News of the Cyber World

[kyonides]

Twitter Announces ‘Zero Tolerance’ Policy
on Threats of Violence
With Exceptions for ‘Outrage’ and Satire

The social media platform, headed by Elon Musk, officially announced its “zero tolerance policy towards violent speech” on Feb. 28.
...
“However, healthy conversations can’t thrive when violent speech is used to deliver a message. As a result, we have a zero-tolerance policy towards violent speech in order to ensure the safety of our users and prevent the normalization of violent actions.”

Under the new policy, Twitter users may not threaten, incite, glorify, or express a desire for violence or harm.
...
The updated policy notes that this includes threats to damage civilian homes and shelters or infrastructure that are “essential to daily, civic, or business activities.”
...
“This also includes using coded language (often referred to as ‘dog whistles’) to indirectly incite violence,” the platform’s rules and policies state.
...
Users who violate the new policy...risk having their Twitter accounts immediately and permanently suspended.

Poland Probes Emails From Hacked Account of Government Official

Prosecutors in Poland have opened an investigation into some emails from the hacked mailbox of a former government official on suspicion that classified information could have been leaked.
...
The investigation is connected to the private mailbox of an aide to Polish Prime Minister Mateusz Morawiecki that was hacked in 2021. The aide, Michal Dworczyk, resigned last year.

Government officials have blamed Russian and Belarusian hackers and cast doubt over the authenticity of the leaked correspondence, which included email exchanges with Morawiecki and government advisers.

Two opposition lawmakers who notified prosecutors about the leaks said they were informed that a probe was launched into one of the email threads. They said the investigation relates to Dworczyk’s communications with his defense adviser, who provided him with information about weapons, some of which was described as “top classified.”
...
Tomczyk and another lawmaker, Adam Szlapka, said high officials discussing classified matters in correspondence from private email accounts without adequate security compromised Morawiecki’s government and the ruling Law and Justice party.

Basically, what it means is that Russia might already know what kind of weapons or even how many of them Poland currently has. This is critical because Poland is a full fledged member of NATO.

Turkey Fines TikTok for Weak Data Protection Measures

Turkish authorities have fined TikTok 1.75 million lira ($93,000) for not taking sufficient measures to protect users from unlawful processing of their data, the Personal Data Protection Board (KVKK) said on Wednesday.
...
The data protection authority also said in a statement on its website that TikTok should translate its Terms of Service into Turkish and update its privacy and cookies policy texts in line with the country’s regulations.

TikTok said they are looking into the Turkish regulator’s fine, adding that they remain committed to providing a safe and protected platform for users.
...
Turkey has the ninth most users of TikTok in the world, with some 30 million accounts on the social media platform, data from Statista showed.

LastPass Reveals Second Attack
Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems.

The company said one of its DevOps engineers had their personal home computer hacked and infected with a keylogger as part of a sustained cyber attack that exfiltrated sensitive data from its Amazon AWS cloud storage servers.
...
This intrusion targeted the company's infrastructure, resources, and the aforementioned employee from August 12, 2022, to October 26, 2022. The original incident, on the other hand, ended on August 12, 2022.

The August breach saw the intruders accessing source code and proprietary technical information from its development environment by means of a single compromised employee account.

Here I wanna take a break to note something important. That employee couldn't have been your average IT guy for his account gave the  hackers access to privileged information. So he could be what we could call an administrator or something the like. Plus, it's quite abnormal to give a single individual total access to all of their secret data. Normally, they'd heavily compartmentalize it for security reasons. And there's the fact he was using his own PC or laptop.  Even so there's that dreadful keylogger...

GoTo, the parent company of LastPass, also fessed up to a breach last month stemming from unauthorized access to the third-party cloud storage service.
...
"Specifically, the threat actor was able to leverage valid credentials stolen from a senior DevOps engineer to access a shared cloud storage environment"
...
This allowed the malicious actor to obtain access to the AWS S3 buckets that housed backups of LastPass customer and encrypted vault data.
...
"The threat actor was able to capture the employee's master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer's LastPass corporate vault," LastPass said.