Weekly cyber, it failed badly, but I can't name it !

There is an algorithm here, that actually filter and burry my content when I go too straight to the point.

But we saw huge failures in the SAAS, IAAS, and whatever stupid computing in the sky are called now. Between losing access controls on major companies, from organizations who had only one job, security access control.

I don't have a magical solution as some commented, but at least I had expectations from very specialized services to do what they were supposed to do. We can understand that some businesses fail to get good security in a certain extend, because it's not their job, but the ones taking responsibility (despite all the contractual BS and drop of responsibility, yes, I call contractual BS, because if you advertise you as specialist on something, there should be an added value VS being stupidly and easily pwned, sadly, there isn't, so what the value ? BS)

Isn't everything we do about bringing value and making a difference ? doing good and acting for good ?

So yes, cloud have to do better, or be trashed. We need to recover some key lost things : ACCOUNTABILITY and RESPONSIBILITY, seems they got lost on the way to cloud and devops.

Back to the topic, here is what you should have seen this week, according to me ! (yes, just like that, my an myself...) This week in 34 points :

1 - Where you organization security posture and maturity can make a difference - New Browser-in-the Browser (BITB) Attack Makes Phishing Nearly Undetectable

2 - Some say "data is the new oil", so it totally match this case - Anonymous Group Hacked Russian Oil Pipeline Giant and Released 79 GB of Stolen Data

3 - Bloatware are a threat ! Western Digital app bug gives elevated privileges in Windows, macOS

4 - I wanted to speak again about data privacy days that was weeks earlier ! Data Privacy Day: 7 Tips to Protect Your PII and Sensitive Data

5 - Now is a good time for a pentest ! Better have the good guys find your exploitable vulnerabilities that a foreign state sponsored actor ! White House Warns of New Intel on Russia Mulling Cyberattack 'Options' Against US

6 - The cloud is infected and spreading on your devices ! Android password-stealing malware infects 100,000 Google Play users

7 - Vulnerable for month as Microsoft doesn't manage to secure the systems or patch properly (claiming to be a cyber security shop...I guess OS security is not in the scope) - Windows zero-day flaw giving admin rights gets unofficial patch, again

8 - Don't fall for this scam triggering a supply chain attack ! Serpent malware campaign abuses Chocolatey Windows package manager

9 - Azure back end hacked again (has been confirmed many times and details are in post comment) #clowd ! Microsoft investigating claims of hacked source code repositories (seems that the cloud is not under the security scope either)

10 - Multi-cloud is multi leaks ? 7 Cloud Security Trends That May Impact Your Cloud Security Planning

11 - Because we all had to use this with remote work and all (and because the cloud leaks non stop, let's try to at least set the part we control the right way) - Zoom - 5 -Minute Fixes Cheatsheet

12 - The cloud hacked and leaked everywhere ! Situation is out of control (it actually never have been ! ) - Okta investigating claims of customer data breach from Lapsus$ group (well at the time of this newsletter, Okta hack is confirmed, hundreds of customers hacked where accounts had to be reset, a real cloudpocallypse ! ) - confirmation post 1 -

13 - Dell BIOS / UEFI patch time again ! New Dell BIOS Bugs Affect Millions of Inspiron, Vostro, XPS, Alienware Systems (UEFI, an hypervisor that turn pretty bad ! Yes since UEFI your systems run in a sort of virtual environment, with almost zero direct access to hardware, and that's a big shift in attack surface)

14 - Big tech and the cloud are above the laws ! Time for a reality check ! Ban Online Behavioral Advertising (Does this sounds like I don't like the cloud ? Nah, I don't like abuse, stolen IPs, privacy abuses, data leak, identity theft, marketing BS.... )

15 - These days of hacked cloud, hacked Azure, Hacked Okta, and potential AWS tokens granting way more access than they should....isn't that in the press yet ? The AWS Shared Responsibility Model: Everything You Need to Know

16 - So you thought MAC were safe from malwares ?  Custom macOS malware of Chinese hackers ‘Storm Cloud’ exposed

17 - How do you know that medical equipment supposed to keep you alive is not going to kill you anytime soon ? New Supply Chain Vulnerabilities Impact Medical and IoT Devices

18 - The cloud suing the cloud for abuse, antitrust, and lies and fake marketing ! Let's see what's the outcome.

19 - Patching your routers people ? Over 200,000 MicroTik Routers Worldwide Are Under the Control of Botnet Malware

20 - Self care and self training is definitely needed these days ! Microsoft expands cybersecurity skills initiative to 23 more countries as latest attacks show problem (I think Nortel will come back from the death and teach how not to have your IP stolen by foreign hackers and survive this, and the builders for the Titanic will come to help how not build strong non submersible ships, and Russia will come to the table explaining how to maintain peace in the world and avoid casualties at all costs)

21 - Active for 8 months at ISPs level....New Mustang Panda hacking campaign targets diplomats, ISPs (Did I warn you that connected = hacked ? Still not believing me ? yes you must apply overlapping security controls and avoid monoculture and cloud stupidity at all cost, assess risk, split the risk, protect your critical assets from the cloud and the threat actors, almost the same thing actually )

22 - Well, fact is, MFA is highly efficient, and free, security control to avoid account take over - Protecting Against Healthcare Ransomware Attacks with MFA

23 - The cloud explains to you how it lacked resources and flexibility to serve the business needs. Interesting. GitHub explains the cause behind the past week's outages.

24 - Train your staff with awareness training ! Morgan Stanley client accounts breached in social engineering attacks

25 - Western digital patch time ! Western Digital My Cloud OS update fixes critical vulnerability

26 - The cloud is an easy target ! Microsoft Azure Developers Awash in PII-Stealing npm Packages

27 - When the cloud is hacked, its abuses, data theft and bad practices just shine in front of all - HubSpot Data Breach Ripples Through Crytocurrency Industry

28 - If you use the spyware browser, time to patch as it is hacked on top of it - North Korean hackers exploit Chrome zero-day weeks before patch (or remove it, use firefox while disabling it's invasive studies participation, brave, vanadium etc)

29 - If you work in anything related to critical infrastructure, especially power distribution, this one is for you - NERC CIP is More Relevant Than Ever

30 - Hopefully your redis server is patched and up to date ! Public Redis exploit used by malware gang to grow botnet

31 - Technology in cars is a big issue because it's unmaintained, extremely exposed and huge attack surface - Honda bug lets a hacker unlock and start your car via replay attack

32 - A reading for the weekend ! Misconfigurations that can lead to S3 ransomware exposure and the mitigation tools you can leverage to prevent it - The Urgent Threat of Ransomware to S3 Buckets Due to Misconfigurations

33 - Kaspersky Named First Russian Company on Security Risk List

34 - Fact is insurance is a corrective measure that will not cancel any other impact than short term financial, so by definition, in the information security world, it's somehow very very ineffective - 5 Reasons Not To Place Blind Faith In Your Cyber Insurance Alone

Enjoy the reading, share, comment, cloud lovers will complain, but hey, don't shoot the messenger, I'm not the guy triggering the leaks and the failures, I'm not the one forcing people to the cloud and spreading people's PII, I'm just showing where we state, this is terrible, it sucks, and it's critical to let people know the current cloud state is a threat and must change.

Have a good weekend all !