Cybersecurity News Update: Week of September 12th, 2022

Hello! It's been another busy week, full of cybersecurity incidents and other developments. Let's dive in!

Uber has apparently suffered what?The Register?has described as what?"looks like a substantial cybersecurity breach." The company has not shared many details but it appears a hacker broke into the HackerOne account of an Uber employee and may have gained access to all of Uber's HackerOne reports.??

The US Department of Justice (DoJ) announced an indictment on Wednesday against three Iranian hackers who used ransomware to extort a battered women's shelter and a power company. And that's just the beginning. The DoJ said the trio?launched ransomware attacks at "hundreds" of victims in England, Australia, Iran, Russia and the United States, saying they extorted money "largely" for their own accounts. One of the biggest targets was Boston Children's Hospital?in the summer of 2021. Fortunately, an unspecified intelligence partner tipped off the FBI, and the agency worked with Children’s to block what would have been “one of the most despicable cyberattacks I’ve seen,” Wray said at a Boston College cybersecurity conference in June.?

The European Union introduced legislation that requires companies that make digital devices and software to fulfill basic cybersecurity requirements. Lawmakers are hoping the new legislation will reduce hacking risks in a broad range of products. In addition, manufacturers that do business in the EU must provide security patches and updates for the product’s lifetime or five years after going to market, whichever is shorter. The fine for breaking the rules would be as much as 15 million euros, equivalent to $15 million, or 2.5% of global revenue.

With cybercrime rampant worldwide, the United States is doing what it can to help other countries by participating in joint law-enforcement operations and examining how cybersecurity rules can be more closely aligned. The US is also "harmonizing" breach reporting requirements between states and federal agencies due to the increasing nature of crimes with an "international dimension".?

Twitter's former head of security has continued to speak with the US Senate Judiciary Committee. On Tuesday,?Peiter “Mudge” Zatko told the committee that his former employer was unable to track how employees accessed internal data, blinding them to foreign spies. Zatko told lawmakers there was?“a lack of fundamental tools and access controls” putting the company at least 10 years behind industry norms. Mudge cited one example where there were “thousands of failed attempts to access internal systems per week” and nobody could explain where they were coming from or what they were trying to access.

Networking giant Cisco has had its files stolen after a breach earlier in the year. However, the company contends, as it has since the incident was first reported, there is?no impact to its business. Cisco disclosed in August a security breach was detected on May 24 after a ransomware group named Yanluowang claimed to have obtained gigabytes of information and publishing a list of files allegedly stolen from the company.?

Tesla owners could not have been happy to learn?that attackers are now able to unlock and start a Tesla Model Y in just seconds. Researcher Josep Pi Rodriguez, principal security consultant for IOActive, this week revealed a vulnerability involving an NFC relay attack. The attack?requires two thieves working in tandem, one of whom needs to be near the car and the other near the car owner, who has an NFC keycard or mobile phone with a Tesla virtual key in their pocket or purse.?The vulnerability is the result of a software update eliminating the need for Tesla owners to place their NFC key card in the console between the front seats to shift into D and drive off. As?Slashgear?puts it, the update came with a flaw: The car could accept new keys within two minutes after unlocking, and the new keys could unlock and start the vehicle without requiring further authentication.

That's a wrap for this week's news. See you next week! For more information visit our blog.