{"id":26830,"date":"2022-12-31T15:39:13","date_gmt":"2022-12-31T15:39:13","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/31\/techspots-top-security-stories-of-2022-vulnerabilities-wait-in-the-wings\/"},"modified":"2022-12-31T15:39:13","modified_gmt":"2022-12-31T15:39:13","slug":"techspots-top-security-stories-of-2022-vulnerabilities-wait-in-the-wings","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/31\/techspots-top-security-stories-of-2022-vulnerabilities-wait-in-the-wings\/","title":{"rendered":"TechSpot’s top security stories of 2022: Vulnerabilities wait in the wings"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

As additional facets of daily life go digital, it’s more paramount now than ever to be proactive about online security. As 2022 proved, however, staying safe isn’t just a modern concern as vulnerabilities have been around for years – decades, even – and can crop up in the most unexpected places and ways.<\/p>\n

Security researchers show off the RTX 4090’s password cracking power<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

The new GPU significantly reduces the time required to obtain or recover user passwords<\/h4>\n

Security researcher and password cracker Sam Croley posted benchmarks highlighting the RTX 4090’s password-cracking muscle. Nvidia’s newest flagship GPU shattered the RTX 3090’s previous benchmark records and doubled performance across almost every algorithm tested. The cracked passwords adhered to security best practices and included random letter cases, symbols, and numbers.<\/p>\n

For years, some Gigabyte and Asus motherboards carried UEFI malware<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

The CosmicStrand rootkit is the latest indication that UEFI malware may be more common than previously thought<\/h4>\n

Security firm ESET discovered the first UEFI rootkit that had been used in the wild back in 2018. This type of persistent threat used to be the subject of theoretical discussions among security researchers, but over the past years, it’s become clear that it’s a lot more common than previously thought, despite being relatively hard to develop.<\/p>\n

Janet Jackson song from 1989 declared a cybersecurity vulnerability for crashing hard drives<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

Rhythm Nation doesn’t send out good vibrations<\/h4>\n

People of the world today, are we looking for a better way of life?” sang Janet Jackson on her 1989 hit Rhythm Nation, not knowing that the better way of life she was talking about didn’t include certain hard drives. It’s just been revealed that the song has the power to crash particular models of laptops, and it has now been recognized as a cybersecurity vulnerability.<\/p>\n

GameStop “wiretapped” customers without consent, claims lawsuit<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

It sold secret transcripts to a marketing firm to build profiles using personal information<\/h4>\n

If it wasn’t stupid enough that GameStop dove headfirst into the NFT and crypto market right before the bubble burst, hang on for a second \u2014 the company wants you to hold its beer. It is now being sued for recording customer service chats without consent and selling transcripts to a marketing firm.<\/p>\n

QNAP issues ransomware warning to users: secure your devices or disconnect unprotected NAS<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

Ransomware and brute force attacks from unidentified sources are actively targeting network devices<\/h4>\n

QNAP issued a security statement urging their NAS users to take immediate action and secure their data against ongoing ransomware and brute force attacks. While the responsible parties have not been identified, the widespread attacks appear to target any vulnerable network devices. The company has provided security setting instructions and mitigation actions that any QNAP NAS users should implement immediately.<\/p>\n

Nvidia allegedly hacked its hackers, stole its data back<\/a><\/h3>\n
\"\"<\/picture><\/a><\/div>\n

Hacking group Lapsus$ claims to still have a copy of the data<\/h4>\n

Several online security groups are reporting that the South American hacker group Lapsus$ is claiming to have been behind the recent cyberattack on Nvidia. It’s also claiming that Nvidia hacked them in return, encrypted the stolen data, and ransomed back their machines. For now, this is just hearsay, but makes for a great turning-the-tables story.<\/p>\n

Multiple security flaws emerge in Australian digital driver’s licenses<\/a><\/h3>\n
\"\"<\/picture><\/a><\/div>\n

Possibly less secure than physical ID cards<\/h4>\n

The government of New South Wales in Australia introduced digital driver’s licenses in late 2019, claiming they were harder to forge than physical identification. A security company recently outlined multiple reasons why this isn’t the case.<\/p>\n

Nvidia hackers leak 190GB of sensitive data from Samsung<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

The leaks includes Samsung’s encryption data and source code<\/h4>\n

Lapsus$, a hacking group that leaked confidential information from Nvidia just last week, has reportedly moved to a new target: Samsung. The hackers have claimed an attack that leaked 190GB of confidential information from the South Korean technology giant, including encryption data and source code for Samsung’s most recent devices.<\/p>\n

Teen hacker gains remote control of over 20 Teslas<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

Full control over car doors, security system, and more<\/h4>\n

This week, a teenager reported that he has gained remote access to around two dozen Tesla cars in multiple countries and is trying to contact their owners. The list of things he can do to the affected vehicles is long and dangerous.<\/p>\n

Source code for Alder Lake BIOS was posted to GitHub<\/a><\/h3>\n

\"\"<\/picture><\/a><\/p>\n

It could’ve exposed some security vulnerabilities<\/h4>\n

Apparent source code for Alder Lake BIOS has been shared online. It seems to have been leaked in its entirety at 5.9 GB uncompressed, possibly by someone working at a motherboard vendor, or accidentally by a Lenovo manufacturing partner.<\/p>\n<\/p><\/div>\n