This week in InfoSec shows that you’re always running a vulnerability Rant of the Week is a politically insensitive wiretap Billy Big Balls is an example of governments taking on big tech Industry News is the latest and greatest news stories from around the world And Tweet of the Week is all about the points
This week in InfoSec (11:25)
With content liberated from the “today in infosec” twitter account and further afield
12th September 2014: Stephane Chazelas contacted Bash maintainer Chet Ramey about a vulnerability he dubbed "Bashdoor", which later becoming known as Shellshock. It was publicly disclosed 12 days later.
Shellshock was kind of a big deal - and the vuln had been in Bash for 25 years!
https://x.com/todayininfosec/status/1834293229472416242
9th September 2001: Mark Curphey started OWASP (the Open Web Application Security Project). In 2023 it was renamed the Open Worldwide Application Security Project.
https://x.com/todayininfosec/status/1833191889790480500
Rant of the Week (16:33)
WhatsApp's 'View Once' could be 'View Whenever' due to a flaw
A popular privacy feature in WhatsApp is "completely broken and can be trivially bypassed," according to developers at cryptowallet startup Zengo.
According to cofounder Tal Be'ery, his team was building a web interface when they discovered a flaw in WhatsApp's View Once. While the feature was supposed to be limited to platforms where the necessary controls could be enforced, such as mobile clients, the WhatsApp API server didn't properly enforce it.
The server would still send these messages to other platforms, but they couldn't be viewed - unless someone fiddled with the code.
"The View [O]nce media messages are technically the same as regular media messages, only with the “view once” flag set," the technical explanation states.
"Which means it’s the virtual equivalent of putting a note on the picture that says 'don’t look.' All that is required for attackers to circumvent it, is merely to set this flag to false and the media become regular and can be downloaded, forwarded and shared."
Billy Big Balls of the Week (27:10)
Australia’s government spent the week boxing Big Tech
The fun started on Monday when prime minister Anthony Albanese announced his intention to introduce a minimum age for social media, with a preference for the services to be off limits until kids turn 16.
"I want kids to have a childhood," the PM urged. "I want them off their devices … I want them to have real experiences with real people."
Albanese promised legislation to enact the rule will be tabled before Australia's next election, due by 2025. Opposition leader Peter Dutton broadly supported the proposal, which is pitched at parents who are tired of having to protect their kids online.
Industry news (34:34)
DoJ Distributes $18.5m to Western Union Fraud Victims
Poland's Supreme Court Blocks Pegasus Spyware Probe
UK Recognizes Data Centers as Critical National Infrastructure
Mastercard Acquires Global Threat Intelligence Firm Recorded Future for $2.65bn
TfL Confirms Customer Data Breach, 17-Year-Old Suspect Arrested
Irish Data Protection Regulator to Investigate Google AI
Microsoft Vows to Prevent Future CrowdStrike-Like Outages
Record $65m Settlement for Hacked Patient Photos
Malicious Actors Spreading False US Voter Registration Breach Claims
Tweet of the Week (41:57)
