Cloudflare stops Minecraft DDoS attack / $3B in crypto stolen during 2022 / New malware stealing Facebook Business account passwords

Plus: New Microsoft Office 365 bug could leave encrypted emails vulnerable

Inside.com Part of   Network October 14, 2022

Presented by

Cloudflare has announced that it has stopped a cyberattack against a Minecraft server. The attack peaked at 2.5 Tbps. More: The news was announced as part of the company's Q3 DDoS threat report. This attack against Wynncraft, a Minecraft server, is the largest DDoS attack ever in terms of bitrates. The hackers deployed the Mirai botnet. Wynncraft did not experience any outages due to Cloudflare's intervention. Cloudflare added that the attack lasted two minutes. Zoom Out: According to Cloudflare, DDoS attacks on application layers have increased by 111%, with most of them originating in China and India. The country that was most targeted by this type of attack was Taiwan, with a 200% YoY increase in the number of attacks.

$3B worth of cryptocurrency has been stolen so far in 2022, on pace for a record year. 2021 is currently the record year, with $3.2B in stolen funds. More: This amount has been stolen in 125 different hacking incidents by tens of different threat actors. The most targeted entities remain cross-bridge protocols, with $600M stolen so far in 2022. Axie Infinity was infamously hacked by the Lazarus hacker group in March 2022. The group managed to steal over $600M. A part of the funds has been recovered by the U.S. government. October has become the biggest month in 2022 so far, with four new exploits that amount to $718M being reported this week alone.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work.  They are: Manual Inconsistent Take too long Don’t scale Don’t give developers what they need When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Download whitepaper bundle

A new malware written in PHP is stealing passwords from Facebook Business accounts. The malware is being tracked as Ducktail. More: The malware steals passwords by using security flaws found in browsers. Users who opt to save their log-in credentials on their browsers are at greater risk. Researchers believe that the malware was created by a Vietnamese threat actor, although they did not name it. The attack's infection chain works by having the user first download an infected document, usually a cracked installer of legitimate software. The device is then infected by a PHP script. The script uses a specific domain as a C2 and then starts stealing data from the device. Cryptocurrency wallets, Facebook ad payment methods, login credentials, etc., are all vulnerable. Most malicious files the malware uses are ZIP files.

A recently tracked Microsoft Office 365 flaw shows that hackers could read encrypted emails. Microsoft has not patched the bug yet. More: The security researching company that found the bug claims that the flaw was reported to Microsoft in January of this year. The company also allegedly paid a bug bounty. Microsoft has stated that the bug currently does not fulfill its requirements for intervention and does not represent a risk to its users. Office 365 uses a security feature named Electronic Code Book mode. Researchers stated that Microsoft is using the same series of keys to encrypt emails, making them susceptible to breaches.

A message from SMALLSTEP Securing distributed systems AND distributed teams is as easy as getting a TLS certificate. We have come lightyears further in the last decade with securing our webpages with TLS certificates. But webpages are just the beginning of how we can utilize TLS certificates to identify and secure our distributed systems. Enter the world of internal Public Key Infrastructure (PKI). Big enterprises have created their own internal PKI for decades, but Smallstep is here to take the pain out of ancient PKI *and* give small and medium-sized businesses the ability to access and use this technology, easily. Use TLS certificates to identify and secure: All of your workloads Users Machines And now - devices Apple has taken the first step towards the future of managed device enrollment by launching Managed Device Attestation (MDA) with iOS 16, iPadOS 16, and tvOS 16. Smallstep is here to help make that future - secure device enrollment - a reality. Get early access to this reality and dive into how you can harness the power of TLS here. Get early access

The U.K. Government has released a new cybersecurity guideline. This guideline focuses on supply chain attacks. More: The National Cyber Security Centre, the highest cybersecurity authority in the U.K, is targeting mid-sized and large companies with the new awareness campaign. The NCSC has categorized the guideline into six main phases: Understand the importance of cybersecurity  Prioritize the most important company assets Educate the team on the topic Identify your current risk points Create a cybersecurity approach Evaluate and execute. Only one in 10 companies in the U.K. analyze the risk they face from their suppliers, according to a survey cited by the NCSC. This guideline comes as a result of intensified efforts from the U.K. government to respond to previous supply chain cyberattacks several organizations in the country were hit with.

Quick Hits: Seven brands got influencer campaigns right, and you can, too. Wisdom from the experts on running a successful influencer marketing campaign.* Hackers are using placing stickers with QR codes in random locations to try to breach victims who scan them. SecuriThings, a company that aims to improve the safety and efficiency of security IoT devices, has raised $21M. The Series B was led by U.S. Venture Partners. According to a report, North Korea is funding its nuclear program with the cryptocurrency state-backed threat actors have stolen in recent years. Groups like Lazarus this year have stolen over $600M from one hacking campaign alone. The state Iranian TV broadcasting channel was hacked by unnamed threat actors. The hackers interrupted the signal to play a distorted video of Iranian leadership with face masks on. *This is sponsored content.

Upcoming events at Inside: October 14 - Learn how leaders from Slack, Shopify, and Stripe are improving developer productivity, workflow, and collaboration in their engineering orgs. (Register Here) * October 19 - AMA with Zecca Lehn (Responsibly VC) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here) November 02 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) November 09 - Live AMA with Yashar Behzadi (CEO and Founder of Synthesis AI)* (Register Here) December 07 - Live AMA with Deividi Silva ( Head of Developer Relations at Gun.io) (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

Get better security for your distributed systems with TLS certificates.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.

                                                           

Crypto Trading Firm NYDIG Lays Off 33% of Staff

ALSO: Binance launches $500 million bitcoin mining fund, Uniswap v3 picks zkSync and more |

October 14, 2022 The biggest crypto news and ideas of the day  Supported by Hello and welcome to The Node. This is Daniel Kuhn and Xinyi Luo, here to take you through the latest in crypto news and why it matters. In today's newsletter:  Top Shelf: Crypto trading firm NYDIG laid off about 33% of staff, Uniswap will be deployed on zkSync soon and Binance Pool starts a $500 million fund to support bitcoin mining. The Takeaway: David Z. Morris looks at why markets are less than rational in today's economy. If you were forwarded this newsletter and want to subscribe, sign up here. And click here to unsubscribe.   – D.K. Today's must-reads Top Shelf Crypto Trading Firm NYDIG Lays Off About 33% of Staff: The New York-based bitcoin services company NYDIG has cut around 100 jobs over the past several weeks. In late 2021, the firm raised $1 billion in funding to build an institutional-grade platform to bring bitcoin to banks and credit unions. However, the crypto market has soured since the fundraise.  "NYDIG put all their eggs in this banking strategy, but they realized that there was no way that these banks were ready," a former employee told CoinDesk. Uniswap to Deploy on Privacy-Focused zkSync Following Community Vote: Decentralized exchange Uniswap will soon be deployed on privacy-focused layer 2 system zkSync, allowing faster transactions at lower fees. The proposal passed with nearly 100% of all votes agreeing to deploy Uniswap on zkSync, with over 72 million UNI staked by users. Binance Pool Starts $500M Fund to Support Bitcoin Mining: Binance Pool started a $500 million lending facility for BTC miners amid a mining industry downturn. Miners will need to pledge security in the form of physical or digital assets for the loan, which will have a duration of 18-24 months. The company is the latest to join the growing ranks of alternative lenders  providing capital to the distressed mining industry, including mining rig-maker Bitmain, decentralized finance platform Maple Finance and crypto asset management firm Grayscale.  – D.K. and Xinyi Luo  With Nexo Pro, you can do spot, margin, and futures trading, now with a 50% discount on fees. On the platform, beginners and experienced users get access to 3,000+ order books from a single interface. This guarantees you the most favorable price from over 10 liquidity providers with instant execution and near-zero price slippage.    There are 400+ crypto pairs available for which you can set up market, limit, stop loss, take profit, and TWAP orders. An API that can be used for automated trading strategies is also available.  With Nexo Pro live, you can now seamlessly transition from earning and borrowing against your crypto to trading it, and vice-versa. Get started on Nexo Pro today, and profit more by getting the best possible prices on all your trades. Putting the news into perspective The Takeaway  (Anna Moneymaker/Getty Images)   Why Did Crypto Surge After Bad Inflation News?   David Z. Morris looked at yesterday's market spectacle, which had crypto and stocks trading up even after a gloomy inflation print. This means the Federal Reserve is likely to continue raising rates, thereby knocking stocks and crypto down. You can never explain markets, but in the long term they should be rational. Traders seem to be doing the opposite of what is expected. Is reflexicity rational or irrational? Read the article here.  SocialGood App - Handing Out $100s: The Ambition of a Shop-to-Earn App's Founder*   How is the SocialGood App able to offer 100% back to shoppers? Why would they offer such a high reward rate when they could easily offer lower cashback percentages like their competitors? Is there any economic rationale for this business model?   To answer these questions, we spoke with Soichiro Takaoka, the founder and CEO of the company that runs the SocialGood App, SocialGood Foundation Inc.   Read the full interview here    *This is sponsored content from SocialGood. Overheard on CoinDesk TV... Sound Bites "It's going to be [about] continuing to engage on it and working productively with the ecosystem." – Head of digital assets at WisdomTree Will Peck, on the Security and Exchange Commission's rejection of the fund management company's spot bitcoin exchange traded fund proposal, on CoinDesk TV's "First Mover" The news in a sentence Headlines CoinShares Releases Experimental AI Bot That Tries to Calculate the Fair Price for an NFT | Popular Bitcoin Astrologer's Star Falls on Twitter Following $30K in Celsius Payments | US Judge Removes Legal Firm Roche Freedman From Class Action Against Tether, Bitfinex | Crypto Hacker Agrees to Pay $22M in AT&T SIM-Swap Case | FTX's Sam Bankman-Fried Backtracks on $1B Political Donation, Calls it 'Dumb Quote | What others are writing Off-Chain Signals  Celsius Exchange Data Dump Is a Gift to Crypto Sleuths—and Thieves (Andy Greenberg, Wired – soft paywall) Mark Zuckerberg's Meta Metaverse Legs Were Staged (Decrypt) Who is Avraham Eisenberg and why is he all over Crypto Twitter? (Protos) New crypto accounting guidelines could 'smooth the way' for adoption (Cointelegraph) The Chaser... The Node A newsletter from CoinDesk Were you forwarded this newsletter? Sign up here. See Previous Editions Copyright © 2022 CoinDesk, All rights reserved.  250 Park Avenue South New York, NY 10003, USA See all of CoinDesk's newsletters | Opt out