Cybersecurity specialists list their election week fears

Calling it the Super Bowl for malicious actors, cybersecurity specialists have a long list of fears over election day security. These include disruption to local, municipal support services, ransomware attacks that lock up polling data, hacking of tabulation or reporting of results, and disinformation designed to undermine the public’s trust in the voting process. Since voter-registration databases are better protected than in 2016, they say we should be prepared for cyber-attacks that deny access to voter-registration lists on election day. A full list of the experts concerns is available at threatpost.com

(Threatpost

Fact checking now extends back in time

The Wayback Machine serves an archive of web pages that dates back years, and which provides snapshots of millions of website as they appeared at that time. In an effort to ensure accuracy within their library, The Internet Archive that runs the Wayback Machine has started to respond to requests from fact checking organizations such as Politifact, and will be marking fact-checked snapshots with yellow banners.

(The Internet Archive)

Hacker selling 34 million user records stolen from 17 companies through broker

The addresses are being sold through a broker, who justifies it role by stating that they themselves were not responsible for hacking into the seventeen companies. According to Bleeping Computer all of the seventeen databases being sold were obtained in 2020, with the largest breach being Geekie.com.br with 8.1 million records. None of the companies affected had reported recent data breaches prior to this week.

(Bleeping Computer)

WeWork embarrassed by insecure password

A shared user account used by WeWork employees to access printer settings and print jobs had an password so simple that a customer guessed it. The password, which was 9999, was shared among WeWork community managers. It was only accessible on WeWork’s Wi-Fi networks, but that included the free guest Wi-Fi network. WeWork has announced a thorough investigation and upgrade, and they say they have changed that password.(TechCrunch)

Thanks to our sponsor, Trusona

Trusona enables enterprises to secure and simplify user access by removing passwords from the Windows 10 login experience. With a single desktop sign-in using Trusona’s passwordless MFA, employees are automatically authenticated into Office 365 or their SSO, giving them secure access to all of their corporate applications. Give your workforce a solution they don’t have to work around.

Monero scam briefly hijacks Trump campaign website

President Trump’s campaign website was briefly defaced Tuesday night with the front page replaced with a message claiming that hackers had compromised “multiple devices” and stolen “strictly classified information” — claims that the Trump campaign rejected. There was a call to action, too: Visitors had the choice to “vote” on whether the material should be made public, by sending the cryptocurrency Monero to online wallets marked “yes” or “no.” It’s unclear if hackers broke directly into the website or redirected its traffic to another server.

(Cyberscoop)

Mastercard introduces AI-enhanced protection against cyberattacks

Cyber Secure was launched on October 30 and is being touted as a “first-of-its-kind,” AI-enabled suite of software tools that allow banking institutions to assess or evaluate potential cybersecurity risks across their ecosystem and it also helps them prevent potential security breaches. Mastercard describes Cyber Secure as a major step forward in identifying cyber vulnerabilities by giving banks the ability to actively monitor and keep track of their “cyber posture.” 

(Crowdfund Insider)

Japanese nuclear agency warns of cyberattack, turns off email systems

Japan’s Nuclear Regulation Authority is asking people to contact it via phone or fax, as it is unable to receive emails from the outside world after suspecting it was under cyber-attack. According to Japanese media, an unknown external party managed to gain access to the Nuclear Regulation Authority’s networks although there has been no confirmation of data having been exfiltrated, and officials stressed that nuclear security related information was held on a separate system that was not connected to the outside world.

(Graham Cluley)

Prankster registers an XSS attack as a UK company name

Companies House, the UK Government’s official registrar of companies has, blocked a person who registered a new business with a name that contained the right characters arranged in the right order to trigger a cross-site scripting (XSS) attack against users of the service’s API. This event seems to have been more of a white-hat experiment, but has caused the UK Government to look more closely at the current accepted practice of allowing punctuation symbols in company names.

(The Register)