News

Google is raising its "reward" for uncovering security flaws in some of its Android smartphones from $200,000 to a maximum of $1.5m. The new top "prize" is payable to those who spot bugs in the Titan M security chip in Google's Pixel smartphones, as well as meeting specific criteria. Google said it had paid out more than $4m to security researchers since 2015. Source: BBC

Although the data was legitimately scraped by legally operating firms, the security and privacy implications are numerous. An open Elasticsearch server has exposed the rich profiles of more than 1.2 billion people to the open internet. Source: Threat Post

Google expands its Android Security Rewards program and multiplies its top cash prize from $200,000 to $1 million. An expansion of Google's Android Security Rewards (ASR) program includes a new top prize of $1 million, a massive increase from the previous top prize of $200,000, Google reported today. Researchers could earn even more for exploits found in Android developer preview versions. Source: Dark Reading

T-Mobile said today in a data breach notification that the account information of an undisclosed number of customers using the company's prepaid services was accessed by an unauthorized third-party. "Our Cybersecurity team discovered and shut down malicious, unauthorized access to some information related to your T-Mobile prepaid wireless account," the breach notification says. Source: Bleeping Computer

After a deadline was missed for receiving a ransom payment, the group behind Maze Ransomware has published almost 700 MB worth of data and files stolen from security staffing firm Allied Universal. We are told this is only 10% of the total files stolen and the rest will be released if a payment is not made. Source: Bleeping Computer

European hotel booking platform provider Gekko Group mistakenly stored over 1 terabyte of information on a publicly configured server, exposing troves of data related to its hotel B2B clients, as well as travel agents and their customers. Source: SC Magazine

Cyber-attack on a hospital in Rouen last week caused "very long delays in care", reports the AFP news agency. Medical staff at the French city's University Hospital Centre (CHU) were forced to abandon PCs as ransomware had made them unusable, a spokesman said. Instead, staff returned to the "old-fashioned method of paper and pencil", said head of communications Remi Heym. Source: BBC

The NSA recently issued an advisory to enterprises that adopt 'break and inspect' technologies to gain visibility over encrypted traffic, warning them of the potential risks of such an approach. In fact, decrypting and re-encrypting traffic through a proxy device, a firewall, intrusion detection or prevention systems (IDS/IPS) that that doesn't properly validate transport layer security (TLS) certificates, for instance, will weaken the end-to-end protection provided by the TLS encryption to the end-users, drastically increasing...

External Key Manager and Key Access Justification are intended to give organizations greater visibility into requests for data access. Google Cloud today debuted new capabilities, External Key Manager and Key Access Justifications, to give customers greater visibility into who requests access to their information and the reasoning behind these requests. They also have the ability to approve or deny them. Source: Dark Reading

Admins and owners of WordPress websites are urged to immediately apply the Jetpack 7.9.1 critical security update to prevent potential attacks that could abuse a vulnerability that has existed since Jetpack 5.1. You can update your installation to the 7.9.1 version through your dashboard, or manually download the Jetpack 7.9.1 release here. Source: Bleeping Computer