December 21, 2020
David Redekop

This Week In Nerd News – December 21, 2020

Your weekly top 5 technical and security issues Nerds should pay attention to:

YouTube video

Dozens of journalists’ iPhones hacked with NSO ‘zero-click’ spyware, says Citizen Lab.

I know this is starting to sound like it’s the same song over and over. Same with the mitigation. Effective egress control is the only mitigation.

The spyware was silently delivered, likely over iMessage.

 

Read More: Dozens of journalists’ iPhones hacked with NSO ‘zero-click’ spyware, says Citizen Lab

 

Microsoft is reportedly added to the growing list of victims in SolarWinds hack.

In response to the report, Microsoft said it had detected a backdoored version of SolarWinds software in its network but had uncovered no evidence it was used to compromise the company’s production system or access customer data

Other reported victims include the Energy Department nuke security administration.

 

Read More: Microsoft is reportedly added to the growing list of victims in SolarWinds hack

 

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor.

This is the most important story of the week. The most important story of 2020.

FireEye has uncovered a widespread campaign, that we are tracking as UNC2452. The actors behind this campaign gained access to numerous public and private organizations around the world. They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software. This campaign may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft. The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security.

 

Read More: Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

 

Apple’s App ‘Privacy Labels’ Are Here—and They’re a Big Step Forward.

It remains unclear how effective the warnings will be, but the attempt alone is a promising development.

Read More: App privacy details on the App Store

 

Facebook tracks ‘OceanLotus’ hackers to IT firm in Vietnam.

The announcement on Friday is the first time Facebook has publicly exposed an offensive hacking operation and, if confirmed, would be a rare case of suspected state-backed cyberspies being tracked to a specific organisation.

Cybersecurity investigators at Facebook have traced a hacking group long suspected of spying on behalf of the Vietnamese government to an IT company in Ho Chi Minh City.

 

Read More: Facebook tracks ‘OceanLotus’ hackers to IT firm in Vietnam

 

Did you know?

Finally, there’s true E2E (End to End) encryption for group video calling in Signal: Signal adds support for encrypted group video calls

Need an IT professional? Request service today.