.png)
We have some juicy news for you today, including a massive data leak, new malware and vulnerabilities and an interesting story released by our favourite Krebsonsecurity. Let's take a look at what happened this week.
1. Another massive blow for the US police departments after a data leak exposed 270 GB of confidential information including police officer's names, email addresses, phone numbers, FBI reports and many more. The collection of data was released to the public by Distributed Denial of Secrets, an alternative to WikiLeaks. As reported, the material could expose sensitive law enforcement investigations and even endanger lives, while it is unknown if they will reveal any police misconduct situations.
2. Moving on, ESET researchers discovered new Android ransomware disguised to be an official COVID-19 tracing app provided by Health Canada. The malicious app encrypts the files on the device and then leaves a Readme.txt file in every directory urging the user to read it. Fortunately, the researchers were able to identify a flaw in the coding of the malicious app and release software that decrypts the affected files.
3.IBM has patched four zero-day vulnerabilities in its Data Risk Manager product. What's interesting about this story is that IBM refused to release a patch when the vulnerabilities were disclosed to them. Only after the exploit code was available, they finally patched them. Three of the four vulnerabilities can be combined to achieve remote code execution as root, while the remaining vulnerability allows someone to download arbitrary files from the system.
4. Krebsonsecurity released an interesting article describing how malicious actors can enable multi-factor authentication on a compromised account to make it more difficult for the user to regain access to their account. As cybersecurity professionals, we suggest that you always enable multi-factor authentication on your devices and accounts to ensure their safety.
5. Last but not least, Nvidia warns its users for several high-severity flaws in it's Nvidia GPU display drivers. Attackers can exploit the flaws to launch a DoS attack, gain escalated privileges or view sensitive information. Thankfully a patch has been released addressing all of the aforementioned vulnerabilities. We highly suggest Nvidia users download and install the latest update to their driver from here or the Nvidia GeForce Experience app.
