New leaks, Russian hackers target the US, and other cybersecurity developments

We have gathered the week’s most important cybersecurity news.

A serious bug found in Kaspersky Password Manager

Security researchers Ledger Donjon discovered a vulnerability in Kaspersky Password Manager — it generated passwords tied to the moment of their creation. The bug was found in 2019, but they only disclosed it now.

All the passwords generated by Kaspersky Password Manager were predictable (CVE-2020-27020)! Here is why.https://t.co/OyNXWlYtNV

— Ledger Donjon (@DonjonLedger) July 6, 2021

According to analysts, if two users created passwords via the service in the same second and did not change the default settings, they would receive identical combinations.

Such a problem could allow recreating the base of all passwords generated by the service, experts say:

«The consequences are clearly bad: any password can be cracked. For example, between 2010 and 2021 there are 315,619,200 seconds, so the Kaspersky Password Manager could have generated no more than 315,619,200 passwords. Brute-forcing would take a few minutes».

In April, the company reported that the issue had been fixed. Users are advised to update the password manager and change their passwords.

The Trump-supporters’ social network suffered a leak a few days after launch

The social network Gettr, created by former Donald Trump aide and spokesperson Jason Miller, was hacked a few days after its launch.

Jason Miller’s new right-wing social media site «Gettr» was hacked this morning. pic.twitter.com/cncddw9RZ9

— Zachary Petrizzo (@ZTPetrizzo) July 4, 2021

Data was found on one of the hacker forums. The databases contain names, email addresses, birth year information and the locations of platform users.

Putin signed a law on blocking defamatory information on the internet

President Vladimir Putin signed a law on non-judicial blocking of sites that disseminate information that defames a citizen’s honour and dignity or damages their reputation and relates to accusations of crime.

Under the law, citizens may approach the prosecutor’s office with a request to remove such information and to block it if the site owner refuses to “voluntarily remove the defamatory material about the citizen”.

Hackers breached the U.S. Republican Party and more than a thousand companies

This week saw several breaches of American organisations. Media report that they were carried out by Russia-linked hackers.

The REvil (also known as Sodinokibi) gang claimed responsibility for an attack on the U.S. software developer Kaseya, which affected more than a thousand companies. For decrypting the stolen files, the attackers demanded $70 million in Bitcoin.

Also, according to media reports, the attack on the U.S. Republican Party. The attackers are believed to be Cozy Bear. The Russian embassy said that Russia has no involvement in the attack.

Morgan Stanley suffered a client data breach

One of the largest U.S. banks, Morgan Stanley, reported a data breach after attackers stole client personal information by breaching a third-party vendor’s server. This was reported by Bleeping Computer.

In May 2021 the vendor Guidehouse notified Morgan Stanley that attackers had breached a server to gain access to the financial institution’s client data.

Guidehouse discovered the breach in March but found no evidence that the stolen data had been distributed on the network.

European Parliament approved a controversial bill allowing monitoring of chats to protect children

The European Parliament approved a law allowing companies to track chats and other content to identify child sexual abuse. The rules are to be temporary and apply for three years. During that time lawmakers should propose another approach to tackling such content.

The initiative is considered controversial — many worry about the privacy implications it would entail.

Also on ForkLog:

• Experts found 172 fake Android apps for mining.
• Ukraine to create a registry of prohibited sites.
• Bitcoin.org was subjected to DDoS attack. Hackers demanded a Bitcoin ransom.

What to read this weekend?

We revisit the history of the Russian hacker group Lurk — what it is famous for, how it operated and what linked it to the security services.

Read ForkLog’s Bitcoin news on our Telegram — cryptocurrency news, prices and analysis.