News of the Cyber World

[kyonides]

Instagram down for thousands of users globally
Users took to Twitter to complain about the outage

Instagram was down for thousands of users across the world on Wednesday, according to Downdetector.com.

The Meta Inc. owned social media platform was down for over 45,000 users early on Thursday, the outage tracking website noted.

About 2,000 users were from the UK, and over 1,000 reports each came from India and Australia, according to the website that tracks outages by putting together reports from a number of sources, Reuters reported.
...
About 85 per cent of the users experienced outages on the platform’s mobile app while about 11 per cent reported problems accessing the Instagram website.

Nearly four per cent of the users who reported outages said they had issues logging into the platform, Downdetector.com noted.

Reports of the outage started from about 1:30am GMT and peaked in the following hour with user reports gradually decreasing.
...
However many others have also reported being able to access Instagram during the outage.

Matt Taibbi rips ‘spineless’ media
for ignoring FTC’s demand for Twitter to reveal journalists

The Federal Trade Commission’s demand that Twitter reveal the names of journalists who were granted access to company records is being assailed as “an outrageous attack on the First Amendment.”

Matt Taibbi, the former Rolling Stone journalist, blasted his “former colleagues in mainstream media” for failing to cover what is being billed as “insane overreach” by FTC Chair Lina Khan.

He wrote that the lack of media outrage was “particularly infuriating” given that none of the journalists who published the “Twitter Files” had “asked for nor received access to private user data” whereas “the Files themselves are full of instances of government agencies improperly asking for the same.”

“Which journalists a company or its executives talks to is not remotely the government’s business. This is an insane overreach,” according to Taibbi.

In a Twitter thread, Taibbi referred to mainstream reporters as “spineless, corrupt, amoral f–kwits.”

Author Michael Shellenberger, who was among those given access to Twitter Files, blasted the Biden administration for its “outrageous attack on the First Amendment.”

 And Shellenberger had to show up exactly when the FTC should not even remember his name at all. What a great way to stay away from that regulator turned  espionage agency.

Elon Musk apologizes after mocking disabled Twitter employee he laid off

The billionaire mogul apologized for mocking a fired Twitter employee who suffers from muscular dystrophy and uses a wheelchair.

Musk had accused Haraldur Thorleifsson of using his disability as an “excuse” to do “no actual work” after the Iceland-based software engineer complained that he had not heard about his job status for nine days.

“I would like to apologize to Halli for my misunderstanding of his situation,” Musk tweeted late Tuesday to his 130 million followers, referring to Thorleifsson by his nickname.

“It was based on things I was told that were untrue or, in some cases, true, but not meaningful.”

The Twitter boss also revealed he spoke with Thorleifsson on a video call about a possible return to the beleaguered social media platform.

 Well, I seriously doubt that calling those details "true, but not meaningful" truly helps him defend his case in front of the general public, at all.

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year.

While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's widely used by public institutions and universities, the re-infiltration in October 2022 involved the exploitation of a zero-day in the same program.

Cybersecurity firm AhnLab Security Emergency Response Center (ASEC) said it's refraining from divulging more specifics owing to the fact that "the vulnerability has not been fully verified yet and a software patch has not been released."
...
AhnLab V3 anti-malware engine was disabled.
...
Aother steps taken to conceal its malicious behavior include changing file names before deleting them and modifying timestamps using an anti-forensic technique referred to as timestomping.

...designed to connect to a remote command-and-control (C2) server...

Since we're talking about remote servers here, let's go back to the LastPass Hack Crisis...

LastPass Hack: Engineer's Failure
to Update Plex Software Led to Massive Data Breach

The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.

The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022.

The intrusion ultimately enabled the adversary to steal partially encrypted password vault data and customer information.

The second attack specifically singled out one of the four DevOps engineers, targeting their home computer with a keylogger malware to obtain the credentials and breach the cloud storage environment.

 So if you've ever used LastPass to access any online service, even if you stopped using it in the last year or so, you better rush to change your passwords. All of them like right now or else face the hack of many of your accounts.