The Truth: Cisco Router Vulnerabilities, DNA Database Startup Hacked, Wikipedia Article of Disgraced Spiegel Journalist Doctored
Friday, 8 November 2019
It’s the last day of the work week and here are some tech news for you to take into the weekend.
Several small business router models made by Cisco use hardcoded password hashes and duplicate certificates which makes it easy for attackers to break into these devices. If you are running an RV320 or RV325 router, you should update to firmware version 1.5.1.05 or later. If you are using any of the following router models, you should update to firmware version 4.2.3.10 or later: RV016, RV042, RV042G and RV082.
Heads-up: “It has been revealed that Adobe’s Experience Platform mobile SDKs, used to create apps that interact with the company’s cloud services, until recently contained sample configuration files that created insecure default settings. Developers creating apps that utilize those files as templates or examples could find that their apps have been sending data over the network without SSL protection, making it vulnerable to interception and alteration.” Doesn’t sound like Adobe wants to fix this any time soon.
Anti-virus manufacturer Trend Micro has disclosed that one of their employees has sold customer support data to phone scammers. “In early August 2019, Trend Micro became aware that some of our consumer customers running our home security solution had been receiving scam calls by criminals impersonating Trend Micro support personnel. The information that the criminals reportedly possessed in these scam calls led us to suspect a coordinated attack. Although we immediately launched a thorough investigation, it was not until the end of October 2019 that we were able to definitively conclude that it was an insider threat. A Trend Micro employee used fraudulent means to gain access to a customer support database that contained names, email addresses, Trend Micro support ticket numbers, and in some instances telephone numbers. There are no indications that any other information such as financial or credit payment information was involved, or that any data from our business or government customers was improperly accessed. Our investigation revealed that this employee sold the stolen information to a currently unknown third-party malicious actor.” Wow, pretty embarrassing, that one.
People keep asking me if I would want my DNA sequenced by a company. Hey, it’s pretty cheap and so cool! Why not do it? Here’s why: “DNA-testing firm Veritas Genetics experienced a security breach that included customer information”, Bloomberg reports. “Veritas, which sells whole-genome sequencing for $599, said it became aware that a customer-facing portal had been recently”accessed by an unauthorized user. The company said that the portal didn’t contain genetic data, DNA-test results or health records.” Uh-huh. I’m sure those were on systems that are actually secure. What are the chances… The problem with having your DNA out there is that you can’t change it after a breach like you can change a passwort. If it’s ever used for authentication, or someone invents a way to easily replicate it from this kind of data, you’re fucked.
Dart 2.6 has been released. According to The Register, the new version of Google’s JavaScript competitor includes “the ability to create self-contained, native executables for the major desktop operating systems.”
In the US, employees for surveillance equipment manufacturer Aventura Technologies have been arrested because the company is accused of rebranding Chinese-made surveillance gear as US-made products. “It is alleged Aventura imported cheap cameras and network-enabled security gear from vendors in China, then rebranded the equipment as being made by Aventura at its factory in Long Island, NY. In addition to lying about the products being made in America, it is alleged Aventura owner Jack Cabasso falsely represented his wife Frances as being the owner and CEO of the company in order to get government contracts earmarked for women-owned small businesses.” Wow. What a shitshow.
In Germany, someone has been messing with the Wikipedia article of disgraced Spiegel journalist and fraudster Claas Relotius (here’s his English Wikipedia page). Apparently coordinated attempts were made to make his article shine a more positive light on him. As Heise reports (German), one IP address in particular had registered a whole number of accounts that were making some of these edits. This IP was, Heise says, localised in the municipality of Seevetal in Lower Saxony. Relotius' hometown of Tötensen is part of this municipality. There is already talk of this being “one of the biggest manipulations in the German language version of Wikipedia ever.”
Anyway, I’ll take a cue from Mark Knopfler. And I’m picking my way out of here, one song at a time. See you on Monday!
This is an archived issue of my daily newsletter FOXTROT/ALFA. You can find more information about it, including how to subscribe via email, on this page.