(x) Blogwatch—not a bot, nor a parody

Foolish columns for @SecurityBlvd @ReversingLabs: @RiCHi curates the best bloggy bits, finest forums, and weirdest websites—a/k/a OTOH. Also @DevOpsDotCom’s TLV

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

Former head of #L3Harris​’s #Trenchant “offensive cyber” division has admitted to stealing a weapons-grade exploit chain worth $35M and selling it for personal gain.

Company’s not on trial, but the feds charged #PeterWilliams last week—and this week he’s decided to ’fess up:

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

So long and thanks for all the fish: Admits to selling unpatched bugs to a shady Russian broker.

Raises important questions about national security risks. In #SBBlogwatch, we go out with a whimper.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/ysHaEKC8Yw $LHX

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd Former head of #L3Harris​’s #Trenchant “offensive cyber” division has admitted to stealing a weapons-grade exploit chain worth $35M and selling it for personal gain.

Company’s not on trial, but the feds charged #PeterWilliams last week—and this week he’s decided to ’fess up.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

As we discussed earlier this year, organized crime groups are using slaves to scam people from massive “pig butchering” factories. One notorious center for the grotesquely evil practice is Myanmar.

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

Low Earth Pork: #PigButchering scammers in #Myanmar lose use of 2,500 Starlink terminals.

#SpaceX is crowing about how it’s blocked the scammers’ use. In #SBBlogwatch, we wonder what took Elon so long.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/iNLhMdFRUR

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd As we discussed earlier this year, organized crime groups are using slaves to scam people from massive “pig butchering” factories. One notorious center for the grotesquely evil practice is Myanmar.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

#Microsoft​’s #Windows security update rollup is badly buggy this month.

Post-patch, the #WinRE recovery environment doesn’t work with most keyboards and mice. And a fix for a cryptography bypass bug is causing failures, requiring rollbacks or registry edits to resolve.

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

Satya fiddles while Redmond burns? Bugs with security certs—plus failing USB keyboards and mice—cause QA questions.

Leads to concerns about #Windows dev process. In #SBBlogwatch, we grab a Linux ISO.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/QtwrLRY3jp $MSFT

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd #Microsoft​’s #Windows security update rollup is badly buggy this month.

Post-patch, the #WinRE recovery environment doesn’t work with most keyboards and mice. And a fix for a cryptography bypass bug is causing failures, requiring rollbacks or registry edits to resolve.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

Anything any #Android app can display is vulnerable to the #Pixnapping attack—including #2FA codes. That’s the worrying claim from a group of researchers this week.

“It’s like Rowhammer, but for the screen,” quips one wag:

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

If at first you don’t succeed: Researchers discover a new way to steal secrets from #Android apps: #Pixnapping

$GOOG thought it fixed the flaw. But group’s demo says not. In #SBBlogwatch, we blur the pels.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/wideupPhGz

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd Anything any #Android app can display is vulnerable to the #Pixnapping attack—including #2FA codes. That’s the worrying claim from a group of researchers this week.

“It’s like Rowhammer, but for the screen,” quips one wag.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

#Redis (Remote Dictionary Server) and its open source fork #Valkey share a scary flaw that can give an attacker full remote code execution.

It’s been assigned a maximum CVSS score of 10.0—which is something you don’t often see.

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

Redis hell: CVSS 10.0 vulnerability in ubiquitous cloud storage layer. PATCH NOW.

#Redis shouldn’t normally be exposed to the internet, but it often is. In #SBBlogwatch, we descend a layer.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/dJg41ZgonH

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd #Redis (Remote Dictionary Server) and its open source fork #Valkey share a scary flaw that can give an attacker full remote code execution.

It’s been assigned a maximum CVSS score of 10.0—which is something you don’t often see.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

#Japan​’s biggest producer of beer is still not producing any beer this week.

#Asahi Group Holdings shut down production Monday after detecting a cyber intruder.

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

金のうんこ！ Breaking: Big #beer brewer belatedly believes bitten by ransomware—and likely a data breach.

Today #Asahi confirmed fears of #ransomware. In #SBBlogwatch, we dry out.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/97TJI3PXTm

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd #Japan​’s biggest producer of beer is still not producing any beer this week.

#Asahi Group Holdings shut down production Monday after detecting a cyber intruder.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

The #Akira #ransomware gang have found a way to override the multifactor authentication in #SonicWall SSL VPN appliances.

These scrotes appear to be able to move laterally from the VPN boxes to deploy ransomware.

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

Strange factors: Yet another security problem plaguing #SonicWall customers.

It’s worrying that #ransomware scrotes have broken SonicWall’s #2FA. In #SBBlogwatch, we hear customers’ anger.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/O2CZFYfRqV

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd The #Akira #ransomware gang have found a way to override the multifactor authentication in #SonicWall SSL VPN appliances.

These scrotes appear to be able to move laterally from the VPN boxes to deploy ransomware.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

Iconic British brand today warned its business would stay stalled for even longer.

And a loose confederation of threat actors, now calling itself Scattered Lapsus$ Hunters, has claimed responsibility for hacking the big car firm—via tedious Telegram trolling:

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

#JLR vs. SLH: #JaguarLandRover woes worse than previously thought.

Yes, it’s those Salesforce vish kiddies again. In #SBBlogwatch, we drive the point home.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/5AuoLT801z

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd Iconic British brand today warned its business would stay stalled for even longer.

And a loose confederation of threat actors, now calling itself Scattered Lapsus$ Hunters, has claimed responsibility for hacking the big car firm—via tedious Telegram trolling.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

U.S. senator #RonWyden (pictured) is demanding the #FTC do something about #Microsoft $MSFT already.

He says Satya’s crew are to blame for some awful #ransomware attacks exploiting a vulnerability that’s more than 10 years old:

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

Roasting Redmond for #Kerberoasting: “Like an arsonist selling firefighting services,” quips 76-year-old.

Exploit affects #ActiveDirectory with old specs. In #SBBlogwatch, we wonder where to point fingers.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/ig4pyGCqRg

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd U.S. senator #RonWyden (pictured) is demanding the #FTC do something about #Microsoft already.

He says Satya’s crew are to blame for some awful #ransomware attacks exploiting a vulnerability that’s more than 10 years old.

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

A pair of ethical hackers discovered a bunch of “catastrophic” vulns in the code running 30,000 #BurgerKing, #TimHortons, #Popeyes and #FirehouseSubs locations.

Owner #RBI quickly fixed the flaws, but then its contractor #Cyble issued a sus-seeming #DMCA takedown notice:

[Richi Jennings @richi.bsky.social / @[email protected] @RiCHi]

#StreisandEffect in full effect: #RBI platform riddled with terrible #security flaws.

Tale as old as time: Poor, unfortunate $8½B corp vs. evil, vindictive, millennial hackers. In #SBBlogwatch, we rule.

@TheFuturumGroup @TechstrongGroup @SecurityBlvd: https://t.co/2LsedwD4Yv

[(x) Blogwatch—not a bot, nor a parody @xBlogwatch]

@RiCHi @TheFuturumGroup @TechstrongGroup @securityblvd A pair of ethical hackers discovered a bunch of “catastrophic” vulns in the code running 30,000 #BurgerKing, #TimHortons, #Popeyes and #FirehouseSubs locations.

Owner #RBI quickly fixed the flaws, but then its contractor #Cyble issued a sus-seeming #DMCA takedown notice.