Episode 118 - We should have taken a summer holiday

The Host Unknown Podcast

This week in InfoSec: (The one and only):

23rd August 2006: SpoofCard confirmed that Paris Hilton was among the terminated customers, and that Lindsay Lohan was among those whose voicemail accounts were broken into. SpoofCard said it had implemented controls to prevent recurrences.

Paris Hilton: Master Hacker?

https://twitter.com/todayininfosec/status/1297213638059728896

26th August 2008: It was reported that a laptop on the International Space Station was infected by removable media containing the http://W32.Gammima.AG worm.

Space. Where you don't want to be dealing with malware.

Malware detected at the International Space Station

https://twitter.com/todayininfosec/status/1298690676448735232

Rant of the Week:

Block sued after ex-staffer siphons customer data

Block – the digital payments giant formerly known as Square – faces allegations it failed to take adequate measures to protect customers' personal information.

A lawsuit, filed Tuesday in a federal district in Oakland, California, on behalf of two users of Cash App, operated by Block subsidiary Cash App Investing, claims the company failed to implement reasonable security. As a result, a former employee was able to download internal reports containing personal information after leaving the firm.

Coincidentally, Twitter – another venture co-founded by Block Head Jack Dorsey – was accused of subpar security by its former security chief in a recent whistleblower complaint.

Block disclosed the December 10, 2021 data theft on April 4, 2022, and stated it was contacting 8.2 million current and former customers about the privacy snafu. The biz said, "a former employee downloaded certain reports of its subsidiary Cash App Investing LLC … that contained some US customer information."

The employee had access to those reports while employed but in this instance downloaded the files after leaving the company. The data obtained included customers' full name and brokerage account numbers, and in some cases, brokerage portfolio values, brokerage portfolio holdings and/or stock trading activity for one trading day.

As far as the litigants are concerned, Block didn't meet its security obligations, failed to notify customers in a timely manner, provided too little information about the incident, and failed to offer credit or identity monitoring services.

Billy Big Balls:

Lloyd's to exclude certain nation-state attacks from cyber insurance policies

Lloyd's of London insurance policies will stop covering losses from certain nation-state cyber attacks and those that happen during wars, beginning in seven months' time.

In a memo sent to the company's 76-plus insurance syndicates, underwriting director Tony Chaudhry said Lloyd's remains "strongly supportive" of cyber attack coverage. However, as these threats continue to grow, they may "expose the market to systemic risks that syndicates could struggle to manage," he added [PDF], noting that nation-state-sponsored attacks are particularly costly to cover.

Because of this, all standalone cyber attack policies must include "a suitable clause excluding liability for losses arising from any state-backed cyberattack," Chaudhry wrote. These changes will take effect beginning March 31, 2023 at the inception or renewal of each policy.

At a minimum – key word: minimum – these policies must exclude losses arising from a war, whether declared or not, if the policy doesn't already have a separate war exclusion. They must also at least exclude losses from nation-state cyber attacks that "significantly impair the ability of a state to function or that significantly impair the security capabilities of a state."

Industry News:

Counterfeit Android Devices Revealed to Contain Backdoor Designed to Hack WhatsApp

Ex-Security Chief Accuses Twitter of Cybersecurity Negligence

Facebook Bug Causes Users’ Feeds to Be Spammed

Plex Suffers Data Breach, Warns Users to Reset Passwords

Scammers Create 'AI Hologram' of C-Suite Crypto Exec

Workplace Stress Worse than Cyber-Attack Fears for Security Pros

US Firm Pays $16m to Settle Healthcare Fraud Claims

Talos Renews Cybersecurity Support For Ukraine on Independence Day

Microsoft Attributes New Post-Compromise Capability to Nobelium

Tweet of the Week:

https://twitter.com/J4vv4D/status/1562775110544949248?s=20

Come on! Like and bloody well subscribe!