Microsoft finds severe TikTok security flaw / Twitter suffers outage weeks after data breach / Alloy raises $52M

Plus: A Chilean government agency gets hit by cyberattack

Inside.com Part of   Network September 01, 2022

Presented by

Microsoft has found a severe security flaw in TikTok. The flaw is a one-click exploit that has now been patched, according to TikTok. More: If exploited, the bug would have allowed hackers to take control of someone's TikTok account. The threat vector used to breach the victims was malware. This bug is being tracked as CVE-2022-28799  and has a CVSS score of 8.8. Clicking the link would take a user to a fake landing page where they're led to believe that TikTok is asking for special permission. Once the user clicks on that box, the malware is able to bypass security protocols and steal data such as messages, photos, and videos. Researchers believe that the flaw has been abused by hackers.

Twitter suffered an outage today. Users saw messages such as "Something went wrong. Try reloading." and "Uh, Oh, there was an error." More: Multiple Twitter users complained that they were not able to load the app.  Some users couldn't even connect to Twitter's servers. While Twitter has not publicly addressed the issue, the company faced a similar problem back in August. Zoom Out: Twitter suffered a data breach only three weeks ago. Over 5 million users had their data abused by threat actors.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work.  They are: Manual Inconsistent Take too long Don’t scale Don’t give developers what they need When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Download whitepaper bundle

Fraud prevention startup Alloy has reached unicorn status after a new $52M funding round. The company had previously raised $100M in a Series C. More: The $52M funding round was raised at a $1.55B valuation. Alloy's previous C round valued the company at $1.35B. The company has expanded to over 40 countries and regions, including North America, EMEA, Latin America, and APAC. The startup has more than 300 customers, such as Ally Bank, HMBradley, Gemini, Ramp and Evolve Bank & Trust, Brex, and Petal. Lightspeed Venture Partners and Avenir Growth co-led the round, while Canapi Ventures, Bessemer Venture Partners, Avid Ventures, and Felicis Ventures participated.

A Chilean government agency got hit by a cyberattack. The announcement came from Chile's national computer security and incident response team. More: Threat actors targeted Microsoft and VMware servers. The cyberattack enabled hackers to list removable devices for encryption and evade being detected by antivirus software. Hackers reached out to authorities, giving them a three-day window to pay a ransom in exchange for the stolen data. Researchers believe that the malware used to attack the government in Chile is able to severely damage VMs by brute-stopping them. This is similar to the methods that Conti ransomware has used in the past. The government in Chile has not named any suspects yet. The national computer security and incident response team also did not provide technical details regarding the cyberattack.

A message from SECURITY COMPASS This is your show developers! Come and interact with our panel through questions or advice on how we can all improve developer-centric threat modeling. What to expect: Earlier this year, Security Compass ran a survey that probed the mind of developers. During this webinar, we'll be discussing our findings with security experts who live in the developer and threat modeling space. What you will learn: The connection between developer user stories or requirements, coding, and threat modeling. How to keep up with the ongoing discovery of software weaknesses. Practical advice for developers is to stay current on threat modeling practices. When: September 14, 2022, at 11am EST Whether you are a developer, lead, architect, or thread modeler, this webinar will leave you with something to think about.  Register Here

Zilla Security has raised a $13.5M Series A. The company aims to protect companies from having unauthorized actors gain access to critical data. More: The round was led by Tola Capital and FirstMark Capital, with participation from Pillar VC. Zilla Security is based in Boston, Massachusetts. The company was founded in 2019 and currently employs 35 people. Zilla claims that it currently has over 60 customers.

Quick Hits: Fix your email overload for as little as $7.00 a month.* The creators of the BianLian ransomware have updated their C2, signaling that the group does not intend on stopping its campaign. The ransomware targets VPNs. Researchers have tracked close to 2,000 apps that contain AWS token data. If stolen, the data could cause harm to private Amazon accounts. The apps are active on Android and iOS. Apple has patched a Webkit flaw tracked as CVE-2022-32893. The bug had a CVSS score of 8.8 and was used to remotely control outdated iPhone operating systems. Amid the shifting landscape of embedded systems, developers turn to real-time operating systems when "good enough" isn't good enough.* *This is sponsored content.

Upcoming events at Inside: September 07 - AMA with Andrew Gazdecki (Founder of MicroAcquire) (Register Here) September 09 - AMA with Jay Ryan (U.S. Federal Government Program Manager at Security Compass) (Register Here) September 14 - What Do Developers Think of Threat Modeling? (feat. security experts from Security Compass, Dell, and Tricentis) (Register Here) * September 14 - AMA with Brian Dean (Founder of Backlinko) (Register Here) September 21 - AMA with Kristen Ruby (Founder of Ruby Media Group) (Register Here) September 28 - AMA with Leigh-Ann Buchanan (Founder of aīre ventures) (Register Here) October 05 - AMA with Ram Bartov (Chief Accounting Officer at TripActions)* (Register Here) October 12 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) October 19 - AMA with Zecca Lehn (Responsibly VC) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

Register to learn What Do Developers Think of Threat Modeling?

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.