Feb 20 2023
Welcome to Gone Phishing, your daily cybersecurity newsletter that’s got more lolz than the BAFTAs has cringe.
Today’s hottest cyber security stories:
Here’s one for the commuters, or anyone who’s ever driven through Slough, God forbid. We came across a fun little device called Flipper. Well, Flipper Zero, to be precise.
It’s marketed as a fun tool for ‘geeks’ to mess around with, hacking into radio protocols and bits of hardware etc.
And yeah, apparently the clever little thing is even capable of hacking into traffic light systems and flipping them, so to speak.
It does in the same way that emergency services can, by shining an infra-red light into a special sensor on the traffic lights to recombobulate the signal. Cool, huh?
They say: Flipper Zero is a portable multi-tool for pentesters (penetration testers – probing IT systems for weak spots), and geeks in a toy-like body.
It loves hacking digital stuff, such as radio protocols, access control systems, hardware and more.
It’s fully open-source and customizable, so you can extend it in whatever way you like.
We say:
A fun little toy to mess around with that could be also useful as a tool for testing systems for vulnerabilities. Probably more the first one, though, to be honest. We wouldn’t recommend actually going out and using this thing to change traffic lights from red to green. You could find yourself in a spot of bother.
Cool device, nonetheless!
Can you Adam-and-Eve it? Audacious hackers have targeted the FBI (Federal Bureau of Investigation), and it’s the second time in 15 months. The cheek of it!
FYI, there’s no indication that the two breaches are connected.
This latest attack took place last week with the FBI formally announcing it on Friday. The U.S. agency said it was an ‘isolated’ incident which has been ‘contained’.
#PizzaGate 2.0?
Probably the most notable (and creepy/disgusting/disturbing) thing about this is that the computer system that was targeted and subsequently compromised was one that was actively being used in the investigation of child sexual exploitation.
This is information that CNN managed to verify from two separate sources within the bureau. So, was it threat actors looking to throw the FBI off their scent and essentially cover their tracks. That’s certainly what it looks like…
Thankfully, the FBI has contained the attack and presumably we’ll know more in due course. Still, makes your skin crawl, doesn’t it?
Not the first time…
In November 2021, threat actors used a legitimate email address that the FBI uses to communicate with state and local law enforcement to send phony emails to thousands of organizations about a fabricated cyber threat.
Spam email impersonating the FBI (Spamhaus)
The FBI said at the time that it fixed a vulnerability related to the incident, but the bureau never publicly named a suspect.
Makes you think… Is anybody safe? And is nothing sacred? Scammers gonna scam, yo.
Top web hosting company GoDaddy has been hacked. It has reported a security breach in which its cPanel shared hosting environment was breached by unknown attackers.
The threat actors stole source code and installed malware on GoDaddy’s servers in a prolonged attack in a yearslong attack.
GoDaddy is world’s largest domain registrar. It works closely with WordPress and other popular hosting platforms to serve more than 20 million customers globally.
The company became of the attack back in December 2022 thanks to self-reporting from customers. Not a great look for GoDaddy that its customers knew before it did, but then again that’s kind of the nature of domain- hosting.
The attack was similar to ones we’ve covered before. The malware mimics well-known and trustworthy sites but when unsuspecting victims click the links, they are redirected to infected landed pages. Gross.
Additionally, a data breach took place thanks to a compromised password. This ended up affecting about 1.2 million WordPress users.
They gained access to the following information:
It just goes to show, you can’t be too careful these days. Stay safe out there, true believers.
And remember, if it smells phishy, don’t click!
So long and thanks for reading all the phish!
