News of the Cyber World

[kyonides]

Supreme Court clears way for WhatsApp case against NSO Group
opening spyware firm to more lawsuits

The Supreme Court on Monday denied a petition from NSO Group, the Israeli spyware maker, to dismiss a lawsuit alleging the firm exploited the WhatsApp platform in 2019 to spy on 1,400 users.

The decision upholds a previous California federal court ruling that rejected NSO Group’s arguments that it qualified for foreign sovereign immunity because it had been acting on behalf of a foreign government to investigate terrorist activity at the time it deployed the software.

NSO Group filed its petition with the Supreme Court in April after a federal judge in California rejected an appeal in the case brought by Meta, WhatsApp’s parent company.
...
The Supreme Court previously called on the Biden administration to weigh in on the case and in November the Justice Department filed an amicus brief asking the court to deny the petition. The administration in 2021 added NSO Group and fellow Israeli spyware company Candiru to its entity list of companies that pose a national security risk.

The high court’s ruling comes amid growing concern from Washington about reining in the spyware industry.
...
The court’s decision could help bolster the standing of other lawsuits against the surveillance firm. The Knight Institute filed a lawsuit in U.S. federal court against NSO Group in December on behalf of members of the Salvadoran news outlet El Faro. The lawsuit alleges that the NSO Group violated U.S. hacking laws by deploying spyware against the journalists.

LastPass breach exposes how US breach notification laws
can leave consumers in the lurch

On Thursday, Dec. 22., as Americans prepared for the holidays and braced for massive winter storms, the password manager LastPass announced to its 33 million customers that it suffered a major security breach.
...
Based on the public notification from LastPass, the potential implications of the incident were anything but clear. Security experts immediately criticized LastPass’s announcement as misleading and difficult to understand. The company’s announcement seemed to imply that it would be difficult for the attacker to decrypt stolen passwords, but that would very much depend on a given user’s master password.
...
The U.S. famously does not have a federal privacy law — something that might determine the rights of consumers to know their personal data has been stolen. What it has instead are 50 different state laws governing breach notification. When a company realizes its systems have been breached and data inappropriately accessed, it must examine the affected users state by state and determine whether the data stolen and belonging to them qualifies for notification under each user’s state data-breach notification regime.
...
Beyond its difficult-to-parse post announcing the breach, LastPass has stayed silent regarding what exactly transpired on its systems ... Based on communications LastPass sent to some affected customers and obtained by CyberScoop, the company has informed some customers directly about the breach, but these notices have included few details to help customers understand the implications of the breach.
...
The use of a password manager represents a foundational component of improving security for ordinary consumers — but that also creates a juicy target for hackers looking to obtain passwords to a large number of accounts to enable other attacks.
...
In the case of the breach LastPass disclosed in December, one breach appears to have led to another. According to the company, “an unknown threat actor” accessed a cloud-based storage environment “leveraging information” that was, in turn, stolen from a breach disclosed in August.
...
LastPass has emphasized that while the attacker was able to steal encrypted password data, this data could not be decrypted without access to the master password, which only the user is in possession of. So long as a user picked a strong master password, the company claims, an attacker probably won’t be able to decrypt the stolen passwords — running a brute force attack to do so would simply take too long.

Take in consideration that guessing a master password is way easier than individually decrypting ALL passwords handled by that master password.

GitHub disables pro-Russian hacktivist DDoS pages

GitHub on Tuesday disabled accounts on the platform belonging to a pro-Russian hacktivist group linked to attacks on entities in NATO countries, including efforts to disrupt the websites of Denmark’s central bank and other financial institutions in the country, GitHub confirmed to CyberScoop.

The group, NoName057(16), used the software development platform to host its distributed denial of service (DDoS) tool website and code used in its attacks, researchers with SentinelOne said Thursday. The researchers reported the activity to Github, prompting the company to disable the group’s accounts earlier this week.
...
NoName057(16) distributes cryptocurrency to its top DDoS contributors. And while its DDoS attacks have been generally short-lived, the financial incentives offered by the group encourage “people to contribute more technical resources for a more powerful attack,” SentinelOne’s researchers note.

The group has shown a willingness to target a wide range of organizations across NATO, said Tom Hegel, a senior threat researcher with SentinelOne’s SentinelLabs. By offering a financial incentive, “individuals contributing to the attacks may have financial gain in mind, rather than politics—meaning there is a larger pool of potential contributors,” Hegel said.
...
NoName057(16) initially targeted Ukrainian news sites starting in March of this year but shifted to attacking various entities in NATO countries, in a bid to silence “what the group deems to be anti-Russian,” according to Hegel and Milenkoski.

The group tends to shift targets depending on current events, the researchers note. In December, for instance, the group disrupted websites in Poland shortly after lawmakers there recognized Russia as a state sponsor of terrorism. In January, the group targeted the cargo and shipping sectors in Lithuania, before turning to targets in Denmark.
...
Attacking in retaliation for the Czech Republic’s role in training Ukrainian soldiers, NoName057(16) claimed to have taken down a website belonging to presidential candidate Tomas Zima.

Commands sent from NoName057(16)’s command and control server make it clear the group has attacked websites belonging to other candidates in the Czech presidential election, Hegel said, rendering some of them intermittently available over the course of Wednesday.