LastPass confirms source code theft and hacking

LastPass confirms source code theft and hacking

News Summary:

  • Recent discoveries by Trend Micro researchers include a new piece of Go-programmed targeted malware called Agenda. One of its own clients was the target of the ransomware’s targeted attack. The investigation into the event showed that the threat actor entered the victim’s network through a public-facing Citrix server. He or she most likely used a legitimate account to get access to this server and make lateral moves inside the victim’s network. Businesses in Asia and Africa were affected by the new ransomware family. The term “Agenda” appears in ransom notes and dark web posts by a user going by the name of “Qilin,” who is probably connected to the ransomware distributors.

  • LastPass, a password management service, has revealed a security breach that saw some source code and technical data stolen. It is said that the security intrusion, which targeted its development environment, happened two weeks ago. The business has claimed that no encrypted passwords or client data were accessed, but has made no other statements about the incident or what source code was taken. According to LastPass CEO Karim Toubba, “an unauthorised entity obtained access to elements of the LastPass development environment through one hacked developer account and acquired chunks of source code and certain confidential LastPass technical knowledge.”

Four years after the Observer revealed the scandal that dogged the internet giant in ongoing controversy, Facebook has agreed to settle a lawsuit seeking damages for providing Cambridge Analytica access to the private data of tens of millions of users. According to a court document, Meta, the parent company of Facebook, has essentially settled a long-running case alleging that Facebook improperly shared user data with the UK analysis firm for an undisclosed price. This extraordinary action has caused some observers to hypothesise that it was made in order to prevent CEO Mark Zuckerberg and departing Chief Operating Officer Sheryl Sandberg from having to appear in front of plaintiffs’ attorneys next month during hours of questioning.

Some Google employees are questioning the company’s return-to-office requirements because they are often receiving notifications from management about Covid-19 infections. Employees who spoke to CNBC on the condition of anonymity claimed that since being instructed to return to their desks, notices of infections had been often appearing in their email inboxes. At April, the business mandated that most workers spend at least three days a week in their actual offices. The city’s public health dashboard shows that the epidemic in Los Angeles is currently the greatest of any workplace in the city. Deadline.com was the first to reveal that the computer giant’s chic Silicon Beach campus in Venice, California, registered 145 illnesses, while the massive Playa Vista campus saw 135 cases.

In response to the advancement of quantum computing, CISA published a document last week urging leaders to begin preparing for the switch to more robust secret guarding systems, investigate risk mitigation strategies, and take part in the development of new standards. By the end of the decade, quantum computers—which are presently in experimental stages—will outperform conventional systems, and following technological advances will swiftly make them obsolete. This is universally accepted by experts in the area. According to the agency, “quantum computers will be able to break public key cryptography when they reach higher levels of computational power and speed, endangering the security of corporate transactions, secure communications, digital signatures, and consumer information.”

According to Brian Krebs, Mikhail Matveev, also known by the alias Wazawaka, was the mastermind behind the April ransomware attack on the Washington, D.C. Metropolitan Police Department, which the Babuk gang claimed was one of theirs. According to him, there is now “no such money anyplace as there is in ransomware,” even though ransomware as a company will probably disappear in a few years. He asserts that it is even more profitable than the drug trafficking on the dark web.

Rob Bonta, the attorney general for California, has already begun to investigate the upcoming potential breaches of the California Consumer Privacy Act (CCPA) after last week’s imposition of the state’s first fine of $1.2 million against Paris-based Sephora, a major retailer of cosmetics. Bonta said he also sent letters to “a number of businesses” owing to alleged non-compliance when it comes to handling consumer opt-out requests. The fine was part of a settlement with Sephora that was announced at the same time. The processing of consumer requests made through universal privacy controls, which let users instantly opt out of all online purchases, is at the heart of the infringement. Numerous companies make an effort to avoid this by requiring customers to click on opt-out links each time they visit.

The majority of the ransomware news this week concerned LockBit, who had their Tor data leak sites shut down by a DDoS attack only moments after taking blame for a ransomware attack on the industry titan of cybersecurity. This week, researchers reported on the usage of a Genshin Impact anti-cheat driver to end antivirus processes during ransomware assaults and the emergence of a new extortion gang named Donut Leaks. Ransomware activity has increased overall, according to Cyberscoop, with North Korea being a significant source of this activity. Finally, a French hospital, Bombardier Recreational Products, and Greek natural gas provider DESFA were also targets of ransomware assaults last week.

We will be happy to hear your thoughts

Leave a reply

Tech Reviews, News and Guides
Logo