A roundup of the top news stories in information security this week, including researchers exploiting a critical vulnerability that easily unlocks a popular gun safe, and a new bill threatening jail time for failing to disclose a data breach within 30 days.
MALWARE
Hundreds of HP Laptops Affected by Pre-Installed Keylogger
A security expert discovered that hundreds of HP laptops had preinstalled keylogging code in their software drivers. More than 460 models of laptops, including those in the EliteBook, ProBook, Pavilion, and Envy ranges, were affected by the “potential security vulnerability.” The software could give someone the ability to record every letter types on a computer keyboard discretely.
VULNERABILITY
Popular Handgun Safe Impacted by Critical Vulnerability
A critical flaw found in a top-selling electronic gun safe allows it to be opened by nearly anyone. Regardless if they know the password or not, the Vaultek VT20i handgun safe is impacted by the critical vulnerability after researchers with security firm Two Six Labs were able to leverage it and open the safe in seconds. As long as the safe has Bluetooth connectivity turned on, any attacker would be able to unlock the safe by leveraging the flaw.
INTERNATIONAL HACK
Italian Prosecutors in Hacking Team Case Drop Investigation
After hackers compromised the servers of Italian surveillance tech vendor Hacking Team, an investigation was launched into the incident. This week Italian prosecutors in the case have decided to close the investigation. At the time, a hacker known as Phineas Fisher claims responsibility for the security event, stated that he exposed the data because it shed light on the eavesdropping the company’s government clients would turn to to spy on their domestic opponents. Former Hacking Team employees were previously accused in the case.
LEGISLATION
New Bill Could Mean Jail Time for Failing to Disclose Breaches Within 30 Days
A recently introduced bill proposes that executives who fail to report a data breach within 30 days could serve up to five years in prison. The Data Security and Breach Notification Act detailed how organizations should be securing Social Security numbers, credit card data and other personally identifiable information.
CRYPTOCURRENCY
President Trump Authorizes Blockchain Study
A $700 billion military spending bill was authorized by President Donald Trump this week that includes a mandate for blockchain cybersecurity research. The bill calls for the Department of Defense to look into “potential offense and defensive cyber applications of blockchain technology and other distributed database technologies.”
DATA LEAK
Database Containing 1.4B Credentials Found on Dark Web
A database containing 1b4 billion plain text credentials has been discovered on the Dark Web by security researchers with 4iQ. A single 41-gigabyte file contains all of the usernames and passwords. Of the records, 14% of the passwords (200 million) had not previously been circulated in the clear, according to the company which specializes in monitoring Dark Web sites, hacker forums, and online black markets.
EMAIL SPAM
New Ransom Email Spam Threatens Victims With Death
A new email spam campaign is threatening victims to pay up or risk losing their lives. Discovered by an employee at IT firm Spiceworks, the message’s subject line reads, “Please read this it can be the most important information in your life.” The perpetrators behind the emails - which claim to be from hitmen - ask for 0.5 Btc, which equates to roughly $8,500 given Bitcoins current value. If the money is not paid, the message states that the victims will become the sender’s “prey.”
CYBER THEFT
Russian Cybercriminal Group Exposed by Researchers
A cybercriminal collective hailing from Russia has been exposed by security researchers at Group-IB. The group stole at least $10 million from financial institutions in the U.S., U.K., and Russia by targeting card processing systems and interbank transfer systems. Dubbed MoneyTaker, the group launched more than 20 successful attacks between May 2016 and November 2017.
VULNERABILITY
Experts Discover 19-Year-Old Flaw in TLS Stacks
A team of security researchers has discovered that vendors’ TLS implementations may be vulnerable to a 19-year-old security flaw. The flaw was first discovered in 1998 during the infamous Bleichenbacher oracle attack. The vulnerability allows malicious actors to log and decrypt a TLS server’s RSA-encrypted traffic. The researchers dubbed their work the “Return of Bleichenbacher’s Oracle Threat” (ROBOT).
