Welcome to this week’s newsletter, where we explore a common subject that affects us all: cybersecurity and privacy in the digital age. 
This week we’ve curated interesting stories in the industry ranging from data breaches to ransomware attacks that disrupt Dallas services and security tips including Apple newly introduced Rapid Security Response feature and switching to the latest Cisco telephone adapter. These trends will keep you informed and help you adopt proactive security measures. So sit back, relax and enjoy this weekly summary.
Cisco warns of vulnerability in popular phone adapter, urges migration to newer model
Cisco has issued a warning of a serious security flaw in SPA112 2-Port phone adapters, which could be exploited by a remote attacker to execute arbitrary code on affected devices. The 9.8 flaw, tracked as CVE-2023-20126, which was reported by Catalpa of DBappSecurity was due to a missing authentication process within the firmware upgrade function. Cisco does not intend to release fixes as device has reached end-of-life but urges migrating to migrate to a Cisco ATA 190 Series Analog Telephone Adapter. No exploit has been reported so far.
| Date: | May 5, 2023 |
|---|---|
| Source: | The Hacker News |
| Author: | Ravie Lakshmanan |
| Tag: | Network Security, Vulnerability |
Ransomware attack forces Dallas to shut down courts, disrupts some 911 services
The city of Dallas in Texas, USA has suffered a ransomware attack that has disrupted some key services including the 911 dispatch systems. The city servers suffered widespread outage, believed to be compromised by the Royal ransomware gang, which threatened to publish critical data if the ransom demand is not met. The full impact of the attack is not known but it affected the Dallas Police Department website which is currently offline and the courts remain closed for 2 days. The city responded that it is actively working on isolating the ransomware to prevent its spread.
| Date: | May 4, 2023 |
|---|---|
| Source: | Tech Crunch |
| Author: | Carly Page |
| Tag: | Ransomware, Cyber Crime |
ChatGPT and other AI-themed lures used to deliver malicious software
Check Point researchers have discovered that 1 out of every 25 new domains created related to ChatGPT or OpenAI were either malicious or potentially malicious. Threat actors often disguise malware within innocuous-looking files and offer fake ChatGPT desktop and mobile apps or mobile extensions. The malware is used to steal login credentials and session cookies to hijack accounts. Meta reported that they have blocked over 1000+ malicious links using ChatGPT as a lure across different technologies.
| Date: | May 4, 2023 |
|---|---|
| Source: | Helpnet Security |
| Author: | Zeljka Zorz |
| Tag: | Malware, ChatGPT |
Google is changing Chrome’s lock icon because nobody knows what it means
Google is replacing the padlock icon in Chrome with a new “tune” icon, with the release of Chrome 117 in September. Google claims that this is because, in a study conducted in 2021, only 11% of the participants understood the purpose of the lock icon and many misunderstood it for an overall indication of trust or reliability. The new tune icon represents control menus and Google iterates that it might encourage users to click through and access more information about their security and connection settings. The new icon will come with no new features and will continue to mark plaintext HTTP as insecure on all platforms.
| Date: | May 3, 2023 |
|---|---|
| Source: | The Verve |
| Author: | Jess Weatherbed |
| Tag: | Tech |
Apple and Google join forces to stop unauthorised location-tracking devices
Apple and Google are working together on a draft industry-wide specification that’s designed to tackle safety risks and alert users when they are being tracked without their knowledge or permission by using devices like AirTags. The bluetooth location-tracking devices will be compatible with unauthorised tracking detection and thereby standardise the alerting mechanisms. The proposed specification is expected to be released by the end of the year.
| Date: | May 3, 2023 |
|---|---|
| Source: | The Hacker News |
| Author: | Ravie Lakshmanan |
| Tag: | Data Privacy, Tech |
T-Mobile discloses 2nd data breaches of 2023, this one leaking account PINs and more
Mobile telecommunication company T-Mobile disclosed another breach that exposed customers sensitive data such as their name, contact information, account number, account PINs and other customer data. This incident is the second hack to hit T-Mobile this year, with an overall of nine hacks since 2018. In April 2022, T-Mobile disclosed that a hacker gang, named Lapsus$, gained access to the company’s internal tool and carried out SIM swap which allows unauthorised people to port someone’s phone number to the phone of the threat actor.
| Date: | May 2, 2023 |
|---|---|
| Source: | Ars TECHNICA |
| Author: | Dan Goodin |
| Tag: | Hack, Network Security |
Apple uses iOS and macOS Rapid Security Response feature for the first time
Apple released its first ‘Rapid Security Response’ update available for iOS and iPadOS devices running version 16.4.1 or Macs running version 13.3.1. The update adds an (a) to the OS version to denote that it’s been installed. The feature enables faster and more frequent security patches, especially for WebKit-related flaws that affect Safari and other apps that use Apple’s built-in browser engine. This feature required significant under-the-hood changes to how the encrypted, sealed system volumes in iOS and macOS normally work. However, it is unclear if Apple intends to release more information about the specific bugs patched by this update.
| Date: | May 1, 2023 |
|---|---|
| Source: | Ars TECHNICA |
| Author: | Andres Cunningham |
| Tag: | Tech, New Releases |
Conclusion
Well, that’s all for ‘This Week in Cybersecurity’. As always, our purpose is to provide weekly summaries of important cybersecurity news that’ll keep you informed and stay up-to-date with the latest trends.
Don’t hesitate to post any captivating articles you come across that are not included in the weekly roundup at ‘In the News’ category in passbolt community forum. We’d love to hear your thoughts and share your insights with the community on cybersecurity. Thank you for your contribution! 