Archive for November 25, 2022

All Of VW’s Brands Have Halted Ads On Twitter…. And They Are Saying Why They Are Doing That In Public

Posted in Commentary with tags on November 25, 2022 by itnerd

Elon Musk wants to wean Twitter off of advertising by brands. That’s why he’s pushing Twitter Blue so hard. The thing is that until Twitter Blue can generate the revenue stream that advertising generates, he needs advertisers. There’s no way around that. So it doesn’t help that Volkswagen who’s brands include, Audi, Porsche, Skoda, Lamborghini, Bentley, and Ducati have paused their advertising on Twitter. What makes this even more interesting is that they are actually speaking about why they did this:

A spokesperson for Volkswagen said all the brands had followed the advice, while Audi had opted to halt organic activities, such as direct posts, and only respond to questions from clients on the website.

WirtschaftsWoche had previously reported that Audi had halted all activities on the social media platform, citing company sources.

“We are monitoring the situation closely and will decide on the next steps depending on developments,” an Audi spokesperson added in an emailed statement to Reuters.

Audi has not tweeted since Nov. 1 after previously tweeting almost every day. Elon Musk took ownership of Twitter in late October.

Well, that’s not good if you are Elon as VW is a global brand which means that their advertising spend on Twitter must have been big. Thus that’s a lot of income that Twitter is not getting. And you have to wonder if VW going public with this will spur other companies to not only pull their ads, but to say why in public. If that happens, one has to wonder how Elon will react to that. Not well I would imagine. But we will have to see.

July’s Report Of A Twitter Data Breach Was WAY WORSE Than Previously Thought

Posted in Commentary with tags on November 25, 2022 by itnerd

Remember back in July there was a data breach on Twitter where the information on 5.4 million users was up for sale on the dark web? Well as bad as that was, we now have news that it was actually worse than that. 9to5mac is reporting the following:

We’ve been shown evidence that the same security vulnerability was exploited by multiple bad actors, and the hacked data has been offered for sale on the dark web by several sources.

It had previously been thought that only one hacker gained access to the data, and Twitter’s belated admission reinforced this impression …

And:

There were suggestions on Twitter yesterday that the same personal data had been accessed by multiple bad actors, not just one. 9to5Mac has now seen evidence that this is indeed the case. We were shown a dataset which contained the same information in a different format, with a security researcher stating that it was “definitely a different threat actor.” The source told us that this was just one of a number of files they have seen.

That’s really, really, extremely bad. And reading this report makes one wonder how this is going to get any better under Elon Musk? Because it is pretty clear that Twitter’s security was bad before he took over. So given all that has gone on, how much worse can it be with him in charge? While Twitter doesn’t have a PR department anymore, the company needs to provide some answers on this. And they need to do so now with enough detail to reassure Twitter users that they can have confidence in the company. But I am pretty sure that this is not going to happen.

UPDATE: I have commentary from Brian Johnson, Chief Security Officer at Armorblox:

“Breaches that expose email addresses and phone numbers are almost always followed up by targeted phishing and SMiShing campaigns. Given that Twitter has also been in the news a lot recently, attackers might exploit our cognitive biases like recency bias to send out fake password reset emails or SMSes to Twitter users to steal their credentials. Stolen passwords now allow them to try these passwords out laterally across other sites because many users use the same password across different providers. We recommend that users set up multi-factor authentication on all their personal and work accounts, and more specifically, watch out for suspicious emails that appear to be coming from Twitter. This includes verifying the sender email addresses, and any links that are included in the email to make sure that they are indeed related to Twitter.”

UPDATE #2: Chad McDonald, Chief of Staff and Chief Information Security Officer of Radiant Logic:

“In the latest episode of the Twitter saga, news of the significant data breach resulting in the security expert who reported it being suspended is a huge cause for concern. Security practitioners have often looked to Twitter in the past for updates from colleagues and influencers alike on the latest bugs, vulnerabilities and threat groups. Given the changes that have been brewing at Twitter these last few weeks, it would be incredibly damaging for them to not only be once again responsible for massive amounts of users being breached but that they are also making efforts to cover it up. Twitter must act, quickly, to get a serious handle on how much of their users’ information was leaked and what they plan to remedy the situation.” 

Nine out of 10 Canadian Organizations Were Breached At least Once in the Past Year: Trend Micro

Posted in Commentary with tags on November 25, 2022 by itnerd

Trend Micro Incorporated today announced that 90% of Canadian organizations have had customer records compromised at least once over the past 12 months as they struggle to profile and defend an expanding attack surface. 

The findings come from Trend Micro’s semi-annual Cyber Risk Index (CRI) report, compiled by the Ponemon Institute from interviews with over 4,100 organizations across North America, Europe, Latin/South America, and Asia-Pacific, of which 470 are Canadian.

The CRI calculates the gap between organizational preparedness and the likelihood of being attacked, with -10 representing the highest level of risk. The Canadian CRI index moved from + 0.16 in 2H 2021 to image002.png0.30 in 1H 2022, indicating a surging level of risk over the past six months. 

This trend is also reflected elsewhere in the data: the number of Canadian organizations experiencing a “successful” cyber-attack increased from 83% to 93% over the same period. Unsurprisingly, the number now expected to be compromised over the coming year has also increased from 74% to 86%.

Some of the top preparedness risks highlighted by the index report are related to attack surface discovery capabilities. It is often challenging for security professionals to identify the physical location of business-critical data assets and applications.

From the business perspective, the biggest concern is the misalignment between CISOs and business executives. Based on the scores given by the respondents, “My organization’s IT security objectives are aligned with business objectives” only has a score of 4.35 out of 10.

Overall, Canadian respondents rated the following as the top cyber threats in 1H 2022:

1)      Advanced malware

2)      Cryptomining

3)      Watering hole attacks

4)      Botnets 

5)      Business Email Compromise (BEC)

By addressing the shortage of cybersecurity professionals and improving security processes and technology, organizations will significantly reduce their vulnerability to attacks.

To read a full copy of the latest Cyber Risk Index, please visit: www.trendmicro.com/cyberrisk

Elon Musk Will Offer Amnesty To Suspended Twitter Accounts… While He Gives New Details About Twitter Blue

Posted in Commentary with tags on November 25, 2022 by itnerd

In a move that is sure to spark new alarm bells about Twitter becoming the platform of the far right, Elon Musk via yet another Twitter poll is going to restore suspended Twitter accounts.

By running these polls, he’s creating a situation where he’s creating cover for himself when, key word WHEN things go off the rails when it comes to these suspended accounts. After all, many of these accounts are anti-vaxxers, Neo-nazis, white supremacists, anti-LGBTQ activists, anti-Muslim bigots among other low life scumbags of the universe who don’t deserve a platform. So I can see that this will create a situation where the holders of these accounts make news for all the wrong reasons, and Twitter will get blamed for giving them a voice. Musk therefore will just use the excuse that “the people have spoken” when confronted with that. This despite the fact that this was likely his plan all along.

Another thing is, despite the fact that he makes moves that are this stupid, he still doesn’t get why advertisers are running in the other direction from Twitter. The answer is pretty simple, they don’t want to be associated with a platform that allows hate speech, which is something that has increased since Musk took over. But he’s too stupid to see that quite clearly.

Finally, this move is guaranteed to have the EU knocking on his door demanding answers. And if Musk doesn’t play ball with them, that will end badly for Musk.

The other thing that Musk did overnight is put out this Tweet:

The way I read this Tweet, he has no choice. He clearly wanted Twitter Blue to be a quick revenue generating method by giving it to anyone with few controls. But when that went off the rails and sent corporations to the exits, it backed him into a corner where he now has no choice but to introduce some form of verification process. And I sense he’s clearly not happy about this. It’s not clear how this will work from the Tweet. But it will be interesting to see what happens next Friday when it launches. It does open up an interesting question, if you have a checkmark and you don’t pay for Twitter Blue, what happens to you? I guess we will find that out next Friday as well.