Zack Whittaker

Security editor, TechCrunch
[email protected]
Signal: +1 646.755.8849
New York, NY

Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

NIP-05 Address

Profile Code

nprofile1qqs9eknh8x6wrd92kega8j6htj7nz79mwr7ment2kca0vj4ls526rsqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds86u6mn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

Show more details

Last Notes

2024-08-01 22:41:57

I haven't seen an 8-K like this before.
On July 25, 2024, Meta Materials Inc. said it became aware its website, email system and some IT systems "were significantly disrupted and taken offline." The company said it learned that a former company executive "deliberately de-activated and cancelled the renewal of the Company’s website," which knocked out its email that "significantly impacted the Company’s IT systems."
8-K: https://www.sec.gov/ix?doc=/Archives/edgar/data/1431959/000095017024089345/mmat-20240725.htm

2024-07-18 13:21:09

Considering updating my Slack profile picture to the meme of Matthew McConaughey smoking to adequately reflect my constant mood of "the shit I've seen."
https://files.mastodon.social/media_attachments/files/112/807/220/239/694/560/original/f7f23fa28be88619.png

2024-05-17 18:47:46

New, by me: Two universtiy students have uncovered a security bug that lets millions do their laundry for free.
CSC ServiceWorks provides internet-connected laundry machines to thousands of residential homes and universities around the U.S., Canada and Europe.
The students found that any security checks are done by the app on the user’s device and automatically trusted by CSC’s servers,
But CSC still hasn't fixed the isue — or acknowledged their findings.
More: https://techcrunch.com/2024/05/17/csc-serviceworks-free-laundry-million-machines

2024-04-24 20:12:49

Poland’s prosecutor general told the parliament on Wednesday that powerful Pegasus spyware was used against at least 578 people from 2017 to 2022 during the former government in Poland, among them elected officials.
Adam Bodnar told lawmakers that he found the scale of the surveillance “shocking and depressing.”
https://apnews.com/article/poland-spyware-pegasus-nso-group-israel-413bb3cb27daac011d52b524c6d16160

2024-04-23 00:38:31

BREAKING: UnitedHealth has confirmed that a ransomware attack on its health tech subsidiary Change Healthcare earlier this year resulted in a huge theft of Americans’ private healthcare data.
In a statement, UHG said the criminal hackers stole files containing personal data and protected health information that it says may “cover a substantial proportion of people in America.”
https://techcrunch.com/2024/04/22/unitedhealth-change-healthcare-hackers-substantial-proportion-americans/

2024-04-20 15:04:08

New, by me: Lawmakers passed legislation early Saturday reauthorizing and expanding a controversial U.S. surveillance law shortly after the powers expired at midnight, rejecting opposition by privacy advocates and lawmakers.
The bill passed in a 60-34 vote on the Senate floor overnight.
Democratic privacy hawk Sen. Ron Wyden accused lawmakers of waiting “until the 11th hour to ram through renewal of warrantless surveillance in the dead of night.”
More: https://techcrunch.com/2024/04/20/fisa-nsa-fbi-government-surveillance/

2024-04-18 19:06:27

NEW, by me: Hackers are threatening to publish a confidential database containing millions of records used by companies for screening prospective customers for links to financial crimes.
The financially motivated hacking group says it took 5.3 million records from the World-Check database.
TechCrunch was provided a sample of the records. The London Stock Exchange Group, which maintains the database, confirmed a third-party breach.
More: https://techcrunch.com/2024/04/18/world-check-database-leaked-sanctions-financial-crimes-watchlist/

2024-04-17 18:25:29

Palo Alto Networks urged companies this week to patch against a newly discovered zero-day vulnerability in one of its widely used security products, after malicious hackers began exploiting the bug to break into corporate networks.
Adding another complication, Palo Alto initially suggested disabling telemetry to mitigate the vulnerability, but said this week that disabling telemetry does not prevent exploitation.
https://techcrunch.com/2024/04/17/palo-alto-networks-firewall-bug-under-attack-brings-fresh-havoc-to-thousands-of-companies

2024-04-16 18:25:28

- reply

@npub1zj4…fyjh oh man, this is amazing! now you just gotta hope one of them brings you a big ol' shiny crypto coin.

2024-04-16 16:21:23

New, by me: An extortion group has published a portion of what it says are the private and sensitive patient records on millions of Americans stolen during the ransomware attack on Change Healthcare in February.
It’s the first time that cybercriminals have published evidence that they have in their possession medical and patient records from the cyberattack.
Change Healthcare handles between one-third and one-half of all U.S. patient records.
More: https://techcrunch.com/2024/04/15/change-healthcare-stolen-patient-data-ransomhub-leak/

2024-04-11 21:02:59

NEW: U.S. cyber agency CISA has confirmed that Russian government-backed hackers stole emails from several U.S. federal agencies as a result of an ongoing cyberattack at Microsoft.
CISA said the latest theft of government email presents "a grave and unacceptable risk" to U.S. federal agencies.
Microsoft first disclosed the breach in January. In March, the company said the attack was "ongoing."
More: https://techcrunch.com/2024/04/11/us-cisa-russia-apt-29-government-email-theft-microsoft/

2024-04-11 15:18:34

New, by me: U.S. cyber agency CISA is urging Sisense customers to reset their credentials after the company reported a recent compromise.
CISA said it was investigating as the breach "relates to impacted critical infrastructure sector organizations."
Sisense is a data analytics and business intelligence company that counts airlines, telcos, and tech companies as customers.
More: https://techcrunch.com/2024/04/11/cisa-government-sisense-reset-credentials-cyberattack/

2024-04-05 16:28:50

Earthquake Mastodon, activate!

2024-04-02 17:14:20

New, by me: U.S. police departments are increasingly relying on a controversial surveillance practice to demand large amounts of users’ data from tech companies.
'Reverse' searches cast a digital dragnet over a tech company’s store of user data to catch the information that police are looking for — like location data or search terms.
Now, the feds are already pushing this controversial practice further by demanding to know who watched certain YouTube videos.
More: https://techcrunch.com/2024/04/02/reverse-searches-police-tap-tech-companies-private-data/

2024-03-30 15:12:17

Breaking: AT&T has reset millions of customer account passcodes after a huge cache of data containing AT&T customer records was dumped online earlier this month, TechCrunch has exclusively learned.
A security researcher who analyzed the leaked data told TechCrunch that the encrypted account passcodes are easy to decipher. TechCrunch held the publication of this story until AT&T could reset customer account passcodes.
More: https://techcrunch.com/2024/03/30/att-reset-account-passcodes-customer-data/

2024-03-22 16:47:21

This is a wild story by @npub1lt9…f6eq.
The White House this week praised Paladin Capital Group and other investors for pledging not to invest in spyware companies, or startups that "undermine free and fair societies."
But Paladin previously invested in Boldend, a U.S.-based malware maker, which at one point developed a remote access exploit targeting WhatsApp that "got burned by an update," according to a leaked document we've seen.
More: https://techcrunch.com/2024/03/22/us-cyber-investors-pledge-spyware-is-off-limits-with-a-catch/

2024-03-18 23:18:29

New, by me: Mintlify says dozens of customer GitHub tokens were stolen in a recent cyberattack.
Mintlify allows developers to create documentation for their software and source code by tapping directly into the customer's GitHub source code repositories.
More: https://techcrunch.com/2024/03/18/mintlify-customer-github-tokens-data-breach/

2024-03-18 13:15:49

New, by me: Tech giant Fujitsu said it was hacked, and warned of a possible data breach involving "personal information and customer information."
Fujitsu is one of the world's biggest contractors for government tech. The company recently faced renewed furore over its role in the wrongful convictions of hundreds of U.K. postal workers accused of bad accounting and thefts, which were later attributed to bugs in Fujitsu's software.
More: https://techcrunch.com/2024/03/18/fujitsu-tech-giant-hacked-customer-data-breach/

2024-03-15 18:47:48

Ever wondered how TechCrunch verifies data breaches?
In this reporter's notebook, I look back at some of the biggest data breaches we've confirmed in recent years — including StockX, 23andMe, and a huge leak of U.S. military emails — and how we did it.
https://techcrunch.com/2024/03/15/how-to-verify-a-data-breach/

2024-03-14 13:04:05

My haiku on the proposed TikTok ban.
TikTok ban is dumb,
A data protection law
is the solution.

2024-03-14 11:52:31

New, by me: The Irish government fixed a vulnerability two years ago in its national COVID-19 vaccination portal that exposed the vaccination records of around a million residents.
HSE confirmed a data exposure. But details of the vulnerability weren’t revealed until this week after attempts to coordinate public disclosure with the government agency stalled and ended.
More: https://techcrunch.com/2024/03/13/security-flaw-irish-government-hse-covid-19/

2024-03-13 20:58:41

My TechCrunch colleague and friend @npub1tuc…lsck experienced a devastating house fire last night. Please share and support if you can.
https://www.gofundme.com/f/yd78gx-sarah-and-josie-need-our-help

2024-03-13 18:55:48

New: The Dept. of Health and Human Services's Office of Civil Rights has launched an investigation into the Change Healthcare hack, and "whether a breach of protected health information occurred," as well as Change's compliance with HIPAA rules.
Change Healthcare, which handles around one-third to half of all U.S. patient records, has yet to confirm a breach during its ongoing ransomware attack.
My earlier story: https://techcrunch.com/2024/03/09/change-healthcare-fears-data-breach-ransomware/
https://files.mastodon.social/media_attachments/files/112/089/661/393/785/156/original/3719f67d18639fa6.png

2024-03-09 13:22:33

New, by me: As the cyberattack at Change Healthcare drags into its second week, questions remain about the security of millions of people’s highly sensitive medical information handled by the U.S. health tech giant.
For those on the front-lines of healthcare cybersecurity, the worst-case scenario is that stolen patient records become public.
My weekend read: https://techcrunch.com/2024/03/09/change-healthcare-fears-data-breach-ransomware/

2024-03-03 17:42:51

Happy Sunday, it's ~ this week in security ~ time:
• Change Healthcare hit by ALPHV ransomware
• NSA warns Ivanti hacks hitting defense sector
• US agencies are snooping on phone push notifications
• US bans sale of Americans' data to adversaries
• Anycubic 3D printers mass-hack
• Popular video doorbells have simple bugs
• A rare 2-for-1 cyber cat special, and more
Sign up/RSS: https://this.weekinsecurity.com
Read online: https://mailchi.mp/weekinsecurity/this-week-in-security-march-3-2024-edition
Donate/support: https://ko-fi.com/thisweekinsecurity

2024-02-29 22:55:14

New, by me: A technology company that routes millions of SMS text messages across the world has secured an exposed database that was spilling one-time security codes that may have granted users’ access to their Facebook, Google and TikTok accounts.
The SMS routing company's database was connected to the internet with no password.
More: https://techcrunch.com/2024/02/29/leaky-database-two-factor-codes/

2024-02-29 14:41:46

So glad that Mastodon is a place free from the constant deluge of "guest post" spam... oh, for fuck's sake!
https://files.mastodon.social/media_attachments/files/112/015/052/025/321/630/original/ace92c2ce4c76f70.jpeg

2024-02-28 19:24:45

New, by me: Anycubic customers are reporting that their 3D printers have been hacked and now display a message warning of an alleged security flaw in the company’s systems.
"Immediate action is strongly advised to prevent potential exploitation," reads the message planted on Anycubic 3D printers.
Anycubic's app appears down at the time of publication.
More: https://techcrunch.com/2024/02/28/anycubic-users-3d-printers-hacked-warning/

2024-02-26 20:29:06

New, by me: An ongoing cyberattack at U.S. health tech giant Change Healthcare was caused by ransomware, TechCrunch has learned.
Reuters first reported that the cyberattack was linked to BlackCat ransomware.
The ongoing cyberattack has resulted in outages and disruption to hospitals and pharmacies across the U.S. for the past week.
More: https://techcrunch.com/2024/02/26/ransomware-attack-change-healthcare-prescription-pharmacy-outages/

2024-02-22 20:31:38

New, by me: The U.S. Federal Trade Commission said it will ban the antivirus giant Avast from selling consumers’ web browsing data to advertisers.
Avast will pay $16.5 million to settle the FTC's allegations that it sold the sensitive browsing data of millions of its customers collected from its browser extensions (ostensibly to provide privacy) to more than a hundred other companies.
More: https://techcrunch.com/2024/02/22/ftc-bans-avast-selling-customers-sensitive-browsing-data/

2024-02-22 19:35:32

U.S. health tech giant Change Healthcare is currently experiencing a cyberattack, according to its incident tracker.
But you wouldn't know if you Googled it, because Change Healthcare uses "noindex" code on the incident tracker page, which prevents updates about the incident from listing in search results.
More on the cyberattack and ongoing outage: https://techcrunch.com/2024/02/21/change-healthcare-cyberattack/
https://files.mastodon.social/media_attachments/files/111/976/560/232/706/025/original/d22e97ccc2b262ba.png

2024-02-22 13:25:07

For those following the apparent U.S. cellular outages: DownDetector is not an accurate measure for outages and shouldn't be relied on for news reporting. DownDetector largely relies on crowdsourcing complaints, and folks often complain about the wrong thing and blame it on something upstream or something entirely unrelated.
https://files.mastodon.social/media_attachments/files/111/975/111/193/730/379/original/e711df6ca868ba3a.png

2024-02-20 16:59:04

For that absolute chef's kiss level of detail, the filenames of the screenshots posted by U.K. authorities on LockBit's dark web leak site read "oh dear.png", "doesnt_look_good.png" and "this_is_really_bad.png."
https://files.mastodon.social/media_attachments/files/111/964/627/213/878/356/original/3d34cb1ae846fffa.jpg

2024-02-20 16:50:14

New, by me: U.S.. Treasury has sanctioned two Russian nationals accused of launching LockBit ransomware attacks.
The sanctions state one of the Russians is also involved with REvil, RansomEXX and Avaddon.
By sanctioning the two Russians linked to ransomware, it effectively means paying a ransom to these people (or associated groups) is illegal.
More: https://techcrunch.com/2024/02/20/lockbit-sanctions-ransomware-takedown/

2024-02-14 14:32:57

New, by me: The U.S. DOD is notifying tens of thousands of people that their personal information was exposed in an email data spill last year.
TechCrunch learned that the breach disclosure letters relate to an unsecured U.S. government cloud email server (hosted by Microsoft) that was spilling sensitive emails to the open internet.
Anyone with the email server's public IP address could access the sensitive but unclassified emails inside using only a web browser.
More: https://techcrunch.com/2024/02/14/department-defense-data-breach-microsoft-cloud-email/

2024-02-13 14:18:13

This sign probably isn't the threatening deterrent it was intended to be, but nod to the humblebrag about having resilient offsite data backups.
https://files.mastodon.social/media_attachments/files/111/924/360/184/321/000/original/9a52c317c126257c.jpeg

2024-02-13 00:20:16

I can't stress enough the importance of @npub1dv5…cn6j's findings, whose blog post goes into more detail about the incredibly crap security of TheTruthSpy's infrastructure and the risks that this presents to victims.
But also, because this line brought me the one and only laugh I've ever had related to investigating stalkerware.
https://maia.crimew.gay/posts/fuckstalkerware-4/
https://files.mastodon.social/media_attachments/files/111/921/060/562/888/752/original/9dfaa4c993e5c430.png

2024-02-12 23:22:47

- reply

Our free spyware lookup tool contains about 400,000 unique Android device identifiers that have been compromised by TheTruthSpy stalkerware. This includes victims dating back 2016 through to December 2023, which accounts for pretty much every victim of TheTruthSpy.
Here's the lookup tool:
https://techcrunch.com/pages/thetruthspy-investigation/

2024-02-12 23:11:46

New, by me: Notorious stalkerware operation TheTruthSpy was hacked — again.
Two hacking groups independently found a security flaw in TheTruthSpy that allows the mass access of victims’ stolen mobile device data directly from TheTruthSpy’s servers.
The hack reveals TheTruthSpy continues to spy on tens of thousands of new victims.
TechCrunch added the new data to our spyware lookup tool, which lets you check if your Android device was compromised by TheTruthSpy.
More: https://techcrunch.com/2024/02/12/new-thetruthspy-stalkerware-victims-is-your-android-device-compromised

2024-02-12 22:55:13

This is excellent news! The journalists at 404 Media have done incredible work in the past ~six months that they've been working for themselves, and driven considerable impact from their reporting. I've found considerable value in my 404 Media paid subscription, and would definitely recommend.
https://www.niemanlab.org/2024/02/six-months-in-journalist-owned-tech-publication-404-media-is-profitable/

2024-02-11 17:42:57

A new edition of ~ this week in security ~ just went out:
• Volt Typhoon snooped in US systems for 5+ years
• European spyware used to target iPhones
• Ivanti VPN bug now mass-exploited
• Inside an online fake ID factory
• Verizon hit by employee data breach
• Millions hit by French data leak
• And, a brand new cyber cat (of course)
Sign up/RSS: https://this.weekinsecurity.com
Read online: https://mailchi.mp/weekinsecurity/this-week-in-security-february-11-2024-edition
Donate/support: https://ko-fi.com/thisweekinsecurity

2024-02-09 23:49:49

New, by me: The startup that develops the phone app for WinStar, dubbed the "world's biggest casino," has secured an exposed database that was left on the internet without a password.
The app maker, Dexiga, took the database offline after a security researcher found the leaking database.
Dexiga's CEO claimed the database contained "publicly available information." But it wasn't — the database contained customer names, phone numbers, and email and home addresses.
More: https://techcrunch.com/2024/02/09/winstar-hotel-casino-app-exposed-customer-personal-data/

2024-02-09 01:18:37

New, by @npub1tuc…lsck: A fake app that was masquerading as password manager LastPass on the App Store has been removed, whether by Apple or the fake app’s developer is yet unclear — Apple has not commented.
"That such an obviously fake app got through Apple’s App Review process is a bad look for the tech giant, which has been arguing against new regulations, like the EU’s Digital Markets Act, by claiming these laws would compromise customer safety and privacy."
More: https://techcrunch.com/2024/02/08/a-fake-app-masquerading-as-password-manager-lastpass-just-got-pulled-from-the-app-store/

2024-02-08 16:42:04

New, by me: Livall, the maker of a popular smart ski and bike helmet, has fixed a security flaw that allowed the easy real-time location tracking of anyone wearing its helmets.
More: https://techcrunch.com/2024/02/08/livall-smart-helmet-flaw-location-tracking/

2024-02-07 17:09:19

This is Dotty, one of the chickens who lives with my parents in Scotland. Dotty doesn't know much, she's just a chicken. But even she knows that toothbrush botnet story is bollocks.
https://files.mastodon.social/media_attachments/files/111/891/059/762/452/556/original/0f3cdffd7a0a10a3.mp4

2024-02-03 14:22:25

Incredible reporting by Swiss media looking at Spyhide, a stalkerware made in Iran, which we exposed last year as a phone spyware operation snooping on tens of thousands of unknowing victims. NZZ speaks with a victim to explore the human cost of phone spyware.
via @npub1dv5…cn6j
https://www.nzz.ch/gesellschaft/wenn-der-schatz-auf-handy-mitliest-wie-eine-schweizerin-von-ihrem-partner-mit-iranischer-spyware-ausspioniert-wurde-ld.1775351

2024-02-02 23:40:05

New, by me: A year after settling New York state allegations of 'illegally promoting' phone spyware, the companies behind the phone monitoring (read: stalkerware) apps PhoneSpector and Highster appear to have shuttered.
More: https://techcrunch.com/2024/02/02/phonespector-highster-stalkerware-shut-down/

2024-02-01 18:49:29

New, by @npub1rj7…yvs2: U.S. cybersecurity agency CISA gives federal agencies just two days to disconnect flawed Ivanti VPN products under mass-exploitation.
Volexity founder Steven Adair told TechCrunch that at least 2,200 Ivanti devices have been compromised to date, though the "total number is likely much higher."
More: https://techcrunch.com/2024/02/01/cisa-federal-agencies-disconnect-ivanti-vpn/

2024-01-30 15:43:58

ChatGPT is leaking private conversations that include login credentials and other personal details of unrelated users, screenshots submitted by an Ars reader on Monday indicated.
Story by @npub1hyp…aehm: https://arstechnica.com/security/2024/01/ars-reader-reports-chatgpt-is-sending-him-conversations-from-unrelated-ai-users/

2024-01-28 17:35:46

A new edition of ~ this week in security ~ just went out:
• Microsoft reveals more on Russia's APT29 hack
• NSA buys Americans' internet records without a warrant
• Australia sanctions Medibank hacker linked to REvil
• How Patternz tracks millions using mobile apps
• Hacking a Bitcoin ATM with a QR code
• U.K. councils report data breach to ICO
• A brand new cyber cat, and more.
Sign up/RSS: https://this.weekinsecurity.com/
Read online: https://mailchi.mp/weekinsecurity/this-week-in-security-january-28-2024-edition
Support/donate: https://ko-fi.com/thisweekinsecurity

2024-01-26 22:22:01

I filed a FOIA with the Justice Department on Aug 11, 2023. I asked for an update and this week got a genuinely nice email back, in part apologizing because my request may take about 24 months to complete — about 1091 days on average to process a "complex" request. By my math, that's Aug 2026.
By federal government standards that isn't bad at all — many FOIAs take so much longer. The work that government FOIA folks do is vital and hugely appreciated, and I wish they were given more resources.

2024-01-11 17:35:09

This is why we don't claw the couch, Theo...
https://files.mastodon.social/media_attachments/files/111/738/281/822/241/686/original/a21359a1002cea13.jpg

2024-01-11 17:16:38

New, by me: ACLU attorneys say they found what they called an “alarming error” in a geofence warrant application that “resulted in a warrant stretching nearly two miles across San Francisco.”
The error was likely caused by a typo, but allowed the requesting law enforcement agency to capture information on anyone who entered the stretch of city between Fortuna Avenue to Leavenworth Street during the time the warrant was active.
More: https://techcrunch.com/2024/01/11/geofence-warrant-dragnet-error/

2024-01-10 21:06:40

Mandiant's findings into its X account takeover:
"We have finished our investigation into last week's Mandiant X account takeover and determined it was likely a brute force password attack, limited to this single account. Normally, 2FA would have mitigated this, but due to some team transitions and a change in X’s 2FA policy, we were not adequately protected. We've made changes to our process to ensure this doesn't happen again."
Mandiant has more on the campaign: https://www.mandiant.com/resources/blog/solana-cryptocurrency-stolen-clinksink-drainer-campaigns

2024-01-10 20:49:19

Really good reporting by @npub1xez…m4dz on the SEC's X account hijack.
The fact that the hackers got control of the phone number of the SEC's X account is by far the most important detail in this story.
https://www.washingtonpost.com/technology/2024/01/09/sec-hack-x-crypto/

2024-01-09 22:39:02

SEC spokesperson Cory Jarvis told me by email:
"The SEC's @SECGov X/Twitter account has been compromised. The unauthorized tweet regarding bitcoin ETFs was not made by the SEC or its staff."
Here is the false tweet that was posted.
https://files.mastodon.social/media_attachments/files/111/728/152/334/401/581/original/fbbb4a9b1685da50.png

2023-12-19 13:50:51

New, by @npub1rj7…yvs2: Comcast says hackers stole data of close to 36 million Xfinity customers.
Hackers exploited a known vulnerability called CitrixBleed, found in Citrix devices run by big corporations, but Comcast hadn't patched its own systems.
Comcast says customer names, usernames, dates of birth, hashed passwords, and some partial Social Security numbers were exposed.
More: https://techcrunch.com/2023/12/19/comcast-xfinity-hackers-36-million-customers/

2023-12-18 16:35:23

New, by me: Hackers stole the personal information of more than 14 million Mr. Cooper customers, the mortgage and loan giant has confirmed.
Mr. Cooper previously said that it believed that customer banking data was unaffected. But now the company says hackers stole customer names, addresses, Social Security numbers, and bank account numbers.
More: https://techcrunch.com/2023/12/18/mr-cooper-hackers-stole-personal-data-on-14-million-customers/

2023-12-06 16:10:59

New: Millions of patient scans and health records are spilling online, thanks to a decades-old protocol bug.
Security researchers say doctor's offices, hospitals and medical facilities have unintentionally made the private data and medical histories of millions of patients accessible to the open internet.
More from @npub1rj7…yvs2, reporting from Black Hat Europe in London: https://techcrunch.com/2023/12/06/medical-scans-health-records-dicom-pacs-security/

2023-11-30 18:14:33

New: Security flaws in court record systems used in five U.S. states exposed restricted, sealed and confidential legal documents.
Security researcher Jason Parker said the bugs they discovered varied by complexity, but all could be exploited using only the tools built-in to a web browser.
Two out of three notified vendors confirmed bug fixes, and one Florida county judiciary also confirmed a fix. Another Florida judiciary threatened Parker with legal action.
More: https://techcrunch.com/2023/11/30/us-court-records-systems-vulnerabilities-exposed-sealed-documents/

2023-11-23 15:28:03

New, by @npub1rj7…yvs2:
North Korean state-backed hackers are distributing a malicious version of a legitimate application developed by CyberLink, a Taiwanese software maker, as part of a wide-reaching supply-chain attack targeting downstream customers.
More: https://techcrunch.com/2023/11/22/north-korea-backed-hackers-target-cyberlink-users-in-supply-chain-attack/

2023-11-14 21:13:40

New by @npub1rj7…yvs2: Hackers are exploiting 'CitrixBleed' bug in the latest wave of mass cyberattacks.
'CitrixBleed' requires little effort or complexity to exploit, allowing hackers to break into a victim’s network without a password or using two-factor.
The LockBit ransomware gang has taken credit for hacking big-name firms.
“We would expect CVE-2023-4966 to be one of the top routinely exploited vulnerabilities from 2023," said Rapid7's Caitlin Condon.
More: https://techcrunch.com/2023/11/14/citrix-bleed-critical-bug-ransomware-mass-cyberattacks
https://files.mastodon.social/media_attachments/files/111/410/728/819/271/724/original/74fda8de611bf66a.jpg

2023-11-01 17:35:12

New, by me: Two U.S. lawmakers have asked retail giant Costco why it continues to sell surveillance equipment made by Lorex, despite warnings of cybersecurity risks and links to human rights abuses.
The letter comes two years(!) after a joint TechCrunch and IPVM investigation found big box retailers were selling Lorex gear. Home Depot, Best Buy, and Lowe’s ended up pulling the tech from its shelves, but Costco did not.
Now lawmakers want to know why.
More: https://techcrunch.com/2023/11/01/lawmakers-costco-lorex-dahua-entity-list/
https://files.mastodon.social/media_attachments/files/111/336/259/260/608/417/original/da536be0abc0bdb0.jpg

2023-10-25 20:42:18

"When WIRED asked Okta a series of questions about what steps it is taking to improve customer service defenses in the wake of the two breaches, and why there appears to be a lack of urgency when the company receives reports of potential incidents, the company declined to comment."
https://www.wired.com/story/okta-support-system-breach-disclosure/

2023-10-24 16:10:48

New, by me: Cloudflare and 1Password said hackers briefly targeted their systems following a recent breach of Okta’s support unit.
Both Cloudflare and 1Password, which are Okta customers, said the incidents did not affect their customer systems or user data.
Okta faced criticism for taking three weeks to publicly confirm its breach.
More: https://techcrunch.com/2023/10/24/oktas-latest-hack-fallout-hits-cloudflare-1password/
https://files.mastodon.social/media_attachments/files/111/290/390/668/765/792/original/719ef5315525b178.jpg

2023-10-13 17:26:27

New: TechCrunch has seen a sample of the Shadow data breach containing 10,000 unique records from the hacker who claimed responsibility. We verified a portion of the data, which appears to be genuine.
Many of the customer billing addresses correspond with private home addresses. The dataset alsoincludes private API keys that correspond with customer accounts, though it’s unclear if these keys are accessible by customers.
More: https://techcrunch.com/2023/10/13/shadow-data-breach-hacked/
https://files.mastodon.social/media_attachments/files/111/228/403/143/211/361/original/a2563710a4ceabf6.png

2023-10-12 13:58:09

23andMe's security incident involving the theft of users' genetic information was likely caused by credential stuffing.
Some folks have said that users share some responsibility by not using 2FA on their accounts. I think the company with hundreds of millions in revenue has more responsibility (and far greater resources) to protect users' data than the users themselves.

2023-10-08 16:07:44

- reply

@npub1zj4…fyjh "Total number of Maine residents affected: 41,397"
So it looks like Caesars might know how many folks are affected — and it's probably enormous just given Maine's numbers alone — but isn't disclosing the number just yet.

2023-10-06 14:38:14

- reply

According to my data, these stalkerware networks were hacked or exposed in the past 12 months alone:
💥 WebDetetive
💥 Xnspy
💥 TheTruthSpy
And these have shuttered, or been shut down:
✅ Spytrac
✅ LetMeSpy
✅ Spyhide
✅ Oospy
Stalkerware is difficult to combat and easy for it to reemerge. If you have technical information about a stalkerware/spyware operation or its administrators, please get in touch with me via Signal: +1 646.755.8849 or [email protected] by email.

2023-10-05 23:20:41

New, by me: Oospy, a phone stalkerware app that emerged after its predecessor Spyhide was hacked earlier this year, is no longer operational and has shut down.
The spyware operation's back-end server was taken offline Thursday by the web host Hetzner, which said Spyhide/Oospy violated its terms of service.
The shutdown of the spyware's back-end server marks the end of the spyware's ability to operate, for now.
More: https://techcrunch.com/2023/10/05/spyhide-oospy-hacked-phone-spyware-shuts-down/
https://files.mastodon.social/media_attachments/files/111/184/496/684/350/769/original/205f597fb2035791.jpg

2023-09-27 23:38:13

Chinese hackers who subverted Microsoft's email platform earlier this year managed to steal tens of thousands of emails from U.S. State Department accounts, per Reuters.
State officials said 60,000 emails were stolen from 10 different State Department accounts. Although the victims weren't named, all but one of them was working on East Asia and the Pacific.
https://www.reuters.com/world/us/chinese-hackers-stole-60000-emails-us-state-department-microsoft-hack-senate-2023-09-27/

2023-09-14 15:47:31

New: Caesars Entertainment has confirmed that hackers stole customer data in a recent cyberattack, confirming recent news reports.
The hotel and casino giant said the hackers stole the driver’s license numbers and Social Security numbers for a “significant number of members.”
Caesars is the second entertainment giant to be hacked in recent weeks. MGM is still battling with its ongoing cyberattack.
More: https://techcrunch.com/2023/09/14/caesars-entertainment-data-breach-cyberattack/
https://files.mastodon.social/media_attachments/files/111/063/807/836/563/013/original/95f37c93611af81d.jpg

2023-09-10 17:37:58

A new ~ this week in security ~ just went out, featuring:
• Cracked hacked LastPass passwords used steal crypto
• U.K. "steers away" from encryption clash — for now
• How hackers stole Microsoft's email signing key
• North Korea targets security researchers (again)
• Apple fixes Pegasus zero-click bugs
• A cyber cat-denial-of-service (it's a good one)
Sign up/RSS: https://this.weekinsecurity.com
Read online: https://mailchi.mp/zackwhittaker/this-week-in-security-september-10-2023-edition

2023-09-02 15:06:45

New: The maker of a 'smart' chastity device that can be controlled over the internet has exposed users’ email addresses, plaintext passwords, and — in some cases — precise GPS locations.
Scoop by @npub1lt9…f6eq: https://techcrunch.com/2023/09/02/smart-chastity-cage-emails-passwords-location/
https://files.mastodon.social/media_attachments/files/110/995/700/041/563/369/original/e3dbbe3a40d4cde2.jpg

2023-08-25 18:00:38

The biggest hack of the year so far has just claimed its 1,000 corporate victim — affecting at least 60 million people.
More by @npub1rj7…yvs2 on the MOVEit mass-hacks, by the numbers: https://techcrunch.com/2023/08/25/moveit-mass-hack-by-the-numbers/?tpcc=tcplustwitter
https://files.mastodon.social/media_attachments/files/110/951/085/746/709/151/original/5d51053762bf9875.jpg

2023-08-23 19:13:51

New, by me: Danish cloud host CloudNordic says most of its customers have “lost all data with us” following a ransomware attack on its datacenter systems, including its backups.
CloudNordic said that it believes the hackers had access to the company’s administrative systems “from which they could encrypt entire disks.”
More: https://techcrunch.com/2023/08/23/cloudnordic-azero-cloud-host-ransomware/
https://files.mastodon.social/media_attachments/files/110/940/045/517/165/514/original/5805c5f577091bcb.png

2023-08-12 18:04:09

Here's a fun* (*sarcasm) "on this day" memory: Three years ago during the Trump administration, the FBI came to my house, unannounced, then spent the following year trying to get me to answer questions about a story we had published about a hack involving the Mexican government, which we ultimately declined.
For the record, I'm still salty about it, and I don't know if I can ever step foot in Mexico. But I'm fortunate to work at a publication that let me write about it. https://techcrunch.com/2021/11/23/legal-demands-press-freedoms/
https://files.mastodon.social/media_attachments/files/110/877/475/803/805/426/original/18bc9ce2f625f589.jpg

2023-08-06 17:30:03

A new, packed ~this week in security~ just went out, with:
• Cloud host assisted APT hackers
• FBI investigating multi-state hospital ransomware attack
• US warns of 'critical compromise' to Air Force comms
• Senate votes to allow weed users to get security clearance
• CISA says 2022's most exploited bug is...
• And a brand new cyber cat.
Sign up/RSS: https://this.weekinsecurity.com
Read online: https://mailchi.mp/zackwhittaker/this-week-in-security-august-6-2023-edition

2023-08-05 15:40:48

New, by me: LetMeSpy, a spyware maker based in Poland, said it will shut down and cease operations after a hacker broke in and wiped out its servers.
Radeal CEO Rafal Lidwin, who develops the spyware, did not respond to a request for comment.
More: https://techcrunch.com/2023/08/05/letmespy-spyware-shuts-down-wiped-server/
https://files.mastodon.social/media_attachments/files/110/837/290/215/900/183/original/aec95a6cdbd05e30.jpg

2023-08-01 23:55:40

New, by me and @npub1xwu…ftef: California's new privacy agency first case wants to know what happens to all that connected car data.
“Modern vehicles are effectively connected computers on wheels. They’re able to collect a wealth of information via built-in apps, sensors, and cameras, which can monitor people both inside and near the vehicle,” said Ashkan Soltani, CPPA executive director.
More: https://techcrunch.com/2023/08/01/california-privacy-agency-connected-cars/
https://files.mastodon.social/media_attachments/files/110/816/580/310/380/737/original/c691c32ff7d17ffa.jpg