Weekly Axis Of Easy #256
Last Week’s Quote was “I put my heart and my soul into my work, and have lost my mind in the process.” Tricia got it right with Vincent Van Gogh!
This Week’s Quote: “Men, it has been well said, think in herds; it will be seen that they go mad in herds, while they only recover their senses slowly, and one by one.” … by ???
THE RULES: No searching up the answer, must be posted to the blog – the place to post the answer is at the bottom of the post, in the comments section.
The Prize: First person to post the correct answer gets their next domain or hosting renewal on us and as a bonus gift this week the winner will also get a code for a free audiobook of Charles Hugh Smith’s latest book, on coping with burnout.
In this issue:
- Verified Twitter Vulnerability Exposes Data from 5.4 Million Accounts
- A “massive cyber-attack” hits the Albanian government
- Apple has settled the Butterfly Keyboard case for $50 million
- Researchers at MIT have detected a mysterious radio signal from a distant galaxy
- Thai activists’ iPhones have been hacked by Israeli Pegasus spyware
- Russia fines Google $358 million for not removing banned info
- Rogers Outage Update: A Coding Error
- NameCheap Defi Customers attacked
Elsewhere online
- The California Social Media Bill violates the First Amendment
- Malware found in several new Play Store apps, including Joker, Facestealer, and Coper
- Meta’s lawsuit illustrates social enterprises’ empty promises
- NSO, the maker of Pegasus spyware, is lobbying to be removed from the U.S. blacklist
- Hacking group are targeting Belgium’s defense and interior ministries
Verified Twitter Vulnerability Exposes Data from 5.4 Million Accounts
A bug report of a serious vulnerability was reported back on January 1st by a HackerOne (popular hacking forum) user “zhirinovskiy.”
“This is a serious threat, as people can not only find users who have restricted the ability to be found by email/phone number, but any attacker with a basic knowledge of scripting/coding can enumerate a big chunk of the Twitter user base unavailable to enumeration prior (create a database with phone/email to username connections). Such bases can be sold to malicious parties for advertising purposes, or for the purposes of targeting celebrities in different malicious activities.”
As it usually happens, someone seems to have exploited the vulnerability before Twitter fixed it and as of July 22nd, it was still available.
By July 24th, Twitter has confirmed they’re investigating the situation.
Read: https://restoreprivacy.com/twitter-vulnerability-exposes-5-million-accounts/
A “massive cyber-attack” hits the Albanian government
The Albanian government has been hit with a “massive cyber-attack,” forcing its websites offline. It has emphasized that all citizens’ data stored on its website is “safe and intact” and that it is working with experts from Microsoft and the US-based Jones Group International to restore service.
According to a government statement shared with local media outlets, the incident was caused by a coordinated “attack from abroad.” The statement explained: “To prevent this attack from affecting our information system, the National Agency of Information Society temporarily shut down online services and government websites.”
Several digital services of the Albanian government were attacked by what is believed to be a cyberattack linked to the EU’s opening of accession talks with Albania and North Macedonia. Oliver Pinson-Roxburgh, CEO of Defense.com, believes that a nation-state actor is most likely behind the attack. Oliver Pinson-Roxburgh, CEO of Defense.com, believes that a nation-state actor is most likely behind the attack.
The Albanian government, however, could be a tempting target for multiple threat actors, says Todd Carroll, CISO at CybelAngel: “Albania has a history of data security issues that are only exacerbated by the over-collection of its citizen’s data, compared with those countries subject to EU standards. So, it is not surprising that they are under attack. Once you lose access to your data, you lose the ability to determine ‘how access was gained’ and ‘what was accessed or is being accessed.”
Read: https://www.infosecurity-magazine.com/news/albanian-government-massive-cyber/
Apple has settled the Butterfly Keyboard case for $50 million
Apple has settled a class action lawsuit over unreliable butterfly keyboards in some MacBook models and will pay out $50 million to customers who purchased the devices between 2015 and 2019.
Apple’s butterfly keyboards were ultrathin and prone to breaking. The move to butterfly keys came at the height of the former Apple chief design officer Jony Ive’s tenure when the company’s design philosophy held slim and sleek beauty above all else.
Apple’s butterfly keyboards drew the most ire, and the company was hit with two class actions in the same month in 2018. After several expensive repairs, Apple ditched the keyboards and returned to building computers that made sense for most users.
The settlement for the butterfly suit is estimated to be $50 million, but Apple hasn’t acknowledged any wrongdoing. Owners of eligible MacBooks who bought their computers in California, Florida, Illinois, Michigan, New Jersey, New York, or Washington, DC will receive compensation.
Read: https://www.wired.com/story/apple-butterfly-keyboard-settlement-50-million/
Researchers at MIT have detected a mysterious radio signal from a distant galaxy
Astronomers have detected an unusual radio signal from a far-off galaxy. MIT officials have detected a fast radio burst from a far-off galaxy that lasted up to three seconds and included bursts of radio waves every 0.2 seconds, something uncommon as these signals usually last for a few milliseconds at most.
The Canadian Hydrogen Intensity Mapping Experiment (CHIME), a radio telescope in British Columbia, Canada, detected the fast radio burst (FRB) on Dec. 21, 2019. MIT said that the burst was the longest-lasting FRB, with the clearest periodic pattern seen to date.
The origin of fast radio bursts is uncertain, but astronomers suspect the signal could come from a radio pulsar or magnetar, two types of neutron stars. The source is located in another galaxy, several billion light-years from earth.
Thai activists’ iPhones have been hacked by Israeli Pegasus spyware
In Thailand, cyber attacks on human rights groups have become more sophisticated when it comes to target activities. Around 30 Thai activists and supporters were hacked using NSO Group’s powerful Pegasus spyware, according to Thai legal rights watchdog iLaw and Toronto-based Citizen Lab.
Most victims of hacking were dissidents who demanded reforms in the monarchy and participated in the pro-democracy movement. The list includes lawyer-activist Arnon Nampa, rapper Dechatorn Bamrungmuang aka Hockhacker, student activist Panusaya Sithijirawattanakul, actress-activist Inthira Charoenpura, and academic Prajak Kongkirati.
A report by iLaw claims that the tool was used during protests in 2020-2021, where protestors demanded the resignation of Thai Prime Minister Prayuth Chan-ocha. The hack was revealed after Apple informed victims that their phones had been infected with the spyware.
Earlier reports stated that Thai recipients received warning messages in November 2021, prompting them to contact civic organizations, which helped locate other victims. Interestingly, it is the first time that Pegasus spyware has been used against citizens of Thailand.
Read: https://www.hackread.com/iphones-activists-thailand-hacked-israeli-pegasus-spyware/
Russia fines Google $358 million for not removing banned info
A court in Moscow has fined Google LLC $358 million for failing to restrict access to information considered prohibited in the country. Roskomnadzor, Russia’s internet watchdog, recently announced that Google, along with its YouTube subsidiary, has not removed the following materials despite repeated requests:
-
Discrediting information about the “special military operation” in Ukraine.
-
Terrorism-related content.
-
Content that promotes harmful activities for the health and well-being of minors.
The Roskomnadzor fined Google LLC 68 million rubles ($1.2 million) for failing to remove prohibited information from Google Search and YouTube. The fine could reach 10% of the firm’s annual turnover. Following the Russian invasion of Ukraine, Google’s Russian subsidiary filed for bankruptcy, and its non-paid services are still accessible, but advertising campaigns are not available.
Rogers Outage Update: A Coding Error
The telecommunications company has one core network that provides all their services. They began upgrading that core network back in February of 2022 with a seven phase process.
Weeks later, a full account was given to CRTC, which were disclosed Friday in redacted form.
On July 8th, at 2:27am ET, the 6th phase began. Two hours and sixteen minutes in, a piece of code was introduced that deleted a routing filter.
“Deleting the filter caused all possible routes to the internet to pass through the routers, resulting in several of the devices exceeding their memory and processing capacities. This caused the core network to shut down.“
It took most of the day to restore services, starting with the wireless service, since the technicians had to figure out a way to communicate with each other, eventually swapping their SIM cards to Bell or Telus SIMs.
There will be a hearing in front of the House of Commons, who are studying the outage.
Rogers offered a five-day billing credit to compensate its customers “for the inconvenience” it has caused.
Read: https://www.theglobeandmail.com/business/article-how-a-coding-error-caused-rogers-outage-that-left-millions-without/
NameCheap Defi Customers attacked
Seems there’s no a shortage of bad actors looking for ways to scam the system. In this case social engineering was used to gain access to DNS settings at NameCheap.
Somehow a customer service rep’s credentials were used to change DNS zone files thereby approving malicious smart contracts that resulted in a loss of roughly $350,000USD at the time.
Read: https://domainsure.com/news/namecheap-defi-customers-attacked/
Elsewhere Online
The California Social Media Bill violates the First Amendment
Malware found in several new Play Store apps, including Joker, Facestealer, and Coper
https://thehackernews.com/2022/07/several-new-play-store-apps-spotted.html
Meta’s lawsuit illustrates social enterprises’ empty promises
https://www.wired.com/story/social-enterprise-technology-africa/
NSO, the maker of Pegasus spyware, is lobbying to be removed from the U.S. blacklist
https://www.propublica.org/article/pegasus-spyware-nso-israel-blacklist-lobbying
Hacking group are targeting Belgium’s defense and interior ministries
https://www.securityweek.com/belgium-says-chinese-apts-targeted-interior-defense-ministries
Previously on #AxisOfEasy
If you missed the previous issues, they can be read online here:
- July 18th, 2022: CRTC Chair Ian Scott Confirms Bill C-11 Can Be Used To Pressure Internet Platforms To Manipulate Algorithms
- July 12th, 2022: Apple Debuts Lockdown Mode to Prevent State-Sponsored Spying
- July 4th, 2022: Ending Freedom Of The Press, Speech, And Expression: The Main Goal Of Big Corporations
- June 27th, 2022: Scammers Can Steal Your Selfies For NSFW Purposes On Instagram
- June 20th, 2022: Facebook Messenger Scam: Millions Deceived
The quote “Men, it has been well said, …”: Charles Mackay, from his book “Extraordinary Popular Delusions and the Madness of Crowds” I read this long ago, but it sounds like it may have come from that book.
One I actually knew, but Dale beat me to it: that quote did indeed appear in Charles Mackay’s “Extraordinary Popular Delusions and the Madness of Crowds” from the 1800s (not to be confused with Douglas Murray’s more recent “Madness of Crowds: Gender, Race and Identity”). Mackay’s observations is as true today as it was in the 1800s.