Born's Tech and Windows World

[German]A dashboard used to manage the database of Shanghai police authorities was not secured by a password for over a year and could be freely accessed via the Internet. This is likely the cause of the recently leaked Shanghain Police Files, which reveal data on over 1 billion Chinese visitors. The whole thing is hosted in the Alibaba Cloud, using – according to experts – outdated technology with security problems. Something rings a bell in the back of my head, some places in Europe (e.g. Switzerland) rely on the Chinese cheap cloud for data storage. Details on the above case and the open database can be found in the blog post Hacker sells 1 billion personal data from Shanghai police data base for 10 bitcoins.

[German]The Log4Shell vulnerability in the Log4j library, which can be exploited in Java, is presumably present in many systems and software packages. The problem is likely to affect us for years to come, experts estimate, and it has not yet reached SMEs. The Department of Homeland Security (DHS) also addressed the Log4j issue again this week in a recommendation.

Continue reading →

[German]Cyber criminals are promoting a tool on social networks that can be used to crack passwords in industrial control systems (ICS, PLCs). This is certainly useful for technicians who need to access PLCs (Programmable Logic Controllers) or ICSs (Industrial Control Systems) but no longer know the access data. The problem: The advertised password cracking tool is contaminated with the Sality malware, and the attackers use it to infect the PLCs or ICS.

Continue reading →