Security News Update for the Week Ending August 11, 2023

Police Don’t Know Who Accessed Data Posted in Error

This is somewhat hard to believe while at the same time all too common. Would your company do any better. Police in Northern Ireland posted the entire country’s police roster in response to a freedom of information request – by accident. Even though they took it down, they don’t seem to know who/if anyone accessed it. Credit: The Register

No Honor Among Thieves

Two North Korean hacking groups hacked Russian missile and satellite maker NPO Mashinostoyeniya for close to a half year. I thought they were on the same side? Right now it is unclear who needs who more, given the war in Ukraine, but I can’t imagine Putin is happy. As in other situations right now, Putin may have to grit his teeth. Credit: The Register

Multiple Banks Fined $500+ Million for Using iMessage, Signal

Financial institutions, brokers, government agencies and others are required to retain communications. The Securities and Exchange Commission and the Commodities Futures Trading Commission fined a number of banks because they were using apps like iMessage for business and could not produce those messages for an audit, as required by law. The banks, collectively, are coughing up $549 million. Don’t be surprised if more fines follow and also don’t be surprised if auditors start asking questions you can’t answer about the use of messaging apps that don’t comply with the law. Credit: The Verge

Hosting Provider Cloudzy Accused of Hosting LOTS of Illegal Traffic

Depending on whether you think they are crooks or dumb, apparently 50% +/- of the traffic that they host is illicit purposes. One possibility is that their “know your customer” process is flawed. Another possibility is “you can pay in bitcoin and we ask no questions”. While they have offices in Wyoming and Cypress, it is like a front for Iran. What is the government going to do? Credit: Data Breach Today and The Record

CISA Says PC Makers Should Use Security By Design for UEFI

In light of all of the recent issues with the “formerly-thought-to-be-secure ” boot loader process, CISA is calling for PC makers to improve the security for updating their boot loader software. The boot load is the beginning of a chain-of-trust for securing computers, no matter the operating system. If it is not secure, then nothing afterwards is secure either. CISA is saying that Microsoft has still not completely fixed the Black Lotus UEFI boot loader security. While Microsoft is the current villian, they are certainly not the only one. Credit: Dark Reading

by