At a glance.
- Twitter warns of possible developer data compromise.
- Baltimore's ransomware attack may have been a trendsetter.
- GDPR compliance as phishbait.
- Airbnb fixes its communications bug.
Twitter warns that developer data may have been compromised.
Social media giant Twitter has informed its developers that their private access keys and tokens might have been compromised, reports TechCrunch. Twitter notified developers via email that, due to a system bug, the keys and tokens which allow developers to access the network and interact with development software might have been temporarily stored in the browser cache and that, if that cache were accessed by an intruder during the appropriate timeframe, the data could have been stolen. While the bug has been fixed and there is not yet any evidence that the sensitive info was seen, Twitter warned those possibly affected out of the proverbial abundance of caution.
Baltimore ransomware extortion attack broke new ground.
StateScoop reports that the May 2019 ransomware attack on the US City of Baltimore‘s government network included a second phase that was innovative at the time, according to the findings of cybersecurity company CrowdStrike. Not only did the breach cripple the city’s operations for weeks, but the attackers, using RobbinHood ransomware, also threatened to publish sensitive stolen files if the mayor did not send the requested ransom of $76,000. Though Baltimore officials refused to pay, this act of data extortion, which CrowdStrike has dubbed “Outlaw Spider,” is noteworthy because it was one of the first examples of attackers using this now commonplace tactic.
Phishing scam uses GDPR as bait.
Area 1 Security reports it has discovered a new phishing scam in which the attacker sends an email attempting to convince the recipient that their system is not compliant with the European Union’s General Data Protection Regulation (GDPR). By spoofing the sender address field to make it appear as if the email originated from an internal security department, the scam takes advantage of the fact that many users are unfamiliar with the details of GDPR compliance and may therefore be worried enough (or curious enough) to click. The scheme targets front-facing company email addresses or those of executives in sales positions, employees most likely to have access to client data, and then directs the recipient to a WordPress site that, when accessed, harvests the victim’s credentials.
Airbnb has fixed its communications bug.
Home rental company Airbnb has corrected a glitch, discussed in the CyberWire last week, that erroneously allowed rental owners to view private messages and booking details of other account holders, the Register reports. Though the bug appears to be the result of an internal tech error versus the action of intruders, users were nonetheless understandably concerned about the privacy of their data on the website. "We fixed the issue quickly and are implementing additional controls to ensure it does not happen again," Airbnb told the Register.