Security news weekly round-up - 26th January 2024
Published: 2024-01-26 18:44:09

---
title: Security news weekly round-up - 26th January 2024
published: true
description: Weekly review of top security news between January 19, 2024, and January 26, 2024
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/0jupjut8w3h9mjwm8m57.jpg
series: Security news weekly round-up
---

## __Introduction__

Welcome everyone. This week's review will cover almost everything that we set out to do in this series. This includes _security_, _malware_, _research in computer security_, _vulnerabilities_, and _cybercrime_.

<hr/>

## [Meta won't remove fake Instagram profiles that are clearly catfishing](https://www.bleepingcomputer.com/news/security/meta-wont-remove-fake-instagram-profiles-that-are-clearly-catfishing/)

This article is worthy of your reading (as is everything in the review), but this is special. The lesson here is to be careful of the accounts you interact with on Instagram, especially the ones that appear "successful". You never know; it could be an imposter.

Here is why:

> These imposters then begin to "follow" the followers of the real account, in hopes of getting followed back and establishing themselves as trustworthy on the platform, while simultaneously blocking the authentic profile whose pictures they are misusing. This cuts off the possibility of contact with and being seen by the authentic user.

## [NS-STEALER Uses Discord Bots to Exfiltrate Your Secrets from Popular Browsers](https://thehackernews.com/2024/01/ns-stealer-uses-discord-bots-to.html)

The lesson from this article? Think again before you download "cracked" software. Why? That's because the article explained that's how this _stealer_ can get on your computer.

What's more, the following serves as extra motivation on why you should read this article now:

> the malware subsequently saves screenshots, cookies, credentials, and autofill data stolen from over two dozen web browsers, system information, a list of installed programs, Discord tokens, Steam and Telegram session data. The captured information is then exfiltrated to a Discord Bot channel.

## [Ambient light sensors can reveal your device activity. How big a threat is it?](https://arstechnica.com/security/2024/01/ambient-light-sensors-can-reveal-your-device-activity-how-big-a-threat-is-it/)

Keep calm, for now, it's research. However, it's bound to get better in the future and that's why you should be aware of it now. Nonetheless, it's a fun read.

Here is something to get you started:

> There are plenty of limitations that prevent the attack as it exists now from being practical or posing an immediate threat. The biggest restrictions: It works only on devices with a large screen, in environments without bright ambient light, and when the screen is displaying certain types of content that are known to the attacker.

## [Malicious NPM Packages Exfiltrate Hundreds of Developer SSH Keys via GitHub](https://thehackernews.com/2024/01/malicious-npm-packages-exfiltrate-1600.html)

At the time of writing, the packages have been removed by the npm maintainers. This is where we have to state again: always double-check the package that you download from npm.

The following is a quick reminder of why this is necessary:

> The campaign is just the latest example of cybercriminals and malicious actors using open source package managers and related infrastructure to support malicious software supply chain campaigns that target development organizations and end-user organizations

## [$1.7 Billion Stolen in Cryptocurrency Hacks in 2023: Analysis](https://www.securityweek.com/1-7-billion-stolen-in-cryptocurrency-hacks-in-2023-report/)

That's a lot of money and it's scary because it shows that real people suffered considerable losses in the cryptocurrency world in 2023. Stay safe in 2024 and keep yourself updated with the latest security news (no matter how small it might seem).

An excerpt from the article:

> Although the total amount stolen from crypto platforms in 2023 was down significantly from prior years, it is clear that attackers are becoming increasingly sophisticated and diverse in their exploits. The good news is, crypto platforms are becoming more sophisticated in their security and responses to attacks, too

## [Thousands of GitLab Instances Unpatched Against Critical Password Reset Bug](https://www.securityweek.com/thousands-of-gitlab-instances-unpatched-against-critical-password-reset-bug/)

It's really scary with a CVSS score of 10. Here, 10 means that it's severe. What's more, there are more than 5000 such servers currently out there.

Here is more about the bug:

> the issue allows attackers to have password reset messages sent to unverified email addresses under their control, potentially leading to account takeover.

## [The life and times of Cozy Bear, the Russian hackers who just hit Microsoft and HPE](https://arstechnica.com/security/2024/01/the-life-and-times-of-cozy-bear-the-russian-hackers-who-just-hit-microsoft-and-hpe/)

Cozy Bear also goes under different aliases like APT29, and The Dukes, among others. I have read some documented research about their attacks in the past. Now, based on public reports, they struck Hewlett Packard Enterprise and Microsoft in May and November 2023.

It's a bit of a _long read_, so here is what should inspire you to read it all:

> Cozy Bear hacking its way into the email systems of two of the world’s most powerful companies and monitoring top employees’ accounts for months aren’t the only similarities in the two events.
>
> Both breaches also involved the compromise of a single device on each corporate network, then escalating that toehold to the network itself. From there, Cozy Bear camped out undetected for months.

## __Credits__

Cover photo by [Debby Hudson on Unsplash](https://unsplash.com/@hudsoncrafted).

<hr>

That's it for this week, and I'll see you next time.