Lionsgate Play suffers data leak / Nexus banking Trojan could affect 450 apps / Irish food company Dole hacked

Plus: Chinese hackers are targeting Middle Eastern telecom companies

Inside.com Part of   Network March 23, 2023

Presented by

The Lionsgate Play streaming platform has suffered a data leak. Over 37 million users are believed to be affected. More: Researchers have found over 20GB worth of server data that contained nearly 30 million entries. The data leak has exposed the following data: subscribers’ IP addresses, device IDs, operating systems, and web browsers. Researchers also found unidentified hashes with logged HTTP GET requests, but they could not determine their exact purpose or usage. According to researchers, they could have been used as secrets for authentication or just user IDs.

A recently tracked Nexus Android banking Trojan could breach 450 financial apps. The Trojan is being rented to threat actors for $3,000 per month. More: The Nexus Trojan is being used as a Malware-as-as-Service. Nexus can target multiple banking and cryptocurrency targets by using overlay attacks and keylogging features to steal login credentials. Researchers claim that Nexus has been entirely written from scratch, but similarities between Nexus and the SOVA banking Trojan have been found. The malware also supports features to bypass both SMS-based and app-based two-factor authentication. Nexus doesn’t infect systems located in Russia. Experts believe that the Nexus Trojan is in the early stages of development.

A message from FORTE GROUP ChatGPT, "when it comes to whether 'ilities' should be prioritized in software engineering, who is right, the CTO or the CEO?" To learn the answer firsthand, join Forte Group on March 30th, 2023, for a virtual panel discussion, "The balance between business expectations and CTOs' software sustainability needs." A panel on how CTOs balance and prioritize non-functional requirements into their roadmap. We have lined up seasoned professionals in the room who drive the evolution from agile, excellent cloud migration, and test-driven-development to become what we refer to as modern engineering. Our expert panel, composed of experienced CTOs and business leaders and our special guest ChatGPT, will share their thoughts on 7 "ilities" that continue to be the source of conversation within engineering circles: Usability Maintainability  Scalability Availability  Extensibility Security Portability Take the opportunity to learn from experts in the field and gain valuable insights into the latest engineering trends! Register Now

Irish food company Dole has admitted its employee data has been stolen in a breach that occurred in February. Dole employs nearly 38,000 people across 30 countries. More: Researchers believe that the company was forced to shut down production plants in North America and halt deliveries to stores after being hit by the cyberattacks in February. Several clients complained that they were not able to find the shopping items that they wanted on the item list. The company stated that it has invested in its cybersecurity infrastructure in order to minimize the risk of being hit by similar campaigns in the future.

Chinese hackers are targeting Middle Eastern telecom companies with a hacking campaign named Operation Tainted Love. The hacking campaign has been active since early 2023. More: The infection chain begins by launching Microsoft Exchange servers to deploy web shells used for command execution. A successful breach enables hackers to conduct: cyberespionage credential theft, lateral movement, and data theft. Researchers believe that the threat actors responsible for this breach could be Gallium or APT41 due to the use of a common code signing certificate. APT41 has previously targeted telecommunication companies.

The U.K. government has launched a new cybersecurity plan for the NHS. The country's main health agency has been targeted by hackers several times in recent years. More: The U.K. government has stated that its goal is to help the health sector improve its cyber risk management, data protection, and incident response.  The British government has presented five main pillars for this plan: Identify where disruption will cause the greatest harm to patients, such as disruption to critical services, Unite the sector to take advantage of scale, tap national resources and expertise, and accelerate response, Ensure leaders are engaged, employees know the cybersecurity basics, and more security specialists are recruited, Embed security into emerging technology to better protect it from cyber threats, Support every health and care organization to minimize the impact of incidents and recovery time. The plan's implementation will be boosted by the Cybersecurity Assessment Framework, which has four objectives: manage risk, protect against attacks detect security events, and minimize the impact of incidents. The full scope of this plan will be unveiled in the summer of 2023. Zoom Out: In 2022, hackers managed to breach an IT supplier that worked for NHS.

Quick Hits: Take your Google Cloud knowledge to the next level with The GCP Cookbook! Discover self-contained recipes for seamless cloud computing.* Clerk, a California-based company that aims to make user authentication faster, has raised a $15M Series A round led by Madrona, with participation from Andreessen Horowitz. The famous YouTube channel Linus Tech Tips has been breached. Hackers are using the channel to promote crypto scams such as Bitcoin giveaways. Microsoft has announced that the new Windows 11 build is going to have increased protection against phishing attacks and will support the SHA-3 cryptographic hash functions. Backslash Security, an Israel-based provider of a cloud-native application security solution, has raised $8M from StageOne Ventures, First Rays Venture Partners, and D. E. Shaw Group. Wind River Learning Subscription: Get an in-depth embedded software education for $3,600.* *This is sponsored content.

Upcoming events at Inside: March 23 - Inside Marketing Coffee Break w/ Aditya Vempaty (Register Here) March 27 - Inside Interview with Zscaler - Zero Trust Defense Strategies to Take Your Security to the Next Level (Watch On Demand) March 28 - Inside Startups Coffee Break (Register Here) March 30 - A panel on how CTOs balance and prioritize NFRs into their roadmaps (Register Here) * April 06 - Inside Interview with Lacework - The Evolution of Cloud Security w/ Ulfar Erlingsson (Watch On Demand) April 18 - Human Resources Summit'23 (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Join our Virtual Panel Discussion to get experts addressing CTO's unique challenges.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2023 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.