TWINN #107 Ditching encryption for exfiltration
Article Contents
Heraclitus, a Greek philosopher, once said, “Change is the only constant in life.” This is certainly the case in the world of IT and cyber security. Keeping up with new criminal tactics and strategies is now the full-time career of many. This is out of necessity as we have no choice but to keep making criminal behavior more difficult and expensive for all threat actors.
The latest behavior change is noteworthy and appears to be in response to criminal returns not being what they used to be, perhaps because recovery methods and incident response processes allow victims to get back to business without paying the ransom.
However, data exfiltration can still be extorted.
The 5 Top Cyber Security Stories Of The Week – January 16, 2023
Ransomware gangs are starting to ditch encryption. The threat of having sensitive data released or sold on the dark web is still a way to for criminals to be paid.
CISA Warns for Flaws Affecting Industrial Control Systems from Major Manufacturers. The big takeaway for us and our clients is that public-facing services need to be carefully audited. Port forwards are literally dangerous to perform these days. Patching isn’t good enough; we need to apply zero trust to everything, but especially industrial control systems.
Microsoft Patch Tuesday: 97 Windows Vulns, 1 Exploited Zero-Day. Yes, that’s 97 of them. Given the many risks we face in updating Windows systems quickly vs the risk of not updating quickly, it requires careful evaluation and application.
Identity Thieves Bypassed Experian Security to View Credit Reports. Given how easy Experian made it to get anyone’s credit by just knowing name, address, date of birth, and Social Security number (information often obtainable from leaked sites), no wonder real-life identity theft is still such a major problem.
ChatGPT is enabling script kiddies to write functional malware. Why have we unleashed this? In computer science, it’s often just because “Well, because we could.” Now we’ll have to consider mitigations against a brand new set of threats.
Did you know?
AI in your family photos can be very helpful, especially on older photos. The app is available for both Android and iOS and Google is transparent enough with their privacy policy that it can be used without them keeping your data. Enjoy!
