Welcome to this week’s newsletter, where we explore a common subject that affects us all: cybersecurity and privacy in the digital age. 
This week’s ‘In The News’ we’ve highlighted interesting articles such as the draft U.N. Cybercrime Treaty and its potential implications. While some view the treaty as a much needed step towards creating a more secure cyberspace, the Electronic Frontier Foundation has provided a perspective that raised concern over the potential impact on individual’s freedom and privacy. Other cybersecurity news we covered this week include uncovering the mastermind behind 3CX supply chain attack, Whatsapp new verification feature, the arrest of the man behind the leak of US classified defence documents. It is paramount to learn about the latest cybersecurity trends and adhere to the best practices for staying safe online. So join us if you want to stay informed with the newest security developments.
Classified intel leaked to Discord server leads to 21-year-old’s arrest
According to the US Department of Justice, US Air Force National Guard member Jack Teixeira was arrested on charges of illegally leaking classified documents on Discord. Teixeira supposedly led a private Discord group who posted memes and discussed shared interests including guns and games. The leaked documents consist of classified national defence information and sensitive details about the war in Ukraine and have been found circulating online for months. The case has raised concern within the US government about the extent of social media monitoring.
| Date: | Apr 14, 2023 |
|---|---|
| Source: | Tech Crunch |
| Author: | Taylor Hatmaker |
| Tag: | Data breach, Cyber Crime |
Whatsapp introduces new device verification feature to prevent account takeover attacks
In an attempt to mitigate mobile device malware that poses a threat to people’s privacy and security, Whatsapp has announced a new verification feature called Device Verification that helps to prevent account takeover (ATO). This feature introduces a security-token that’s stored locally on the device to detect potentially suspicious connections and an authentication-challenge that causes malicious connections to be blocked. Whatsapp is also launching a Key Transparency feature to confirm whether chats are end-to-end encrypted without manual verification.
| Date: | Apr 13, 2023 |
|---|---|
| Source: | The Hacker News |
| Author: | Ravie Lakshmanan |
| Tag: | Mobile Security, Data Privacy |
LinkedIn can now get users verified for free
In a battle to beat fake accounts, LinkedIn has announced three new verification features that allow users to authenticate aspects of their identity and job histories. The features include verifying an individual’s current employer by receiving a security code in work email, verifying identity through authentication company Clear and verifying for name and current employer through the Microsoft Entra Verified ID credential. These features are freely available to all individual users with some rolling out at the end of the month.
| Date: | Apr 13, 2023 |
|---|---|
| Source: | Tech Radar |
| Author: | Craig Hale |
| Tag: | Data Privacy, Data Protection |
North Korean hackers uncovered as mastermind in 3CX supply chain attack
3CX, enterprise communication service provider, confirmed that the supply chain attack targeting its desktop application for Windows and masOS was orchestrated by a North-Korean backed threat actor. Security firm Mandiant states that the hacker group, UNC4736, infected the 3CX system with a malware codename TAXHAUL that decrypts and loads shellcode containing a “complex downloader” labelled COLDCAT. An updated app is made available to customers to mitigate against such future attacks.
| Date: | Apr 12, 2023 |
|---|---|
| Source: | The Hacker News |
| Author: | Ravie Lakshmanan |
| Tag: | Malware, Cyber Crime |
Mercenary spyware hacked iPhones victims with rogue calendar invites, researcher says
Researchers at Microsoft and Citizen Lab have claimed that Israeli spyware manufacturers, QuaDream, have hacked the iPhones of journalists, politicians and NGO workers using malicious calendar invites. The researchers have identified over five victims of the malware, which uses a zero-click exploit that has not been patched yet by Apple. In 2021, Israeli newspaper Haaretz reported that QuaDream doesn’t operate the spyware but its government customers do-as a practice of surveillance.
| Date: | Apr 11, 2023 |
|---|---|
| Source: | Tech Crunch |
| Author: | Lorenzo Franceschi-Bicchierai |
| Tag: | Spyware, Cyber Risk/Cyber Threats |
How much to infect Android phones via Google play store? How about $20k
Kaspersky, a Russian infosec outfit, who have studied nine dark-web markets between 2019 and 2023, states that cybercriminals can buy developers accounts and loaders for an amount ranging from $60 - $20,000 to insert malware into people’s Android device via Google play store. Cybercriminals always found a way to bypass Google security measures against tackling malicious apps. Therefore, it is paramount that we are more vigilant in downloading any unknown apps and check app permission to limit access.
| Date: | Apr 10, 2023 |
|---|---|
| Source: | The Register |
| Author: | Jessica Lyons Hardcastle |
| Tag: | Cyber Crime, Malware |
Decoding the U.N. Cybercrime Treaty
The proposed U.N. Cybercrime Treaty, which has the potential to rewrite criminal laws around the world, is at risk of stifling free speech and increasing government surveillance and expanding state investigative techniques, according to EFF. The treaty’s emphasis on content-related crimes could result in overly abused laws that curb free speech, while provisions that criminalised insulting religion could potentially make it illegal to post content protected under international law. The draft treaty also includes vague provisions for increasing surveillance. EFF is of the opinion that human rights must be baked into the proposed treaty so as it doesn’t become a tool for limiting free speech, infringing on data privacy and sidelining human rights protection.
| Date: | Apr 7, 2023 |
|---|---|
| Source: | EFF |
| Author: | Paige Collings and Katitza Rodriguez |
| Tag: | Data Privacy, Politics |
Conclusion
We hope the articles we’ve shared are of importance and relevant to you in staying up-to-date with the latest cybersecurity trends. We do encourage you to take proactive security measures in staying safe online and enhance your cybersecurity posture.
Feel free to contribute any interesting articles you come across in the ‘In The News’ category of passbolt community forum and share your thoughts and experiences on cybersecurity and data privacy standards. We love to connect more with you and discuss more on topics that are relevant to us. 