Cryptocurrency Company Hacks Itself Before Hackers Can Hack It
Credit to Author: Brian Barrett| Date: Sat, 08 Jun 2019 13:00:00 +0000
Apple's Worldwide Developers Conference kicked off the week, bringing with it some interesting security enhancements for iOS and macOS users. The company will start offering its own single sign-on option, competing with Google and Facebook but with enhancements those two currently don't offer. And it rejiggered its Find My feature using some very clever cryptography. On the other hand, the company only just now got around to patching a 20-year-old modem bug, and noted macOS hacker Patrick Wardle dropped yet another zero day vulnerability.
There's more than just Apple news of course, even though it sometimes doesn't feel like it. The 2020 election feels far away, but there's still not enough time to make sure the vote is secure. Russia and Iran's plans to cordon themselves off from the rest of the internet continue apace, a dangerous fragmentation. An internet outage rocked the internet last week, thanks to a Google Cloud Catch-22. And an excerpt from Joseph Menn's Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World takes a look at @stake, a hugely influential cybersecurity company founded in 1999.
And there's more! As we do every Saturday, we’ve rounded up the security stories that WIRED didn’t break or cover in depth this week, but that you should know about. Click on the headline to read the full story, and stay safe out there.
Here's something you don't see every day. When the Komodo Platform, a cryptocurrency startup, found out about a backdoor present in its Agama wallet app, it took a somewhat unusual step to protect its customers from getting hacked: It hacked them first, using that backdoor to exfiltrate about $13 million of vulnerable funds before an outside group could. Affected users can reclaim their funds, as soon as they wrap their heads around the fact that they were hacked so that hackers couldn't hack them.
Two separate health care related hacks came to light this week, first of Quest Diagnostics, then LabCorp. Nearly 20 million people have been affected between the two. In both cases, the companies themselves appear not to have been hacked, but rather a third party called the American Medical Collection Agency. If AMCA was more broadly hacked, that could mean far more people are at risk, given just how many major health care providers it services.
Hackers hit Baltimore with ransomware weeks ago, but the incident has only more recently gained national attention. That includes some apparently conflicting reports, some of which claim the attackers used the National Security Agency's leaked EternalBlue tool, others of which insist they did not. The Wall Street Journal this week splits the difference, reporting that there were in fact two hacker groups infiltrating Baltimore's system at the same time—one of which used EternalBlue. At this point, it's hard to know what to believe—and either way, Baltimore appears no closer to getting things back to normal.
Facial recognition technology continues to expand, bringing with it a commensurate sense of unease. But Microsoft took the rare step this week of reversing course on some of its initiatives, deleting a database of 10 million images built from publicly available shots of 100,000 notable people. Microsoft has been a vocal advocate for tighter regulations around facial recognition, but while deleting its so-called MSCeleb database is a nice gesture, the fact that it had been publicly available means copies are almost certainly still circulating online.