As a cybersecurity professional, I appreciate the impact that cyber policy can have on the adoption of and effective utilization of technology. We see this working today in very advanced, mature industries. In the automotive industry, policies around safety for instance, have done wonders to reduce the number of injuries resulting from an accident. Likewise, policies for manufacturing and chemical production help reduce the risk associated with handling dangerous chemicals.
2.5 Million Impacted by Data Breach at Nelnet Servicing
The data of more than 2.5 million individuals was compromised in a recent data breach at technology services provider Nelnet Servicing.
The impacted individuals have taken student loans from Edfinancial and OSLA, which have contracted Nelnet for various services, including an online portal that student loan borrowers can use to access their accounts.
Chinese Hackers Target Energy Firms in South China Sea
The Chinese APT known as TA423 (aka Red Ladon, APT40 and Leviathan) has been operating a cyberespionage campaign across Australia, Malaysia and Europe. The campaign has had three distinct phases – the latest from April 2022 to mid-June 2022. The primary targets have been Australian organizations and energy exploration in the South China Sea.
Google Launches Bug Bounty Program for Open Source Projects
Google today introduced a new bug bounty program to reward security researchers who discover and report vulnerabilities in the company’s open source projects.
As part of the new Open Source Software Vulnerability Rewards Program (OSS VRP), Google is offering bug bounty payouts of up to $31,337. The lowest vulnerability reward will be $100.
FBI Warns of Surge in Attacks Targeting DeFi Platforms
The FBI is warning of an increase in attacks targeting decentralized finance (DeFi) platforms to steal cryptocurrency.
According to the agency, miscreants are taking advantage of the increased interest in cryptocurrency and the complex functionality and the open source nature of DeFi platforms to perform nefarious activities.
Pwn2Own Offers $100,000 for Home Office Hacking Scenario
Trend Micro’s Zero Day Initiative (ZDI) has announced the targets and prizes for its next Pwn2Own hacking competition, as well as the introduction of a new category that aims to simulate a real world home office environment.
Elon Musk Subpoenas Twitter Whistleblower Ahead of Trial
Elon Musk’s legal team is demanding to hear from Twitter’s whistleblowing former security chief, who could help bolster Musk’s case for backing out of a $44 billion deal to buy the social media company.
FTC Accuses Data Broker of Selling Sensitive Location Data
Federal regulators have sued a data broker they accuse of selling sensitive geolocation data from millions of mobile devices, information that can be used to identify people and track their movements to and from sensitive locations, including reproductive health clinics, homeless shelters and places of worship.
Okta Impersonation Technique Could be Utilized by Attackers
Okta has a standard process that can be abused for nefarious purposes. The legitimate method for changing credential details within Okta (for example, if a person gets married and changes her last name and adopts a new email address) can be misused by an attacker to impersonate another existing user.
Galois Open Sources Tools for Finding Vulnerabilities in C, C++ Code
Galois, a firm specialized in the research and development of new technologies, has open sourced a suite of tools for identifying vulnerabilities in C and C++ code.
Dubbed MATE, the tools are the result of a collaborative effort supported by the United States Air Force and Defense Advanced Research Project Agency (DARPA).
