Cybersecurity Expert

Twitter boss, Jack Doresy, had his Twitter account was hacked at the end of August, with hackers using his account to send a stream of offensive messages to his 4.2 million followers. It appears Jack was using his mobile phone to provide multi-factor authentication access to his Twitter account, a good solid security practice to adopt, however, it appears his Twitter account password and his mobile phone SMS service were both compromised, the latter probably due to either sim card swap fraud social engineering by the hacker, or by an insider at his mobile network service provider. A database holding over a million fingerprints and personal data was exposed on the net by Suprema , a biometric security company. Researchers at VPNMentor didn't disclose how they were able to find and access the 'Biostar 2' database, nor how long the data was accessible online. Biostar 2 is used by 5,700 organisations, including governments, banks and the UK Metropolitan Police. In a similar...

July was a month of mega data privacy fines. The UK Information Commissioners Office (ICO) announced it intended to fine British Airways £183 million for last September's data breach , where half a million BA customer personal records were compromised. The ICO also announced a £100 million fine for US-based Marriot Hotels after the Hotel chain said 339 million guest personal data records had been compromised by hackers. Those fines were dwarfed on the other side of the pond, with  Facebook agreeing to pay a US Federal Trade Commission (FTC) fine of $5 billion dollars , to put the Cambridge Analytica privacy scandal to bed . And Equifax paid $700 million to FTC to settle their 2017 data breach, which involved the loss of at least 147 million personal records . Big numbers indeed, we are seeing the big stick of the GDPR kicking in within the UK, and the FTC flexing some serious privacy rights protection punishment muscles in the US. All 'food for thought' when performing cy...

May 2019 was the busiest month of the year for critical security vulnerabilities and patch announcements. The standout was a  Microsoft critical security update for Windows, rated with a CVSS score of 9.8 of 10 . This vulnerability fixes  CVE-2019-0708  aka 'BlueKeep', which if exploited could allow the rapid propagation of malware (i.e. worm) across networked devices, similar to the devastating WannaCry ransomware attacks of 2017 .  Such is the concern at Microsoft, they have released BlueKeep patches for their unsupported versions of Windows (i.e. XP, Visa, Server 2003) , a very rare occurrence. Researchers at Errata Security said they have found almost one million internet-connected systems which are vulnerable  to the BlueKeep bug. A zero-day Microsoft vulnerability was also reported by an individual called 'SandboxEscaper ', which I expect Microsoft will patch as part of their monthly patch cycle in June.  And a past Microsoft vulnerability, CVE-201...