Blog

Infosec In Brief A security researcher looking at samples of stalkerware discovered an SQL vulnerability that allowed him to steal a database of 62,000 user accounts. 

Eric Daigle published a blog post this week detailing how he found a piece of stalkerware he wasn’t familiar with, Catwatchful, and then quickly proceeded to pwn it into temporary oblivion. 

Stalkerware or spyware is a form of software used to track people’s computer activity. It is typically installed by parents, spouses, or employers with physical access to the user’s computer, and tends to be undetectable and very hard to remove. The number of stalkerware installations has been steadily on the rise, even as it’s repeatedly been breached by online vigilantes and security researchers. 

According to Daigle, Catwatchful is a spyware kit that promises to be undetectable and unstoppable, with only the controller able to make use of it on an infected device or delete it. While it “works really well” for its intended purpose, Daigle also noted that Catwatchful made two POST requests to separate servers when he tried to log into the app. 

One of the two servers, it turned out, had no appreciable security system installed, allowing Daigle to copy plaintext login details for all 62,000 Catwatchful accounts in the group’s system, including the administrator’s. Oops. 

Working with reporters from TechCrunch, Daigle even managed to help identify the alleged administrator of Catwatchful, as well as get its hosters to take it down.

Unfortunately for its stalkees, Catwatchful has remained online as of this week, Daigle says, with temporary sites stood up to replace seized domains, and patches deployed to address the SQLI vulnerability. 

Another Swiss government partner gets ransomed

The Swiss government said this week that the Radix foundation, an NGO dedicated to healthcare promotion, was hit by ransomware. Given Radix counts a number of government agencies among its customers, the government saw fit to report the matter even though no government data was stolen. 

“As Radix has no direct access to Federal Administration systems, the attackers did not gain entry to these systems at any time,” the Swiss government said – but government data on Radix’s own systems isn’t necessarily safe, mind you. 

While it hasn’t shared how many government documents may have been exposed this time around, it could be a sizable amount. The Play ransomware gang hit a Swiss government IT supplier last year and made off with some 65,000 government files among more than a million more stolen from the biz. 

IDE extension verification is easy to spoof, say researchers

Software supply chain security is a critical part of modern cyber hygiene, and that includes verification of extensions used in IDEs. Unfortunately it’s easy to spoof such verification in several top IDEs, researchers from OX security claim.

Research from the OX team, makers of application-level security products, published research this week showing that verification in VSCode, Visual Studio and IntelliJ IDEA can all be spoofed, allowing for a malicious IDE extension to pass itself off as a trustworthy one. 

“The ability to inject malicious code into extensions, package them as VSIX/ZIP files, and install them while maintaining the verified symbols across multiple major development platforms poses a serious risk,” the OX team said. 

With verification marks no longer sufficient to judge authenticity of IDE packages, OX recommends only installing extensions directly from official marketplaces rather than from files, while extension developers and IDE makers should be sure there are multiple methods of extension signing available to ensure file security. 

It wouldn’t be a roundup without a healthcare breach

Healthcare providers are frequently targeted by data thieves, and for good reason: They’re soft targets, they possess valuable PII, and they often pay up in the case of ransomware. This week’s entrant involves US player Esse Health, based in St Louis, Missouri. 

Esse began letting customers know this week that it had been breached in April, and that data belonging to some 263,601 people was possibly stolen. Data included names, addresses, dates of birth and healthcare information – all the usual stuff – though luckily medical records themselves weren’t stolen. 

Reports from shortly after indicate the attack affected Esse phone systems and forced offices to cancel some appointments due to other outages. 

As is often the case, customers in the firing line are being given some free identity protection service, and the assurance that none of their data has been misused in any way Esse can tell – at least not yet. 

CVE program begs you to help it help itself

Things have been a bit perilous for the Common Vulnerabilities and Exposure of late, with the Trump administration letting funding for the program expire until it was saved, for a moment, via a temporary contract extension. CVE board members were reportedly kept in the dark about the end of the program, and now Congress wants a review of the program to check for mismanagement. 

In other words, there’s enough to do without thinking about how the CVE program might be improved if it doesn’t vanish down the memory hole, which is where you, dear infosec professional, come in. 

The CVE Program has created a pair of working groups, one for security researchers at CVE numbering authorities (CNAs) and another for consumers, which includes basically everyone else. 

Research Working Group members will be working to establish research norms and advising other members of the research community with an aim to “promote the CVE program,” while consumers will work to identify what users of the CVE system want and need “to ensure that the CVE Program remains aligned with real-world use cases.”

Make your voice heard at the links above. ®

Prime Day has become the biggest shopping moment of the year, far outpacing Black Friday, thanks to Amazon’s willingness to slash prices to levels you simply won’t find anywhere else. For this event, Amazon often drops its margins to zero or even sells at a loss, all to attract shoppers with deals that are too good to pass up.

One of the best offers right now in the Electronics category is on the Beats Solo 4 wireless headphones and the best part is that this deal is open to everyone—Prime member or not. At just $99, down from $199, this is the lowest price ever for these headphones, and for a brand like Beats, it’s a deal you really can’t ignore. With a price like this, expect them to fly off the shelves until stock runs out.

See at Amazon

Wireless Headphones

The Beats Solo 4 are wireless Bluetooth on-ear headphones that have earned themselves a loyal following through their sound, comfort and style. At their regular price of $199, they’re already a popular pick, but at $99, they become a true steal. If you’re looking for quality wireless headphones that deliver on both performance and battery life, this is the moment to act.

One of the greatest aspects of the Beats Solo 4 is battery life: With 50 hours of playtime per battery charge, you can listen to music for days without needing to recharge. Such a degree of stamina is wonderful if you’re always on the move. And in the unlikely event you ever do run out, a Quick Charge mode gives you hours of music in a matter of minutes.

Quality of sound is what differentiates Beats from the rest, and the Solo 4 deliver the rich bass, sharp mids, and clear highs. You’ll enjoy the balanced sound profile and reliable Bluetooth connectivity. The headphones connect seamlessly with Apple and Android devices and built-in controls allow you to manage volume, skip tracks, or pick up calls without having to reach for your phone.

The on-ear variant features soft ear cushions and an adjustable headband which translates to wearing them for hours on end without feeling even a hint of discomfort. They’re light and foldable so they’re easy to store in a bag or backpack.

This Prime Day deal at $99 is the lowest price these headphones have ever seen, make sure you don’t miss this great opportunity.

See at Amazon