Welcome to this week’s edition of ‘This Week in Cybersecurity’ where we explore a common subject that affects us all: cybersecurity and privacy in the digital age.
This week we’ve curated interesting news that’ll keep you informed with the latest trends, developments and cybersecurity updates. So sit back, relax, and enjoy these short summaries. 
1. GitHub warns Devs of North Korean attack
Microsoft has attributed a cyberattack on Github customers to a North Korean hacking group called as “Jade Sleet” or “TraderTraitor”. The group conducted a low-volume social engineering campaign and target accounts that are connected to blockchain, cryptocurrency, online gambling or cybersecurity sectors. The attack involved creating fake accounts on social media platforms and offering collaboration on GitHub repositories. The hackers used malicious npm package dependencies to download and execute second-stage malware on victims’ machines.
| Date: | Jul 21, 2023 |
|---|---|
| Source: | Infosecurity Magazine |
| Author: | Phil Muncaster |
| Tag: | Cyber Risk/Cyber Threats, Malware |
2. Google demos “unsettling” tool to help journalists write the news
Google has been developing tools, including one which is called Genesis, which can help journalists write news articles. These tools are not meant to automate news but supporting journalists by offering suggestions for news headlines or other writing styles. Google has been developing large language models (LLMs) such as PaLM2 that can summarise information, explain concepts and more. However, a few journalists found the use of “Genesis” unsettling and concerns were raised on misusing AI in journalism which could potentially lead to misinformation and impact credibility.
| Date: | Jul 20, 2023 |
|---|---|
| Source: | Ars TECHNICA |
| Author: | Benj Edwards |
| Tag: | AI, Tech |
3. Apple slams UK surveillance-bill proposals
Apple has stated that it will remove services like FaceTime and iMessages from the UK rather than compromising on data security and privacy if the new proposal to update the Investigatory Powers Act (IPA) 2016 becomes a law. The new proposal requires messaging services to seek approval from Home Office for releasing security features to its customers. Currently, the Home Office can demand immediate disabling of security features without public disclosure or independent oversight, but the proposed update would require immediate compliance. Other services like Whatsapp and Signal have voiced their opposition to the proposal. The government has opened an eight-week consultation on this.
| Date: | Jul 20, 2023 |
|---|---|
| Source: | BBC |
| Author: | Zoe Kleinman |
| Tag: | Data Privacy, Data Protection |
4. Google fixes ‘Bad.Build’ vulnerability affecting Cloud Build service
Google has fixed the vulnerability in its Cloud Build service that allowed hackers to tamper with application images and infect users. The vulnerability, known as Bad Build, allows the attackers to impersonate the accounts and manipulate the build, and thereby inject malicious code. While the fix to this issue was released in June, Orca Security which reported the bug to Google warned of a potential supply chain attack. Therefore, it is advised for organisations to check and adjust permissions to enhance security.
| Date: | Jul 18, 2023 |
|---|---|
| Source: | The Record |
| Author: | Jonathan Greig |
| Tag: | Tech, Vulnerability |
5. U.S. preparing Cyber Trust Mark for more secure smart devices
The U.S. Cyber Trust Mark is being developed to assist the U.S. consumers choose devices that are more secure and resilient to cyber attacks. This program, proposed by the Federal Communications Commission, is expected to roll out next year. Major vendors like Google, Amazon have announced their participation. The products need to meet the cybersecurity criteria set out by National Institute of Standards and Technology (NIST) and will be labelled with a “distinct shield logo” indicating it is NIST-approved. This program will also expand to other devices like consumer-grade routers, smart meters, power inverters, etc.
| Date: | Jul 18, 2023 |
|---|---|
| Source: | Bleeping Computer |
| Author: | Ionut Ilascu |
| Tag: | Tech, Network Security |
6. Microsoft lost its keys and the government got hacked
Microsoft is still investigating how China-backed hackers were able to obtain a Microsoft signing key that was abused to forge authentication tokens that permitted the threat actors to gain access to email accounts, including those belonging to federal government agencies. The threat actors, called Storm-0558, were targeting undisclosed vulnerabilities in Microsoft’s cloud rather than individuals’ email servers. Microsoft noted that it has blocked all activity relating to this incident and hardened its key issuance system.
| Date: | Jul 17, 2023 |
|---|---|
| Source: | Tech Crunch |
| Author: | Zack Whittaker |
| Tag: | Browser Security, Vulnerability |
Conclusion
Well that brings to the conclusion of ‘This Week in Cybersecurity’ roundup. We hope you enjoy these short summaries and feel free to share any interesting articles you come across in the ‘In the News’ category of the Passbolt community forum.
We handpick the most interesting article/articles of the week to be featured in our monthly video edition of “This Month in Cybersecurity” 
Cast your vote below for the article(s) you’d like to see featured in the video: 
GitHub attack
Genesis tools
UK surveillance bill proposal
Google fixed bad.build
Cyber Trust Mark
Microsoft signing key