Hacker claims to have stolen personal data of 1 billion Chinese citizens
Last week, an individual using the alias ‘ChinaDan’ posted on a hacker forum that they obtained 23 TB of personal information of 1 billion Chinese residents. ChinaDan claims the data was exfiltrated from a Shanghai National Police database and includes names, addresses, birthplaces, national ID numbers, mobile numbers, and criminal records. ChinaDan shared a sample of the records on Breach Forums where the data is being sold for 10 bitcoin, equivalent to around $200,000. Binance CEO Zhao Changpeng Tweeted that the company detected a large-scale data breach of an Asian government entity which he claims was caused by a developer who accidentally leaked credentials via a tech blog on CSDN. The data breach, which remains unconfirmed, would be one of the largest ever recorded.
(Infosecurity Magazine and Bleeping Computer)
Ukrainian police take down phishing gang behind payments scam
Ukrainian police said they have arrested nine suspected members of a phishing gang and seized computer equipment, mobile phones, bank cards, and cash from their homes. The gang disguised their phishing scam as EU social security payment notifications which routed victims to malicious sites that harvested their bank account details. Analysts say more than 5,000 citizens were defrauded out of a total of 100 million hryvnias ($3.38 m). If found guilty, the suspects face up to 15 years in prison.
(ZDNet)
NIST unveils ‘quantum-proof’ cryptography algorithms
On Tuesday, NIST announced its future standards will include four encryption algorithms designed to withstand hacking threats powered by quantum computing. The algorithms include one for general encryption purposes (CRYSTALS-Kiber) and another three for digital signatures and identity verification (CRYSTALS-Dilithium, Falcon and Sphincs+). All algorithms under final consideration met baseline security standards and the choice came down to small differences in criteria such as speed and ease of use. NIST expects to select at least one more general use algorithm, to include in its standards, due for release by 2024.
(SC Media)
Google issues patch for actively exploited Chrome bug
Google celebrated July 4th by making their customers independent of a zero-day Chrome vulnerability. The tech giant issued a patch for a heap buffer overflow issue in the browser’s WebRTC engine that could allow attackers to crash or even execute arbitrary code on vulnerable systems. Chrome 103 (103.0.5060.71) for Android and Version 103.0.5060.114 for Windows and Mac fix the issue tracked as CVE-2022-2294.
Thanks to today’s episode sponsor, Votiro
AstraLocker ransomware gang shifts to cryptojacking
Hackers behind AstraLocker Ransomware, which is a spin-off of Babuk Ransomware, issued a statement that they are shutting down their ransomware operations and are shifting their focus to cryptojacking. The gang first stated their intentions to discontinue ransomware operations back in February due to law enforcement hindering their ability to obtain ransoms from their victims. The gang noted that they were prepared to provide a free decryption tool to their victims.
Google to wipe user location history for visits to healthcare facilities and shelters
Google announced that it will automatically delete location logs when it detects visits to medical facilities, counseling centers, domestic violence shelters, abortion and fertility clinics, or addiction treatment centers. Google disables location history by default, but many users enable it to receive personalized recommendations. Even when the feature is enabled Google will now delete logs automatically shortly after a user visits a sensitive area. Google also intends to make it easier for users to delete logs of menstruation trackers in Google Fit and Fitbit.
(ZDNet)
Azure now has confidential VMs with ephemeral storage
Microsoft now allows Azure cloud computing service customers to create hardware isolated virtual machines (aka confidential VMs) with Ephemeral OS disks. The new Azure public preview feature keeps customer data 100% confidential since it will never be sent to remote Azure Storage. Microsoft explained that ephemeral OS disks provide lower read/write latency to the OS disk and faster VM reimaging. Customers will benefit from Azure hardware-based trusted execution environments (TEEs) to protect their data which can only be processed by authorized code.
UK signs its first post-Brexit data sharing deal
On Tuesday, the UK announced its first international data sharing deal since it exited the European Union six years ago. The agreement will allow unrestricted data transfer between the UK and South Korea which is home to mobile tech giants, Samsung and LG. The UK’s Data Minister, Julia Lopez, said she expects the new agreement to bolster digital trade and vital research. Google, Mastercard and Microsoft were among the companies advising the government on this deal as part of an International Data Transfer Expert Council formed earlier this year. Ironically, had the UK remained in the EU, it would already have an established data adequacy deal with South Korea.