News

Facebook-owned WhatsApp has filed a lawsuit against Israel's NSO Group, alleging the firm was behind cyber-attacks that infected devices with malicious software. WhatsApp accuses the company of sending malware to roughly 1,400 mobile phones for the purposes of surveillance. Users affected included journalists, human rights activists, political dissidents, and diplomats. Source: BBC

Companies need to beware of both external cyberattacks and insider threats. Like a classic horror film, both threats come with their own elements of mystery, suspense and fear. Fortunately, it is possible to defend each type of attack vector using a similar cybersecurity strategy for each. More on that later. First, let’s set the scene of the current security landscape.

Scammers are hacking into WordPress and Blogger sites and using the hacked accounts to create posts stating that the blogger's computer has been hacked and that they were recorded while using adult web sites. Source: Bleeping Computer

U.S. fast-food restaurant chain Krystal disclosed a security incident involving one of is payment processing systems and affecting some of its restaurants between July and September 2019. Krystal was founded back in 1932, currently has 342 locations in the Southern United States and "is the original quick-service restaurant chain in the South" according to a press release published on Friday. Source: Bleeping Computer  

French fashion online store Sixth June is offering shoppers more than the latest in men and women streetwear apparel as the site was infected some time ago with code that steals payment card info at checkout. The infosec community typically refers to this type of scripts as MageCart because they initially targeted sites using the Magento e-commerce platform. Source: Bleeping Computer

An unsecured Elasticsearch database left exposed the account information of about 7.5 million Adobe Creative Cloud users. Comparitech, in association with security researcher Bob Diachenko, found the Adobe database, which could be accessed without a password or any login credentials. The company was notified on October 19 and the database was locked down that day. Source: SC Magazine

One Magecart group decided that helping cancer victims is not enough of a reason to deter them from hitting the American Cancer Society’s online store with skimming malware. Sanguine Security found the malware on www.shop.cancer.org/ hiding behind the GoogleTagManager code. The store sells t-shirts emblazoned with the organization’s logo. Source: SC Magazine

Randori, a Boston-based startup from a former Carbon Black executive and a former red team consultant, announced its first product today. Called Randori Recon, this service is designed to act with a hacker’s mindset to surface all of your company’s external weaknesses. Source: Tech Crunch

OCALA, Fla. — Ocala officials said Thursday that the city had suffered a “net financial loss” as a result of a recent email "spear phishing" scam, the latest in a series of recent cybercrimes against Central Florida municipalities. Source: My News 13

Google Cloud Platform suffered issues around the same time as Amazon Web Services but claims they were not caused by DDoS. A significant distributed denial-of-service (DDoS) attack lasting approximately eight hours affected Amazon Web Services yesterday, knocking its S3 service and other services offline between 10:30 a.m. and 6:30 p.m. PDT. Source: Dark Reading