slack breach 02

Don’t panic, Slack’s GitHub has been hacked

WhatsApp has launched a new anti-censorship tool it hopes will help people in Iran avoid government-imposed blocks on the messaging platform. The company has allowed people to do this use proxies to access WhatsApp and avoid government filtering. The tool is available globally. We also have explained what pig slaughter scams are and how to avoid falling into their traps.

Also this week, cybersecurity firm Mandiant revealed that it has seen a Russian cyber-espionage group Turla uses new innovative hacking tactics in Ukraine. The group, believed to be linked to the FSB intelligence agency, has been spotted on the backs of dormant USB infections from other hacker groups. Turla registered out-of-date domains of years-old malware and managed to take over her command-and-control servers.

We have also reported the ongoing consequences of hacking EncroChat. In June 2020, police across Europe revealed that they had breached EncroChat’s encrypted phone network and collected more than 100 million messages from its users, many of them potentially serious criminals. Now thousands of people have been jailed based on the information gathered, but the arrest is raising wider questions around law enforcement hacking and the future of encrypted phone networks.

But that is not all. Every week we round up the security stories we haven’t dug into ourselves. Click on the titles to read the full stories. And stay safe out there.

Slack suffered a data breach on New Year’s Eve

On December 31st, as millions of people were preparing for the start of 2023, Slack has posted a new security update on its blog. In the post, the company says it has discovered a “security issue involving unauthorized access to a subset of Slack’s code repositories.” As of Dec. 27, it discovered that an unknown threat actor had stolen Slack employee tokens and used them to access its external GitHub repository and download some of the company’s code.

“When we were notified of the incident, we immediately invalidated the stolen tokens and began investigating the potential impact on our customers,” Slack’s disclosure says, adding that the attacker did not have access to customer data and users of Slack don’t have to do anything.

The incident is similar to a December 21 security incident revealed by authentication firm Okta, as a cybersecurity reporter Notes by Catalin Cimpanu. Just before Christmas, Okta revealed its code repositories had been accessed and copied.

Slack quickly discovered the incident and reported it. However, as noted by Computer that plays, Slack’s security disclosure didn’t appear on his usual news blog. And in some parts of the world, the company has included code to prevent search engines from including it in results. In August 2022, Slack forced a password reset after a bug exposed hashed passwords for five years.

Police facial recognition used to arrest the wrong man, yet again

A black man in Georgia has spent nearly a week in jail after police reportedly relied on a facial recognition match that was incorrect. Louisiana police used the technology to obtain an arrest warrant for Randal Reid in a burglary case they were investigating. “I’ve never been to Louisiana a day in my life. Then they told me it was for theft. So not only have I not been to Louisiana, but I also don’t steal,” Reid told the local news site Nola.

The publication claims one detective “took the algorithm at face value to get a warrant,” and says little is known about police use of facial recognition technology in Louisiana. The names of any systems used were not disclosed. However, this is just the latest case facial recognition technology used in wrongful arrests. While the police use facial recognition the technology quickly spread across the United Statesresearch has repeatedly shown that he misidentifies black people and women more frequently than white men.

Russia blames cell phone data for rocket attack

On the first day of this year, Ukraine launched its deadliest rocket attack on invading Russian troops to date. An attack on a temporary Russian barracks in Makiivka in the Russian-occupied Donetsk region has killed 89 soldiers, the Russian defense ministry said. Ukrainian officials say about 400 Russian soldiers have been killed. The Russian Defense Ministry later said the location of the troops was identified because they were use of cell phones without permission.

During the war, both sides said they were able to intercept and locate phone calls. While Russia’s latest statement should be treated with caution, the conflict has highlighted how open source data can be used to target troops. Drones, satellite imagery and social media posts have been used to monitor people on the front lines.

Porn sites now require a user ID in Louisiana

A new law in Louisiana requires porn sites to verify the age of state visitors to prove they are over 18. The law says that age verification must be used when a website contains 33.3% or more pornographic content. In response to the law, PornHub, the world’s largest pornographic website, now offers people the option to attach your driving license or ID through a third-party service to prove that you are of legal age. PornHub says it does not collect user data, but the move has raised surveillance fears.

All over the world, countries are introducing laws requiring visitors to porn sites to prove they are old enough to view the explicit material. Lawmakers in Germany and France have threatened to block porn sites if they do not implement the measures. Meanwhile, in February 2022 Twitter has started blocking creators of adult content in Germany because age verification systems were not in place. The UK sought to introduce similar age control measures between 2017 and 2019; however, the plans fell through due to confusion of administrators of pornographic websites, design flaws and fears of data breaches.

Russian spies in Europe classified

The world of spies is, by its very nature, cloaked in secrecy. Nations deploy agents in countries to gather intelligence, recruit other resources, and influence events. But sometimes these spies get caught. Since Russia’s full-scale invasion of Ukraine in February 2022, more Russian spies across Europe have been identified and expelled from countries. A new database by open source researcher @inteltakes has been collecting known cases of Russian spies in Europe since 2018. The database lists 41 uncovered spy entries and, where possible, details each resource’s nationality, profession and service from which they were recruited.