FTX founder has pleaded not guilty to fraud charges
On Tuesday, Sam Bankman-Fried, founder and former CEO of collapsed cryptocurrency exchange, FTX, appeared in a federal court in Manhattan to face eight counts of defrauding customers, laundering money, and violating campaign finance laws. Bankman-Fried pleaded not guilty to all eight counts relating to his moving money from FTX to a crypto hedge fund he fully owned. In total, $7 billion went missing from the exchange just before its collapse, making it one of the largest financial fraud cases in US history.
(BuzzFeed)
LA housing authority operations disrupted by cyberattack
The Housing Authority of the City of Los Angeles (HACLA) confirmed its systems were impacted by a cyberattack after the agency appeared on the LockBit leak site. On December 31, the ransomware gang said it stole 15 TB of data and gave the agency until January 12 to pay an undisclosed ransom. The agency, which serves more than 19,000 families in the city, is working with cybersecurity experts to keep its operations running while the issue gets resolved. This is the second major cyberattack on a LA agency after the Los Angeles Unified School District was attacked back in September.
Ukrainian authorities bust major vishing call center
Ukranian cyber police and investigators have busted 40 individuals involved with a call center operation blamed for defrauding an estimated 18,000 Kazakhstanis. Call center staff rang up victims pretending to be support staff from their banks and elicited bank account info under the guise of “helping” to cancel fraudulent transactions.The scammers used the account info to transfer victim funds into accounts they controlled, as well as taking out loans in their names. The investigation is ongoing, but those already arrested face up to eight years in jail for fraud-related offenses.
Google alleges India antitrust body copy-pasted from European ruling
Back in October, the Competition Commission of India (CCI) fined Google $161 million for exploiting its dominant position in markets such as online search and the Android app store. Google now argues that the CCI’s investigation has more than 50 instances of copy-pasting from a European Commission decision, showing that evidence was not examined in India. In its filing to an Indian appeals tribunal, Google asserts that, “The Commission failed to conduct an impartial, balanced, and legally sound investigation.”
(Reuters)
And now a word from our sponsor, AppOmni
AppOmni identifies misconfigurations and guides remediation to keep your SaaS data secure. We help Security teams make sense of data access permissions, third party app visibility, and threat detection across their entire SaaS ecosystem. Get started at AppOmni.com.
Hackers using stolen bank info to trick new victims
Cybersecurity firm Qualys, has discovered threat actors using stolen Columbian bank records as a lure in recent phishing attacks. Qualys found evidence of over 418,000 stolen bank records but saw no signs of the information being shared on the darkweb. Instead, the attackers are using an Excel email file attachment containing the exfiltrated bank data, to kick off a macro which ultimately executes malware known as BitRAT. BitRAT comes with a wide range of functionalities to steal data, harvest credentials, mine cryptocurrency, and download additional binaries.
Synology fixes maximum severity vulnerability in VPN routers
Taiwan-based networking and storage solutions provider Synology has released two security advisories related to issues in its products. The first advisory warns of a 10 of 10 severity rated bug, tracked as CVE-2022-43931, which can allow a remote attacker to execute arbitrary commands in its VPN Plus Server. The second advisory describes multiple vulns impacting the Synology Router Manager (SRM), which is the operating system that powers the firm’s routers. The discovery of these flaws were credited to several individuals through Trend Micro’s Zero Day Initiative (ZDI). This suggests these vulns were unveiled at the Pwn2Own Toronto 2022 hacking contest back in December.
Google paid $100k smart speaker bug bounty
Security researcher Matt Kunze has cashed in on vulns he discovered in the Google Home Mini smart speaker. Kunze discovered that an attacker could link an account to the smart speaker without the Google Home application, by tampering with the linking process. From there, the attacker could use the account to send remote commands to the device over the internet, to access the microphone and make arbitrary HTTP requests to potentially expose the Wi-Fi password or access other devices. In total, Google paid him a $107,500 reward for responsibly reporting vulnerabilities.
Multiple security breaches shut down trucker protest
Canada Unity, one of the groups that organized last year’s Freedom Convoy that overtook Canadian city streets to protest mandatory COVID-19 vaccinations, has canceled a repeat demonstration planned for February. According to a press release posted to the group’s Facebook page, the rally was called off following “multiple security breaches,” according to organizers, who also cited “personal character attacks” as a reason for the cancellation. One of the group’s founders,James Bauder,wrote, “As a result, the Canada Unity Convoy for Freedom – Freedom Convoy will remain Officially 10-7 until further notice.” The 10-7 is a CB radio code for Out of Service.