Apple, Google and Microsoft Commit to Passwordless Authentication Across Platforms
Cyber Command helped protect Lithuania from cyberattacks, Ukraine hacktivists used DDoS to stop flow of alcoholic beverages in Russia, Period tracking apps pose hazards in a post-Roe world, more
In a joint effort, tech giants Apple, Google, and Microsoft announced that they have committed to building support for the passwordless standard created by the FIDO Alliance and the World Wide Web Consortium across all mobile, desktop, and browser platforms that they control.
Through the tech giants’ support of the FIDO standard, passwordless authentication will come to all major device platforms, including Android and iOS mobile operating systems; Chrome, Edge, and Safari browsers; and the Windows and macOS desktop environments. Passwordless authentication will let users choose their phones as the primary authentication device for apps, websites, and other digital services with a default action, such as entering a PIN enough to sign in to web services without a password. (Corin Faife / The Verge)
Related: Engadget, Silicon Republic, The Financial Express, MacDailyNews, TechPowerUp, iDownloadBlog.com, PYMNTS.com, iClarified, PYMNTS.com, Philip Elmer DeWitt's Apple 3.0, iDownloadBlog.com, MacDailyNews, TechPowerUp, The Financial Express, iMore, VentureBeat, ZDNet Security, Security on TechRepublic, Microsoft, Fido Alliance, SC Magazine, The Register - Security, Phandroid, channelnews, Duo Security Bulletin, BiometricUpdate, Help Net Security, SecureWorld News, Apple, Google
US Cyber Command leader General Paul Nakasone said that a team spent months working with officials in Lithuania to help protect government networks in that country from cyberattacks.
The “hunt forward” mission involved a specialized team that worked side-by-side with Lithuanian officials to identify vulnerabilities and root out any malicious cyber activity on the networks of the country’s foreign affairs ministry and defense systems. It ended this month. (Associated Press)
Related: CIO News, The Record
According to reports from multiple Russian media outlets, hacktivists operating on the side of Ukraine have focused their DDoS attacks on a portal that is considered crucial for the distribution of alcoholic beverages in Russia.
Several vodka producers and distributors claim inability to access the EGAIS (ЕГАИС) portal as required by government regulations. Today, the EGAIS portal remains out of reach, suggesting that the DDoS attack continues. (Bill Toulas / Bleeping Computer)
Related: Security Affairs, Infosecurity Magazine
Ahead of the Supreme Court’s likely reveal of Roe v. Wade, which granted women reproductive rights, the question arises whether women should use period-tracking apps that are often used for other tracking purposes, including location tracking.
Health app makers are mostly free to do what they want with the data they collect and could provide authorities with data to obtain criminal convictions in those states that criminalize a woman’s right to choose.
Eva Galperin, director of Cybersecurity at the Electronic Frontier Foundation, said, “I do think that we are facing a future in which the data collected by period-tracking apps could be used either as a dragnet to identify women who may have had an abortion or as evidence that a woman has had an abortion in a future in which seeking out or having an abortion is criminalized, which is something anti-abortion advocates have been eager to do.” (Carly Page / TechCrunch)
Related: Washington Post
SentinelOne researcher Kasif Dekel said that two high-severity security vulnerabilities, which went undetected for several years, have been discovered in a legitimate driver that's part of Avast and AVG antivirus solutions.
According to Dekel, the flaws, CVE-2022-26522 and CVE-2022-26523, “allow attackers to escalate privileges enabling them to disable security products, overwrite system components, corrupt the operating system, or perform malicious operations unimpeded.” Following responsible disclosure on December 20, 2021, Avast addressed the issues in version 22.1 of the software released on February 8, 2022. (Ravie Lakshmanan / The Hacker News)
Related: ZDNet Security, Security Affairs, SentinelLabs, SC Magazine, Security Week, Avast
The Catalan government is calling for answers “from the highest level” after the head of Spain’s National Intelligence Centre (CNI) reportedly confirmed that 18 members of the regional independence movement were spied on with judicial approval.
The admission came two weeks after cybersecurity experts said at least 63 people connected with the Catalan independence movement had been targeted or infected with Pegasus spyware and three days after the Spanish government said the phones of the prime minister and the defense minister had been targeted with Pegasus. (Sam Jones / The Guardian)
Related: Associated Press, CNBC, Presstv
Researchers at Trend Micro have spotted a pay-per-install (PPI) malware service known as PrivateLoader distributing a "fairly sophisticated" framework called NetDooka, granting attackers complete control over the infected devices.
PrivateLoader functions as a downloader responsible for downloading and installing additional malware onto the infected system, including SmokeLoader, RedLine Stealer, Vidar, Raccoon, GCleaner, and Anubis. It is typically propagated through pirated software downloaded from rogue websites that are pushed to the top of search results via search engine optimization (SEO) poisoning techniques. (Ravie Lakshmanan / The Hacker News)
Related: Trend Micro
Researchers at Cisco Talos have released more details about the activities of a prolific Chinese government hacking group known as Mustang Panda as well as Bronze President, HoneyMyte, or RedDelta The researchers explain how the group used Russia’s invasion of Ukraine as part of its ongoing efforts to infiltrate a diverse range of target networks across three continents in pursuit of espionage and information theft.
Like other security researchers, Cisco Talos notes that the group uses an English-language decoy document with a Russian title discussing refugee and migrant pressures on Belarus to deliver its well-known PlugX malware variant. But it also further reports that Mustang Panda updated its tactics to reduce the remote URLs used to host and deploy the various parts of the malware. (AJ Vicens / Cyberscoop)
Related: The Hacker News, CSO Online, MSSP Alert, Cisco Talos
The National Institute of Standards and Technology (NIST) updated cybersecurity guidance for managing risks in the supply chain pursuant to a directive in President Biden’s executive order of May 2021.
The new guidance comes in the form of a revised publication, formally titled Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST Special Publication 800-161 Revision 1) and provides guidance on identifying, assessing, and responding to cybersecurity risks throughout the supply chain at all levels of an organization. (Mariam Baksh / NextGov)
Related: NIST, NextGov, Help Net Security, Industrial Cyber, Help Net Security, The Hacker News
Salesforce-owned cloud platform Heroku revealed that the stolen GitHub integration OAuth tokens from last month further led to the compromise of an internal customer database.
Attackers used the token to exfiltrate customers' hashed and salted passwords from "a database." Earlier this week, Heroku started performing forced password resets for a subset of its user accounts after last month's security incident without fully explaining why. (Ax Sharma / Bleeping Computer)
Related: IT News, The Hacker News, Dark Reading, The Register
Image by Gerd Altmann from Pixabay