SECURITY TRENDS: Pandemic fuels security M&As

There has been an increase in mergers and acquisitions in the security industry, fueled by more security threats and a shift to remote working brought on by the COVID-19 pandemic, observed WatchGuard CEO Prakash Panjwani.

Panjwan predicts that the security market will continue to see an uptick in M&As for the rest of the year... 

To read more, sign up for our 14-day free premium content trial! 

Close to 200 million user profiles from Instagram have been exposed online by an unsecured database, according to Bob Diachenko, a security researcher at Comparitech. In addition, the researcher found 42 million user profiles for TikTok and four million profiles for YouTube users on the database. The database was maintained by Hong-Kong-based Social Data, which took down the server hosting the database after being notified by Diachenko.

More from Comparitech:

• The exposed data came from Deep Social, a defunct company that scraped user profiles from social media sites, according to Diachenko's analysis. 
• Each record contained the user's name, photo, age, gender, account description, and statistics about follower engagement, and one in five contained phone numbers or email addresses.
• Comparitech warned that attackers could use the database to launch spam marketing and phishing campaigns. 
• Deep Social went out of business in 2018 after Facebook banned it from its marketing API for scaping user profiles.

Microsoft has rushed out emergency patches for critical Windows Remote Access bugs in Windows 8.1 and Windows Server 2012 R2. A remote attacker could exploit the bugs to carry out privilege escalation attacks. Microsoft is urging users to update their machines as soon as possible. 

More:

• Microsoft patched the same vulnerabilities in other versions of Windows in its August Patch Tuesday security update.
• To fix the flaws, Microsoft corrected the way in which Windows Remote Access deals with memory so that it properly handles file operations.
• In total, Microsoft patched 120 security bugs in its products and services on Patch Tuesday, including 17 critical flaws.

TO KEEP UP TO DATE WITH THE LATEST PATCHES FROM LEADING VENDORS, GET MY PATCH WATCH COLUMN FOR PREMIUM SUBSCRIBERS. Click here to upgrade to premium!

A memory leak bug in the IBM Db2 relational database could enable a hacker to access sensitive data or cause a denial of service condition, warned researcher Martin Rakhmanov at Trustwave's SpiderLabs. The flaw affects IBM Db2 versions for Linux, UNIX, and Windows (9.7, 10.1, 10.5, 11.1, 11.5) and stems from improper usage of share memory. IBM issued a patch from the bug in June.

More from SpiderLabs: 

• Rakhmanov observed that developers didn't put explicit memory protections around the shared memory used by the IBM Db2 trace facility.
• As a result, any local users can get read and write access to the memory area, enabling the user to access sensitive data and change how the trace subsystem functions.
• The researcher discovered a similar flaw in the Cisco WebEx Meetings Client on Windows.

Cisco patched a critical default credentials bug in its Wide Area Application Services (WAAS) products that could enable an attacker to gain administrator privileges on a network. The components affected by the flaw include Cisco Cloud Services Platform for WAAS (CSP-W) and Cisco Enterprise Network Computer System (ENCS). 

More:

• The CSP-W is an open hardware platform for deployment of Cisco datacenter network functions virtualization. 
• The ENCS is a hybrid platform for branch deployment and hosting WAAS applications.
• Cisco also patched high-severity bugs in its Smart Software Manager On-Prem and Video Surveillance 8000 series IP cameras.

Every Thursday, I summarize a podcast about cybersecurity so you can read it in about five minutes or less. This week features Rachel Tobac, CEO and co-founder of SocialProof Security, who spoke with Dave Bittner of the Hacking Humans Podcast (#112) about the Twitter hack and the fallout from that mega-breach. [Note: Questions and answers were edited for brevity and clarity.] 

Dave Bittner: I reached out to Rachel Tobac, CEO and co-founder of SocialProof Security, to get her insights on the recent Twitter hack.

Rachel Tobac became aware of the Twitter attack about an hour into it. She first saw that former President Barack Obama had tweeted out a link to a bitcoin opportunity where he would double any contribution. She thought that the offer seemed suspicious. Then she saw that Elon Musk had tweeted out the same offer. People were tweeting, wondering if they didn't have multifactor authentication (MFA) on their accounts. She thought that there was no way that former President Barack Obama and Elon Musk both did not have MFA on their accounts. So she deduced a couple of predictions using Occam's razor...

To read more, click here to upgrade to premium!

QUICK HITS:

• Trend Micro's Zero-Day Initiative (ZDI) has awarded $25M to security researchers in bug bounties over the past 15 years. 
• The Transparent Tribe APT is targeting government and military organizations in India and Afghanistan by infecting USB devices.
• COVID-19-inspired remote work has lead to data breaches at 20% of organizations, according to a Malwarebytes Labs study.
• A cryptomining worm aims to steal credentials of Amazon Web Services, warned Cado Security.
• Fuzzing services provide in-depth code checks for unknown vulnerabilities.
• Vidyard and Hubspot have partnered to create an in-depth guide with proven video scripts and email templates for selling remotely.*

* This is sponsored content.