This is indeed the most serious cybersecurity breach in Singapore so far. 1.5 million records were exfiltrated. If this were to happen to a private company, the fine for breaching PDPA would surely be significant. While cyber attacks are not uncommon or unexpected, having it happen in a way that affects so many people will surely bring pause to many ongoing and upcoming IT projects in the pipeline.
Much ado about nothing. The context was, some journalists were highly suspicious of the USB fan that was included in the goody bag for the media during the Trump-Kim summit in Singapore, deeming it a cybersecurity risk. It’s probably good not to plug untrusted USB devices into your machine but c’mon please give the organizers more credit than this.
A University of Cambridge researcher wanted to know if the fan was bugged.
Source: ‘Suspicious’ USB fan given out at Trump-Kim summit deemed safe | ZDNet
What happens when there’s things are fully automated with no manual override.
In the relentless drive towards cost-cutting and automation I won’t be surprised if we see more instances of such problems.
At least a year later, I can sit here and write about it without feeling too embarrassed. So that’s the story about the machine that fired me and no human could do anything about it.
Source: The machine Fired me
A collection of eye-opening NTFS tricks to do things that you normally can’t.
TRICK 1: CREATE FOLDERS WITHOUT PERMISSIONS (CVE-2018-1036/NTFS EOP) On Windows you can assign “special permissions” to folders like permissions that a user is allowed to create files in a folder, …
Be careful what you install, even if it’s from the official app/repository store. This also goes for browser extensions, docker images, Notepad++ add-ons, etc.
Oh, snap! Just because some packages are available to install directly from the Ubuntu Software Center doesn’t make them safe. This is proved by a recent discovery of malware in some snap packages from the Ubuntu Snaps Store.
Source: Malware Found In The Ubuntu Snap Store – Linux Uprising Blog
This is the classic DDoS attack, but with a twist. Instead of spamming servers through the Internet, someone is spamming phone lines through a phone botnet. Similar to DDoS, this makes it difficult for legitimate calls to go through.
Candidates for Malaysia’s 14th general election have claimed that their phones have been hacked and spammed with calls from overseas numbers.
Source: Malaysia general election candidates slam ‘dirty trick’ spam calls; Najib orders action
Your mobile phone may be hacked when visiting a hostile website. Researchers have used the Rowhammer attack to successfully run unauthorized code.
JavaScript based GLitch pwns browsers by flipping bits inside memory chips.
Source: Drive-by Rowhammer attack uses GPU to compromise an Android phone
I’ve been saying this for ages. iOS privacy and app permission handling is superior to Android from the start.
Maybe check your data archive to see if Facebook’s algorithms know who you called.
Source: Facebook scraped call, text message data for years from Android phones
Great news for web security. There’s no excuse not to adopt HTTPS for your website. We have reached the tipping point for HTTPS adoption and hopefully this will encourage the rest to do so.
I totally agree with this article. Email is fine as-is. There’s no need to make it more “interactive” or “engaging” – we have the web for that. Email is one of the last vestige of the open internet that hasn’t been locked down into a walled garden. Please keep it that way.
Google just announced a plan to “modernize” email, allowing “engaging, interactive, and actionable email experiences.” Does that sound like a terrible idea to..
Source: AMP for email is a terrible idea