Git Code Repos Held to Ransom – Thousands Hacked

Git Hit

Many private Git repositories are at risk of being leaked to the public. Anonymous hackers have wiped victims’ code and are demanding Bitcoin.

Or else? Or else they’ll open-source it for you. And then everyone will be able to see your soopah-sekrit sores, bruh.

But how? The way they broke in is making many scratch their head: It seems people had been publishing their GitHub, GitLab or BitBucket credentials on the web.

FAIL! You could say that. In today’s SB Blogwatch, we furiously facepalm.


Read more: securityboulevard.com/2019/05/git-code-repos-held-to-ransom-thousands-hacked

Dell Hell Gets Hotter via Bad Bug in Every PC, Laptop

RCE FAIL

Every Dell endpoint running Microsoft Windows has a nasty remote-code execution vulnerability. The security hole is in the SupportAssist module.

Amazingly, Dell figured it would be great to allow a web page to take full control of a PC—admin privileges and all. Bypassing the tool’s minimal checks turns out to be trivial.

To top it off, it took Dell six months to fix this vulnerability. In today’s SB Blogwatch, we rush to install the patch.


Read more: securityboulevard.com/2019/05/dell-hell-gets-hotter-via-bad-bug-in-every-pc-laptop

Huge US data leak from Microsoft cloud; 65% of households at risk

Azure ’ad enough yet?

Yet another cloud database with no security. And this one’s enormous.

This time, Microsoft was discovered hosting an 80 million-row, open database of US adults aged over 40. We still don’t know who owns the data, but some speculate shadow IT is to blame.

Obviously, Microsoft bears no responsibility whatsoever for this fantastic faux pas. The unprotected dataset is stuffed full of PII, and represents about 65% of US households.

Let that sink in for a moment: sixty-five percent. In this week’s Security Blogwatch, we’re fed up with feeling déjà vu.


Read more: techbeacon.com/security/huge-us-data-leak-microsoft-cloud-65-households-risk

Did Huawei Hide Backdoors in Telco Kit? Or Is This More Bloomberg BS?

Useful Idiots are Useful

Today’s revelation that Huawei put backdoors into telecom equipment is perfectly shocking. But is the story all that it seems?

Yes, it’s Bloomberg again, trying to sound authoritative about security. But, some say, failing spectacularly.

Remember last year’s hilarious “spy chip” story? In today’s SB Blogwatch, we don’t forget.


Read more: securityboulevard.com/2019/04/did-huawei-hide-backdoors-in-telco-kit-or-is-this-more-bloomberg-bs

Alexa! Why Are You Stalking Me? (Did Amazon Lie?)

Amazon’s Alleged Artifice

Amazon whistleblowers say thousands of Alexa team members supposedly can see your precise location. But just two weeks ago, didn’t the company pinky-swear they couldn’t?

Oh, and these teams include many employees and contractors in low-wage, overseas economies. Which might raise further questions of trust and safety.

Well, duh. In today’s SB Blogwatch, we pull the plug on the Echo and its ilk.


Read more: securityboulevard.com/2019/04/alexa-why-are-you-stalking-me-did-amazon-lie/