This week our news feed is full of vulnerabilities, new attacks and stolen data auctions. Let's take a closer look at what happened.
1.KrebsonSecurity has done it once again, this time exposing a Romanian ATM skimming gang operating in Mexico's top tourist destinations. The malicious group installed sophisticated electronic card skimming devices inside ATMs to clone the cards of tourists and locals. As is turns out, this business was highly profitable, making $1.2 billion while at the same time it was protected by top Mexican authorities.
2. In other news, a researcher received $100k from Apple for disclosing a critical "Sign in with Apple" vulnerability. The vulnerability which is now fully patched could allow a full takeover of the user accounts regardless of the victim using a valid Apple ID email or not. The fact that Apple did not notice this vulnerability during the development of the service is worrying.
3. The criminal group responsible for spreading the ransom malware REvil announced that they would be auctioning the data stolen from their attacks. The first auction is allegedly selling files taken from a Canadian agricultural production company which, as the malicious group states, declined its extortion demands. The database contains 22,000 records, and it has a starting price of $50k.
4.Moving on to more bad news, this time in India where a significant data breach at the mobile payment app "Bharat Interface for Money" has exposed personal and financial data of millions of Indians. The attack happened after BHIM failed to secure a collection of data after a sign-up campaign.
5. Kubernetes Product Security Committee has warned users that configure Kubernetes clusters to use specific container networking implementation that a vulnerability exists that might result in Man-in-the-middle attacks. There will be no patch for this vulnerability until June 17, so users are advised to take some manual steps to secure their systems.
Comments