Hackers are selling access to China-made surveillance cameras / LastPass has been breached / Privado raises $14M Series A

Plus: Hackers are targeting users who download pirated software

Inside.com Part of   Network August 26, 2022

Presented by

Hackers are selling access to China-made surveillance cameras that thousands of people use worldwide. Threat actors are exploring a security flaw that was tracked last year. More: The surveillance cameras are made from Hikvision, short for Hangzhou Hikvision Digital Technology. While the FCC has listed the company as a national security risk, the cameras are still purchased by U.S. customers. The security flaw hackers are using is tracked as CVE-2021-36260, a command injection vulnerability in the cameras' web server. This bug has a CVSS score of 9.8, making it a critical security danger for all sides involved.

Password management company LastPass has been breached. According to the company, hackers managed to steal source code and other key information. More: The breach is believed to have happened two weeks ago from unknown threat actors. LastPass stated that no user account passwords were breached. The company did not share information regarding the threat vector hackers used, its origin, or any other relevant information. LastPass claims that users do not need to change their passwords at the moment because no damage was done to user accounts. The extension has over 33 million users and had over $200M in revenue in 2021.

A message from QUANTUM Save Your Data Before It Needs Saving - Air-Gapped Protection: Reliable and Cost-Effective Paying a ransom may sound like the best case scenario: get your data back, make your customers feel worth it. But actually, it can affect your business in other ways and may, in some cases, be illegal. Make sure your systems are protected across the entire data lifecycle - and never pay a ransom again. You’re able to balance cost while maximizing efficiency. No one can stop ransomware or fully prevent it from taking place - but you can make sure you’re protecting your customers and your data by ensuring that there is a fully air-gapped solution. Request A Demo

Privado has raised a $14M Series A. The company aims to become the go-to tool for developers that want to comply with privacy laws. More: The Series A round was led by Sequoia Capital India and Insight Partners, with participation from Together Fund and Emergent Fund. Privado aims to use the fund to grow its team to 25 employees and improve its product. The company claims that it has signed six-figure contracts and already has revenue from clients. Its monetization model is based on the number of code repositories it scans.  Privado also aims to launch an open-source project soon.

Hackers are targeting internet users who download pirated software. The hacking campaign uses SEO to trick users into visiting malicious links. More: According to researchers, hackers are creating false pages that lead internet users to believe they are clicking on legitimate company links such as: Adobe Acrobat Pro 3DMark 3DVista Virtual Tour Pro 7-Data Recovery Suite MAGIX Sound Force Pro Wondershare Dr. Fone, etc. Users are then redirected to malicious sites such as: xproductkey[.]com allcracks[.]org prolicensekeys[.]com deepprostore[.]com steamunlocked[.]onegetmacos[.]org The files that users download are archives that have a password-protected ZIP file meant to evade detection. Hackers are using Redline stealer as a threat tool, a malware that can steal passwords, credit card data, bookmarks, cookies, cryptocurrency files and wallets, VPN credentials, computer details, etc.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work. They are manual, inconsistent, take too long, don’t scale, and don’t give developers what they need. When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who: Need to scalably model software threats Identify countermeasures Deliver secure and compliant code quickly Download here

Threat actors are replacing Cobalt Strike with the Sliver command-and-control framework. Microsoft researchers believe that this change in strategy has to do with organizations becoming better prepared to defend against Cobalt Strike.  More: Sliver is a C2 framework that was made public in 2019. The command-and-control framework is written in the GO programming language due to its range and deployment speed. In C2 attacks, hackers try to establish a connection between their device and the target. Once communication is established, the infected computer will carry out the commands from the attacker’s C2 server and may install additional software. By doing so, the attacker gains complete control of the victim’s computer. The malicious code then spreads to other computers, creating a network of infected devices known as a botnet. The framework is open-source and can be used as a toolkit. Threat actors that have recently deployed it include FIN12. The latter used the toolkit to deploy ransomware such as Ryuk, Conti, Hive, and BlackCat.

Quick Hits: Consumers want an instant and personalized content experience. Read How a Cloud-Native CMS Makes Content Delivery Faster and Easier..* Beverage companies are hiring more cybersecurity specialists, according to reports. This industry trend is likely tied to the rising number of cyberattacks against companies. Researchers believe that the U.S. budget increase for cybersecurity in 2023 will help improve cyber defense capabilities across all U.S. institutions and incentivize the private sector to innovate. The U.S. will spend $15.6B on cybersecurity in 2023. The Department of Homeland Security plans to evaluate all its contractors regarding their cybersecurity practices. The evaluation will be done by the DHS itself. TikTok has released a new cybersecurity toolkit. The release was done in partnership with Global Cyber Alliance and includes links to numerous videos that aim to educate users on good security practices. Give business gifts people actually want without going over budget. Explore our interactive catalog for this year's trends.* *This is sponsored content.

Upcoming events at Inside: August 30 - An overview of simulation and cloud tools in embedded software (Register Here) * August 31 - AMA with Sophia Amoruso (CEO at Business Class) (Register Here) September 07 - AMA with Andrew Gazdecki (Founder of MicroAcquire) (Register Here) September 09 - AMA with Jay Ryan (U.S. Federal Government Program Manager at Security Compass) (Register Here) September 14 - AMA with Brian Dean (Founder of Backlinko) (Register Here) September 21 - AMA with Kristen Ruby (Founder of Ruby Media Group) (Register Here) September 28 - Free Access to the Semantic Layer Summit with 30+ Enterprise Data Leaders (Register Here) * September 28 - AMA with Leigh-Ann Buchanan (Founder of aīre ventures) (Register Here) October 12 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

With Quantum, we shift the focus from accumulating data to making it work for you.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.