U.S. bans Huawei, Hikvision, ZTE, and Dahua / Dropbox acquires Boxcryptor / French national energy provider hit with $619K fine over weak passwords

Plus: North Korean hackers are using a new malware named Dolphin to attack South Korea

Inside.com Part of   Network November 30, 2022

Presented by

The U.S. has banned the sale and importing of Huawei, Hikvision, ZTE, and Dahua equipment due to several national security risks. This ban will be implemented by the FTC.  More: The U.S. previously accused companies such as Huawei of stealing intellectual property and research and development data and planting backdoors in their products that would potentially allow China to spy on U.S. institutions and citizens. On the other hand, Hikvision’s cameras have been named as potentially liable for the oppression of Uyghurs and other Muslim minorities in China’s Xinjiang province. This sentiment was shared by many European countries, but some of them were unable to implement a full ban due to their dependence on China-made devices for their telecommunication and internet services. In 2019, an executive order from then-President Donald Trump put Huawei on the banned company list. In 2020, the FCC ordered all U.S. telecom companies to stop using equipment from Chinese manufacturers such as Huawei and ZTE and began efforts to revoke China Telecom’s authorization to operate in the United States. The ban on these Chinese companies is effective for all parent companies as well as their subsidiaries. All four FCC members voted unanimously to adopt the new measures against these Chinese tech firms.

Dropbox is acquiring Germany-based cloud storage encryption company Boxcryptor for an undisclosed amount. Boxcryptor stated that its data location and employee contracts will remain unchanged. More: Boxcryptor was founded in 2011, a time when cyberattacks were not as common as they are today. The company was able to successfully predict that consumers would want more security for their cloud-based files, requiring encryption-level measures in order to feel that they are taking good care of those files.  Dropbox confirmed the thesis, stating that its customers have been clear in their demand for better encryption for their files, leading it to acquire Boxcryptor. The U.S.-based company has over 700 million users who utilize it for both individual and enterprise use. Its plans vary from $9.99 per month with 2TB of space up to customizable plans based on the requirements that an enterprise has. Zoom Out: A few weeks ago, Dropbox confirmed that a threat actor had managed to steal several lines of source code that were found in a GitHub repository. According to the company, the threat actor did not manage to steal sensitive data.

A message from SECURITY COMPASS The only secure developer training that is accredited by (ISC)²  Our role-based, language-specific, secure developer training meets developers where they are in their knowledge and learning style to ensure they successfully develop and apply secure coding skills. Go beyond secure coding training. Retain talent, remain competitive, and stay compliant. We offer over 49 courses covering topics including: ● Defending AWS, .NET, Angular, Java, and more ● DevSecOps Fundamentals and DevSecOps for Managers ● Defending Containers, Kubernetes, Docker ● Secure Software Requirements, Design, Testing Explore language-specific, role-based, (ISC)² accredited secure developer training.  Visit our page to browse our curriculum, try a free course, or speak to the team. Browse our curriculum

The national French electricity provider company, Électricité De France, has been fined $619,000 by the national regulator authority for causing 25,000 passwords to be hacked due to weak security methods. The electricity company used an algorithm known as MD5, which has been considered cryptographically broken since 2008. More: EDF France is owned mainly by the French state. The energy company produces over 120 gigawatts of electricity and operates tens of nuclear plants. The MD5 message-digest algorithm is a cryptographically broken hash function. Even though the cryptographic tool has been considered out of use since 2008, when it was first breached, some companies still use this hashing, resulting in severe security risks. To make matters worse, the company did not use salting, a cryptographic method used to store passwords securely. Salting creates a unique hashing for each password, decreasing the chances of getting hacked. Zoom Out: The MD5 algorithm was used in two of the worst security breaches in history. In 2013, over 100 million usernames and passwords were hacked using a weakness in the MD5 algorithm. The information was stolen from Badoo. In another attack in 2017, 92 million passwords were hacked as a result of a company using the same algorithm to hash user data.

North Korean hackers are using a new malware named Dolphin to attack South Korea. ScarCruft hacker group is believed to be the threat actor behind this cyberattack campaign. More: ScarCruft, also known as APT37 or Reaper, is an espionage group that has been operating since at least 2012. It primarily focuses on South Korea, but it has been tracked attacking other countries in Asia as well. This backdoor has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging, taking screenshots, and stealing credentials from browsers.  Dolphin does not have a wide attack surface and is deployed only on a select few. The malware searches the drives for files of interest and then exfiltrates them to Google Drive. The backdoor was used as the final payload of a multistage attack in early 2021. The attack involved a South Korean online newspaper. Zoom Out: North Korean threat actors have been active in recent years. In early 2022, infamous hacker group Lazarus Group stole more than $600M worth of cryptocurrencies from Axie Infinity.

A message from GUN.IO If you could work with a senior developer for free for three months, what could you accomplish? Gun.io is hosting a pitch competition (pre-recorded, so no live stage jitters) this month to give you a chance to do just that.  Simply record your pitch in Rhetoric and submit it by November 21.  Pitches will be judged by a panel of senior developers, and all participants will receive feedback on their pitches from the developer's perspective. Pitches should: Describe the problem you're solving Demonstrate your 3-6 month product roadmap Appeal to developers The winner will have three months of full-time work with a senior dev fully paid for by Gun.io (estimated worth $60,000USD)—worth a shot, right? Apply Now

Open Systems has acquired U.K. startup Tiberium to bring its unique collaboration model to the cybersecurity industry. Tiberium's system is based on Microsoft's security solutions. More: Tiberium specializes in on-chip security, a field that pertains to the security of IoT devices and other physical devices that rely on chips to operate. The company uses proprietary AI technology to automate processes that may pose a threat to a user's security. Its automation feature is able to expedite Tier 1 alerts, enabling security professionals to focus on more important tasks.  Open Systems claims that what made Tiberium differentiate itself from the competition is not only the fact that it combines Microsoft Teams with GPT-3 but that it allows companies to interact with their users in real time across any device. Open Systems is a five-time Microsoft Security Gold Partner, providing security for 10,000 locations worldwide. The Switzerland-based company was founded in 1990, while Tiberium was founded in 2015.

Quick Hits: HubSpot and Brandwatch partnered this year to survey over 1,000 individuals across the U.S. to better understand consumer purchasing habits, thoughts, and behaviors.* Healthcare-focused software solutions company CloudWave has acquired Sensato Cybersecurity, a company that offers cybersecurity defense services for healthcare organizations. The terms of the deal remain undisclosed. Three-quarters of businesses are planning to reduce the number of security vendors they use, according to reports. The Australian government has passed a bill that could see companies be fined up to $34M if they are repeatedly breached by ignoring security protocols. Google has published three newly tracked security flaws that each affect different browsers. The malware is spread by downloading infected files, an action that initiates a one-click infection chain. Tech innovation is surging in education, finance, health care, and other industries. See what your competitors are building with Crowdbotics.* *This is sponsored content.

Upcoming events at Inside: January 10 - Inside Startups Coffee Break (Register Here) January 17 - Inside Marketing Coffee Break (Register Here) January 31 - Growth Summit'23 (Register Here)

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass delivers best-practice, role-based, accredited eLearning solutions.

Try Gun.io: the simplest way to hire world-class developers, expertly matched to you by senior engineers.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.