Winter Olympics mascots in Pyeongchang. Image: Scharfsinn/Shutterstock
From the Winter Olympics to US newspaper databases being held to ransom, it’s your weekly cybersecurity digest.
Thousands of websites were infected with Coinhive’s Monero miner on 11 February, including major UK and US government addresses. The malware was especially sneaky as it was injected silently into a popular extension, Browsealoud.
Meanwhile, Google is cracking down on HTTP sites, and webmasters now only have until July to switch to safer HTTPS and avoid their websites being marked as ‘not secure’.
Notoriously private with its source code, Apple was also busy on the infosec front, as it had to deal with a major leak in recent days.
The mystery of the Winter Olympics
The Winter Olympics are well underway and, of course, along with the athleticism comes a side of cyber-espionage. According to Reuters, South Korean officials have admitted that the official website went down just before the opening ceremony on 9 February, with some disruptions to TV and internet systems reported in Pyeongchang.
Authorities are staying tight-lipped on who is behind the attack, with the Russian foreign ministry denying any involvement, while some other experts think North Korea could be the culprit.
Google pays out big money to bug researchers
Google’s Vulnerability Reward Program paid a total of 1,230 rewards to security researchers who spotted vulnerabilities in its products, according to its 2017 yearly review. More than $1m was spent on rewards for catching bugs and vulnerabilities in Google products, with a further $1.1m given for bugs specific to Android OS devices.
The largest individual reward was a massive $112,500, given to researcher Guang Gong, who submitted an exploit chain on Google Pixel phones.
Sacramento Bee gets stung
California newspaper The Sacramento Bee was hit with a ransomware attack, which saw two of its databases on a third-party server seized, with a bitcoin ransom demanded.
First reported on 7 February, the paper ended up deleting the databases entirely. Subscriber phone numbers, addresses, email addresses and names were exposed, as well as some California voter registration data.
Litecoin wins dark web popularity contest
According to threat intelligence firm Recorded Future, Litecoin has emerged as the upcoming cryptocurrency of choice on the dark web. Litecoin is an older cryptocurrency, which was founded in 2011. Bitcoin is still at number one, while Dash rounds out the top three.
Cyber-criminals have lately been voicing their frustration with bitcoin as a payment method due to larger payment fees and slower processing, much of which can be attributed to the current bubble.
Russian scientists used a nuclear facility to mine cryptocurrency
Several scientists at the Russian Federation Nuclear Centre facility in Sarov are suspected of using a supercomputer on the premises to mine bitcoin. The Hacker News reported that the suspects were caught when they tried to connect the lab supercomputer to the internet, which was supposed to be offline to ensure security was maintained.
Are you a WordPress user?
You might want to update your site, according to Graham Cluley, as WordPress 4.9.3 fixed 34 bugs, but also introduced a flaw, meaning automatic background updates will no longer update automatically.
A second update, 4.9.4, was released on 6 February, so it’s worth updating manually to cover yourself.
Winter Olympics mascots in Pyeongchang. Image: Scharfsinn/Shutterstock
