keep moving

More bad news for Volkswagen.

A team of researchers has found that Volkswagen stores secret keys in car components that leave almost all its vehicles since 1995 vulnerable to theft.

Source: A New Wireless Hack Can Unlock 100 Million Volkswagens

Another impressive likely-state-sponsored malware. Data exfiltration from air-gapped machines is the holy grail of the malware world. If they succeeded this will be huge.

The malware—known alternatively as “ProjectSauron” by researchers from Kaspersky Lab and “Remsec” by their counterparts from Symantec—has been active since at least 2011 and has been discovered on 30 or so targets. Its ability to operate undetected for five years is a testament to its creators, who clearly studied other state-sponsored hacking groups in an attempt to replicate their advances and avoid their mistakes.

Source: Researchers crack open unusually advanced malware that hid for 5 years

It has long been known that telephony services like SMS are not secure. When your infrastructure provider is hostile it gets challenging to protect your users.

Iranian hackers have compromised more than a dozen accounts on the Telegram instant messaging service and identified the phone numbers of 15 million Iranian users, the largest known breach of the encrypted communications system, cyber researchers told Reuters.

Source: Exclusive: Hackers accessed Telegram messaging accounts in Iran – researchers

Great, now we’re on BBC for the wrong reasons. This goes totally against the Smart Nation, IoT and cloud movement. The scary prospect is that quasi-government agencies and even private organizations may take a cue from this and do the same.. Expect a strong pushback from the industry. OTOH, server vendors will be very happy 🙂

Singapore says it will restrict access to the internet for public servants from May next year because of information security concerns.

Source: No internet for Singapore public servants – BBC News

Yet another major fail from a hardware vendor. The tl;dr version is this: Asus laptop comes with a software called LiveUpdate that deliver updates from Asus. The problem is it does so insecurely and without proper validation. So that makes it possible for someone to perform MiTM and deliver fake updates.

Source: *indrora->mind — DeadUpdate; Or, How I learned to stop worrying and…