposed
Adobe secured a database with 7.5 million records belonging to Adobe Creative Cloud users. The cache was not protected in any way, allowing anyone access to client information if they knew how to find it.

Travel database exposed PII on US government employees
A property management company owned by hotel chain Best Western has exposed 179 GB of sensitive travel information on thousands of travelers.

Japanese hotel chain sorry that hackers may have watched guests through bedside robots
Can we at least turn the thing around before we… y’know?

https://hotforsecurity.bitdefender.com/blog/hospital-leaks-129k-patient-records-in-sophisticated-phishing-scam-21674.html

Recruitment Sites Expose Personal Data of 250K Jobseekers
Resumes exposed by job sites that didn’t make cloud storage folders private

Apple Shares iOS 13 Safari Browsing History With Chinese Firm Tencent
Apple generally holds a boastful stance with regard to user privacy. However, some recent reports have made some dangerous revelations that may hurt the firm’s image as well as users’ trust. Apple shares part of

Cyber-attaques / fraudes

Czech authorities dismantle alleged Russian cyber-espionage network
Czech officials said Russian operatives used local companies to launch cyber-attacks against foreign targets.

Revisiting The BlackHat Hack: How A Security Conference Was Pwned
Does anyone remember the Black Hat BCard hack in 2018? This hack has been documented extensively, most notoriously by [NinjaStyle] in his original blog post revealing the circumstances around disco…

German firm Pilz still down a week after getting infected with ransomware
German company Pilz, one of the world’s biggest producers of automation tools is still down after getting infected by ransomware more than a week ago.

Spanish Police Arrest Three in €10m BEC Bust
Guardia Civil reveals details of three-year Operation Lavanco

Étudiant, il a pu arnaquer Apple de près d’un million de dollars
Il aura réussi à tirer plus de 900 000 euros de la poche d’Apple, grâce à de faux iPhone qu’il renvoyait au fabriquant. Mais finalement, trois ans de prison l’attendent.

AWS touché par une attaque DDoS – Le Monde Informatique
Sécurité : Le fournisseur de cloud américain Amazon Web Services a connu une importante perturbation et indisponibilité de services notamment S3, RDS et Aurora…

Cozy Bear Emerges from Hibernation to Hack EU Ministries
The cyber-espionage group, linked to Russia and blamed for hacking the Democratic National Committee in 2016, has been using covert communications and other tec

Failles / vulnérabilités

Equifax used ‘admin’ as username and password for sensitive data: lawsuit
A class action lawsuit filed in January 2019 claims Equifax used « admin » as both password and username for a portal with sensitive information.

Galaxy S10 : le lecteur d’empreintes digitales trompé par les étuis et les films de protection
Films de protection ou encore étuis en silicone : le lecteur d’empreintes digitales des Samsung Galaxy S10 souffre d’une importante faille de sécurité. Samsung pourra-t-il vraiment la corriger de manière logicielle ?

Google Pixel 4’s Face Unlock works even if you have your eyes closed
Face Unlock bug lets someone unlock you’re Pixel 4 phone while you’re asleep or out cold.

US stopped using floppy disks to manage nuclear weapons arsenal
US Air Force switches to secure solid-state-based solution to replace antiquated floppy disks in SACCS nuclear weapons management system.

Réglementaire / juridique

Swedish police cleared to deploy spyware against crime suspects
Spyware should be able to turn on device cameras and microphones, get encrypted chat logs.

Hacker Plants Keylogger Devices on Company Systems Faces 12yr in Jail
A hacker admitted to planting hardware keyloggers on computers belonging to two companies to get unauthorized to their networks and steal proprietary data. He now faces 12 years of prison time.

Texas man sentenced to 145 months in federal prison for hacking Los Angeles Superior Court
A Texas man found guilty of hacking the Los Angeles Superior Court (LASC) computer system and used it to send out phishing emails.

Facebook risque une amende de 35 milliards de dollars pour avoir abusé de la reconnaissance faciale
Facebook est accusé d’avoir utilisé sa reconnaissance faciale sans l’autorisation de 7 millions d’internautes américains.

Divers

U.S. Border Patrol Reportedly Eyes Face Recognition for Body Cams
U.S. Customs and Border Protection-one of the arms of the federal immigration machine shoving tens of thousands of people into de facto concentration camps-is eyeing equipping officers with facial recognition body cams, according to Reuters.

Une simple erreur de code a potentiellement faussé plus d’une centaine d’études scientifiques
Des chercheurs de l’université d’Hawaï ont découvert une erreur de code sur un script créé en 2014. Et celui-ci a peut-être faussé les calculs de nombreuses études scientifiques.

Serveurs, API, outils de veille.
DCOD est un projet indépendant sans revenu. L'infra a un coût. Participez aux frais.

☕ Contribuer aux frais