Original research: https://www.jamf.com/blog/tcc-bypass-steals-data-from-icloud/

For now, the threat actor is just claiming that they hacked BT. No prove whatsoever. Groups usually post a sample of the data when they claim a victim, but that is not the case, for now.

If you are asking if the main attack vector was phishing, they are not clear on that:

According to statements released by Brain Cipher, they have exploited critical weaknesses within Deloitte UK’s cybersecurity infrastructure.

Welcome! I dont know you background, but I would suggest get into selfhosting. There are several projects related to cybersecurity, fun and useful. Ex: MISP, Pihole, The Hive.

Nevertheless: https://www.crowdstrike.com/en-us/blog/crowdstrike-fortinet-partnership-unifies-endpoint-firewall-protection/

That’s why I don’t use Kaspersky :)

In my opinion, you will always be at the mercy of a government in this context: US, China, Russia. In the end it’s a matter of choosing which one. FOSS maybe a little less, but in the end it’s almost the same. That’s my view, of course. That doesn’t mean you can’t give them a hard time ;)

This one does not spark joy.

Update: Israel Planted Explosives in Pagers Sold to Hezbollah, Officials Say (https://www.nytimes.com/2024/09/17/world/middleeast/israel-hezbollah-pagers-explosives.html)

You can use https://tails.net/ booting from another flash drive in memory only.

Take that with a grain of salt.

Agreed

I like to use the 2013 Target breach case. They lost $1 billion due to the attack, their stocks dropped significantly after the attack, had several lawsuits, they closed a few stores, and changed the CEO and CIO. But a few months later, all was forgiven, their stocks recovered, and life went on.

Don’t get me wrong, the risks of a cyber attack have to be taken seriously. But I feel that I have overestimated the impacts of reputational damage my whole life, as an infosec professional. My thinking was always like this: if you get reputational damage, you are done, no chance to recover, it is the end of it.

I’m following the Crowdstrike case, but I would bet that they will lose some market share (mostly prospects), perhaps some layoffs, but stocks will come up eventually.

Not as much as if it contained passwords, for sure. Bu it gives a nice mailing list for phishing and so on.

Depends of the country. Disrupt with Internet/communications may be a crime in some countries.

Kudos to SOC team.

CrowdStrike report of the incident: https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/

Well, depends. If the user go to a captive portal to “authenticate” before the VPN could closes, than no. But, if the VPN can “pierce” through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.

Update: https://sh.itjust.works/post/21631053

Yes.

303,481 servers worldwide, according to Shodan.