15 min read

This Week's [in]Security - Issue 246 | insecurity | Control Gap

CG Blogger : Dec 19, 2021 12:00:00 AM

COVID-19 NIST Desjardins [in]security Crypto Magecart

This Week's [in]Security - Issue 246 | insecurity | Control Gap

Welcome to This Week’s [in]Security. PCI and payments: PCI updates: FAQ, HSM. Magecart, Sportsgear, ATMs, PAX. Supply-Chain Backdoors: Log4J/Log4shell continues! Underfunding! New breaches: Scraping, Finite Recruitment, ProTemps, GumTree. New Ransomware: Kronos, Virginia, logistics, medical. Major outages: AWS. Follow-ups & Fall-out: schools, delays, Desjardins settles. Privacy: Staying signed in. Laws & Regs - Canada: Repair, Harms. US: Data Protection, National Security, Chinese Tech, Takedowns. World: trade disputes, Japan, UK, EU. Standards: NIST drafts. Defense: Webinars, bans, Bug bounties, Internet Hall-of-Fame. Vulnerabilities, Zerodays. Other Vulnerabilities: chips, Ubuntu, Dell, Firefox, Adobe, Apple, Chrome, and MS. ECDSA keys. Cybercrime: Trends, log-ins, Contact Forms, Anubis, Seedworm. Nation States. NSO, Huawei, Nobelium. Crime & Enforcement. Obit pirates, Arrests, Assassins. Other Risks: Data life cycles, AI diagnosis, Shadows, Printers, virtual assault, crypto currency. Health, Safety & Environment. Covid-19: Spread, Curves, Waves, and Variants; Response; Treatments; Immunity; Learned; Impact; Covid Ugly; And more.

PCI Compliance and Payments

News and announcements relating to Payment Security, PCI, Card Brands, Payments, Payment Malware and Fraud, and Payment Related Compliance.

PCI Updates:
- FAQ #1091 has been updated again https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/What-are-acceptable-formats-for-truncation-of-primary-account-numbers
- PCI Security Standards Council Updates PTS Hardware Security Module Standard v4.0 https://www.pcisecuritystandards.org/documents/PCI_HSM_Security_Requirements_v4.pdf
- Q&A with Ralph Spencer Poore https://blog.pcisecuritystandards.org/q-and-a-with-ralph-spencer-poore
Sites hacked with credit card stealers undetected for months https://www.bleepingcomputer.com/news/security/sites-hacked-with-credit-card-stealers-undetected-for-months/
Credit card info of 1.8 million people stolen from sports gear sites https://www.bleepingcomputer.com/news/security/credit-card-info-of-18-million-people-stolen-from-sports-gear-sites/
Visa Warns of Dishonest 'Cashless ATM' Schemes https://www.pymnts.com/news/security-and-risk/2021/visa-warns-of-dishonest-cashless-atm-schemes/
PAX announces results of investigation on network communications of PAX terminals conducted by Palo Alto finds no issues (we do not expect this is the end of the story) https://www.paxtechnology.com/blog/independent-investigation-on-network-communications-of-pax-terminals
Rethinking paying with plastic https://www.mastercard.com/news/perspectives/2021/sustainable-card-recyclable-plastic-bioplastic-ocean-waste/
SWIFT Outlines Strategies for Global Adoption of Frictionless Transactions in 2022 https://www.pymnts.com/news/cross-border-commerce/cross-border-payments/2021/swift-outlines-strategies-global-adoption-frictionless-transactions-2022/

Breaches / Ransomware / Leaks

Covering breaches, leaks, data exposures, ransomware (as potential breach), and their fallout.

Major attacks, supply-chain compromises and widely used backdoors:
- Addressing Log4Shell https://staging.controlgap.com/blog/Addressing-Log4Shell
- As CISA tells US govt agencies to squash Log4j bug by Dec 24, fingers start pointing at China, Iran, others https://www.theregister.com/2021/12/15/log4j_latest_cisa/
- Log4j: List of vulnerable products and vendor advisories https://www.bleepingcomputer.com/news/security/log4j-list-of-vulnerable-products-and-vendor-advisories/
- On the Log4j Vulnerability https://www.schneier.com/blog/archives/2021/12/on-the-log4j-vulnerability.html
- More Log4j News https://www.schneier.com/blog/archives/2021/12/more-log4j-news.html
- Apache Log4j Vulnerability https://security.googleblog.com/2021/12/apache-log4j-vulnerability.html
- Log4J and patch Tuesday https://krebsonsecurity.com/2021/12/microsoft-patch-tuesday-december-2021-edition/
- Log4j Vulnerability Causes Nearly 900K Cyberattacks in Four Days https://www.pymnts.com/news/security-and-risk/2021/log4j-vulnerability-causes-nearly-900000-cyberattacks-four-days/
- As Log4Shell wreaks havoc, payroll service reports ransomware attack https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/
- Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges https://thehackernews.com/2021/12/hackers-begin-exploiting-second-log4j.html
- Hackers Exploit Log4j Vulnerability to Infect Computers with Khonsari Ransomware https://thehackernews.com/2021/12/hackers-exploit-log4j-vulnerability-to.html
- Industrial Organizations Targeted in Log4Shell Attacks https://www.securityweek.com/industrial-organizations-targeted-log4shell-attacks
- Log4j vulnerability now used by state-backed hackers, access brokers https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-by-state-backed-hackers-access-brokers/
- Ransomware, Trojans, DDoS Malware and Crypto-Miners Delivered in Log4Shell Attacks https://www.securityweek.com/ransomware-trojans-ddos-malware-and-crypto-miners-delivered-log4shell-attacks
- Relentless Log4j Attacks Include State Actors, Possible Worm https://threatpost.com/log4j-attacks-state-actors-worm/177088/
- Apache takes off, nukes insecure feature at the heart of Log4j from orbit with v2.16 https://www.theregister.com/2021/12/14/apache_log4j_2_16_jndi_disabled/
- Apache's Fix for Log4Shell Can Lead to DoS Attacks https://threatpost.com/apache-patch-log4shell-log4j-dos-attacks/177064/
- Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released https://thehackernews.com/2021/12/second-log4j-vulnerability-cve-2021.html
- Apache Issues 3rd Patch to Fix New High-Severity Log4j Vulnerability https://thehackernews.com/2021/12/apache-issues-3rd-patch-to-fix-new-high.html
- How to Buy Precious Patching Time as Log4j Exploits Fly https://threatpost.com/patching-time-log4j-exploits-vaccine/177017/
- Log4Shell: 5 Steps The OT Community Should Take Right Now https://www.tenable.com/blog/log4shell-5-steps-the-ot-community-should-take-right-now
- Log4J and open source exploitation https://www.theregister.com/2021/12/14/log4j_vulnerability_open_source_funding/
- The internet runs on free open-source software. Who pays to fix it? https://www.technologyreview.com/2021/12/17/1042692/log4j-internet-open-source-hacking/
New Breaches:
- When is a Scrape a Breach? https://www.troyhunt.com/when-is-a-scrape-a-breach/
- Coles, Westpac, AMP and Department of Defence caught up in ‘significant' data breach of Finite Recruitment https://www.databreaches.net/coles-westpac-amp-and-department-of-defence-caught-up-in-significant-data-breach-of-finite-recruitment/
- Protemps - 49,591 breached accounts https://haveibeenpwned.com/PwnedWebsites#Protemps
- US federal agency compromised in suspected APT attack https://www.databreaches.net/us-federal-agency-compromised-in-suspected-apt-attack/
- Gumtree classifieds site leaked personal info via the F12 key https://www.databreaches.net/gumtree-classifieds-site-leaked-personal-info-via-the-f12-key/
- Woman finds medical records stacked next to recycling bin in Sharpstown neighborhood https://www.databreaches.net/woman-finds-medical-records-stacked-next-to-recycling-bin-in-sharpstown-neighborhood/
New Ransomware and "Incidents":
- Timekeeping biz Kronos hit by ransomware and warns customers to engage biz continuity plans https://www.theregister.com/2021/12/13/ultimate_kronos_group_ransomware_attack/
- Officials: Virginia IT agency hit with ransomware attack https://www.databreaches.net/officials-virginia-it-agency-hit-with-ransomware-attack/
- Logistics Firm Hellmann Scrambling to Recover From Cyberattack https://www.securityweek.com/logistics-firm-hellmann-scrambling-recover-cyberattack
- Propane Gas Distributor Hit With Ransomware https://www.darkreading.com/attacks-breaches/propane-distributor-hit-with-ransomware
- Oregon anesthesiology group notifies 750,000 about ransomware incident; FBI seized threat actors' account with their files https://www.databreaches.net/oregon-anesthesiology-group-notifies-750000-about-ransomware-incident-fbi-seized-threat-actors-account-with-their-files/
Major outages/downs:
- AWS down again, outage impacts Twitch, Zoom, PSN, Hulu, others https://www.bleepingcomputer.com/news/technology/aws-down-again-outage-impacts-twitch-zoom-psn-hulu-others/
Follow-ups and fall-out:
- US schools leaked 28.6 million records in 1,851 data breaches since 2005 https://www.databreaches.net/us-schools-leaked-28-6-million-records-in-1851-data-breaches-since-2005/
- Za: Standard Bank on delay in telling public about data breach: ‘We complied with the law' https://www.databreaches.net/za-standard-bank-on-delay-in-telling-public-about-data-breach-we-complied-with-the-law/
- Desjardins reaches $200M class action settlement in wake of data breach https://www.databreaches.net/desjardins-reaches-200m-class-action-settlement-in-wake-of-data-breach/

Privacy

Articles about privacy related news, risks, and trends.

Staying signed in by default to email services poses serious privacy concerns for users accessing their email on a public or shared computer, Yahoo/Rogers & PIPEDA https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2021/pipeda-2021-005/

Laws, Regulations, Platforms, Standards, and Public Policy

News about laws, regulations, platform rules, and standards affecting security, privacy, technology, and public interest.

Canada:
- The Law Bytes Podcast, Episode 112: Aaron Perzanowski on the Right to Repair https://www.michaelgeist.ca/2021/12/law-bytes-podcast-episode-112/
- The (Still Secret) Online Harms Consultation: What the Government Heard, Part One https://www.michaelgeist.ca/2021/12/the-still-secret-online-harms-consultation-what-the-government-heard-part-one/
US:
- Ground Labs Research Reveals 71% of American Consumers are Unaware of Data Protection Laws https://www.darkreading.com/risk/ground-labs-research-reveals-71-of-american-consumers-are-unaware-of-data-protection-laws
- Why Classifying Ransomware as a National Security Threat Matters https://www.darkreading.com/dr-tech/why-classifying-ransomware-as-a-national-security-threat-matters
- The US will put 8 more Chinese companies including dronemaker DJI on an investment blacklist, report says https://markets.businessinsider.com/news/stocks/us-blacklist-chinese-companies-uyghur-muslim-minority-biotech-dji-biden-2021-12
- This Is Not the Privacy Bill You're Looking For https://www.eff.org/deeplinks/2021/12/not-privacy-bill-youre-looking
- Takedown notices are threatening online thrift shops — just as business is exploding https://www.theverge.com/2021/12/13/22826114/takedown-notices-online-thrift-shops-copyright-trademark
- EFF to Court: Deny Foreign Sovereign Immunity to DarkMatter for Hacking Journalist https://www.eff.org/deeplinks/2021/12/eff-court-deny-foreign-sovereign-immunity-darkmatter-hacking-journalist
- JPMorgan hit with $200 million in fines for letting employees use WhatsApp to evade regulators’ reach https://www.cnbc.com/2021/12/17/jpmorgan-agrees-to-125-million-fine-for-letting-employees-use-whatsapp-to-evade-regulators.html
World:
- Should Have Seen This Coming: U.S. Raises Prospect of Retaliation Over Canada's Digital Services Tax Plans https://www.michaelgeist.ca/2021/12/should-have-seen-this-coming-u-s-raises-prospect-of-retaliation-over-canadas-digital-services-tax-plans/
- Canada Threatens to Delay Copyright Term Extension in Response to U.S. Electronic Vehicle Tax Credit Plan https://www.michaelgeist.ca/2021/12/canada-threatens-to-delay-copyright-term-extension-in-response-to-u-s-electronic-vehicle-tax-credit-plan/
- Japan draws a LINE: web giants must reveal where they store user data https://www.theregister.com/2021/12/16/japan_data_location_requirement/
- Big Tech firms could face criminal sanctions if they don't police unsolicited dick pics https://www.businessinsider.com/unsolicited-dick-pics-illegal-online-safety-bill-2021-12
- Grindr fined £5.5m for sharing users' data https://www.bbc.co.uk/news/technology-59651703
- EU's Digital Identity Framework Endangers Browser Security https://www.eff.org/deeplinks/2021/12/eus-digital-identity-framework-endangers-browser-security
Standards News:
- NIST has released three draft items related to the Workforce Framework for Cybersecurity open for comment until January 31 https://www.nist.gov/system/files/documents/2021/12/15/NFupdateprocess_summary14dec2021_clean.pdf, https://nvlpubs.nist.gov/nistpubs/ir/2021/NIST.IR.8355-draft2.pdf, and https://www.nist.gov/system/files/documents/2021/12/15/NICEabiliitystatements_refactored_15dec2021.xlsx

Defense / Techniques / Solutions

Covering developments and opportunities that may help improve security.

Upcoming Webinars, Virtual Events, and other training related:
- Join NIST and our co-host, Tetrate, for our third annual all-virtual Multi-Cloud Conference on January 27, 2022 from 11:00 AM – 5:00 https://www.nist.gov/news-events/events/2022/01/zta-and-devsecops-cloud-native-applications-virtual
- Join NIST's NCCoE for an Interactive Virtual Workshop on the Cybersecurity of Genomic Data on January 26, 2022, from 11:00 AM – 4:30 PM https://www.nccoe.nist.gov/get-involved/attend-events/nccoe-virtual-workshop-cybersecurity-genomic-data
DtSR Episode 479 - Productivity of Jump Boxes and Bastion Hosts http://podcast.wh1t3rabbit.net/dtsr-episode-479-productivity-of-jump-boxes-and-bastion-hosts
Microsoft rolls out end-to-end encryption for Teams calls https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-end-to-end-encryption-for-teams-calls/
Empowering the next generation of Android Application Security Researchers https://security.googleblog.com/2021/12/empowering-next-generation-of-android.html
Facebook Bans 7 'Cyber Mercenary' Companies for Spying on 50,000 Users https://thehackernews.com/2021/12/facebook-bans-7-cyber-mercenaries.html
Bug-Bounty Programs Shift Focus to Most Critical Flaws https://www.darkreading.com/application-security/bug-bounty-programs-shift-focus-to-most-critical-flaws
DHS announces 'Hack DHS' bug bounty program for vetted researchers https://www.bleepingcomputer.com/news/security/dhs-announces-hack-dhs-bug-bounty-program-for-vetted-researchers/
Facebook expands bug bounty program to include scraping attacks, two years after it was scraped – hard https://www.theregister.com/2021/12/16/facebook_scraping_bug_bounties/
Dan Kaminsky Inducted into Internet Hall of Fame https://www.securityweek.com/dan-kaminsky-inducted-internet-hall-fame

Bugs / Design Flaws / Vulnerabilities / Research

Articles about newly discovered vulnerabilities and research.

Other Zero-day news:
- Actively Exploited Microsoft Zero-Day Allows App Spoofing, Malware Delivery https://threatpost.com/exploited-microsoft-zero-day-spoofing-malware/177045/
Other Vulnerabilities:
- Bugs in billions of WiFi, Bluetooth chips allow password, data theft https://www.bleepingcomputer.com/news/security/bugs-in-billions-of-wifi-bluetooth-chips-allow-password-data-theft/
- Attackers can get root by crashing Ubuntu's AccountsService https://www.bleepingcomputer.com/news/security/attackers-can-get-root-by-crashing-ubuntu-s-accountsservice/
- Dell driver fix still allows Windows Kernel-level attacks https://www.bleepingcomputer.com/news/security/dell-driver-fix-still-allows-windows-kernel-level-attacks/
- Firefox users can't reach Microsoft.com — here's what to do https://www.bleepingcomputer.com/news/security/firefox-users-cant-reach-microsoftcom-heres-what-to-do/
- Adobe Joins Security Patch Tuesday Frenzy https://www.securityweek.com/adobe-joins-security-patch-tuesday-frenzy
- Apple Patches Vulnerabilities That Earned Hackers $600,000 at Chinese Contest https://www.securityweek.com/apple-patches-vulnerabilities-earned-hackers-500000-chinese-contest
- Google pushes emergency Chrome update to fix zero-day used in attacks https://www.bleepingcomputer.com/news/security/google-pushes-emergency-chrome-update-to-fix-zero-day-used-in-attacks/
- Microsoft & Adobe Patch Tuesday (December 2021) – Microsoft 83 Vulnerabilities with 7 Critical, 1 Actively Exploited. Adobe 60 Vulnerabilities, 28 critical. https://blog.qualys.com/vulnerabilities-threat-research/2021/12/14/microsoft-adobe-patch-tuesday-december-2021-microsoft-83-vulnerabilities-with-7-critical-1-actively-exploited-adobe-60-vulnerabilities-28-critical
- Microsoft fixes bug blocking Defender for Endpoint on Windows Server https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-blocking-defender-for-endpoint-on-windows-server/
- Who me: Ooh, an update. Let's install it. What could possibly go wrong https://www.theregister.com/2021/12/13/who_me/
- Alpha-Rays: Key Extraction Attacks on Threshold ECDSA Implementations, by Dmytro Tymokhanov and Omer Shlomovits https://eprint.iacr.org/2021/1621

Hacking / Malware / Cybercrime / Exploitation

News covering active trends, alerts, events.

Trends, Alerts, and Events (other than major breaches):
- New research reveals that one third of all log-in attempts on eCommerce sites are malicious https://www.imperva.com/blog/new-research-reveals-that-one-third-of-all-log-in-attempts-on-ecommerce-sites-are-malicious/
- How the "Contact Forms" campaign tricks people, (Thu, Dec 16th) https://isc.sans.edu/diary/rss/28142
- Hackers steal Microsoft Exchange credentials using IIS module https://www.bleepingcomputer.com/news/security/hackers-steal-microsoft-exchange-credentials-using-iis-module/
- 400 Banks' Customers Targeted with Anubis Trojan https://threatpost.com/400-banks-targeted-anubis-trojan/177038/
- Microsoft Details Building Blocks of Widely Active Qakbot Banking Trojan https://thehackernews.com/2021/12/microsoft-details-building-blocks-of.html
- ‘Seedworm' Attackers Target Telcos in Asia, Middle East https://threatpost.com/seedworm-attackers-telcos-asia-middle-east/176992/
- Malicious PyPI packages with over 10,000 downloads taken down https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-with-over-10-000-downloads-taken-down/
- Phishing campaign uses PowerPoint macros to drop Agent Tesla https://www.bleepingcomputer.com/news/security/phishing-campaign-uses-powerpoint-macros-to-drop-agent-tesla/
- Simple but Undetected PowerShell Backdoor, (Wed, Dec 15th) https://isc.sans.edu/diary/rss/28138
- Threat actors pose as pharmacists, get business associates to send them patient records https://www.databreaches.net/threat-actors-pose-as-pharmacists-get-business-associates-to-send-them-patient-records/
- Indian PM's Twitter Hacked Again by Crypto Scammers https://www.securityweek.com/indian-pms-twitter-hacked-again-crypto-scammers
Nation State Actors:
- Google warns that NSO hacking is on par with elite nation-state spies https://arstechnica.com/information-technology/2021/12/google-warns-that-nso-hacking-is-on-par-with-elite-nation-state-spies/
- US distrust of Huawei linked in part to malicious software update in 2012 https://www.theregister.com/2021/12/18/us_huawei_malware/
- A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
- Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/
- The final report on NOBELIUM's unprecedented nation-state attack https://www.microsoft.com/security/blog/2021/12/15/the-final-report-on-nobeliums-unprecedented-nation-state-attack/
Crime & Arrests, etc.:
- 'A strange and sad game of whack a mole': Ontario agency calls out 'obituary pirates' https://toronto.ctvnews.ca/a-strange-and-sad-game-of-whack-a-mole-ontario-agency-calls-out-obituary-pirates-1.5707542
- CA: Man Charged With Hacking Student Accounts, Interrupting High School Classes https://www.databreaches.net/ca-man-charged-with-hacking-student-accounts-interrupting-high-school-classes/
- Arrest in Romania of a ransomware affiliate scavenging for sensitive data https://www.databreaches.net/arrest-in-romania-of-a-ransomware-affiliate-scavenging-for-sensitive-data/
- Ukraine arrests 51 for selling data of 300 million people in US, EU https://www.databreaches.net/ukraine-arrests-51-for-selling-data-of-300-million-people-in-us-eu/
- Germany Jails Operators of 'Cyberbunker' Darknet Hub https://www.securityweek.com/germany-jails-operators-cyberbunker-darknet-hub
- Meet the man who accidentally started an assassin hiring website https://www.theguardian.com/lifeandstyle/2021/dec/17/bob-innes-rent-a-hitman-assassin-services-website
- FL: Detectives discover child porn on suspect's computer during Polk State College data breach investigation https://www.databreaches.net/fl-detectives-discover-child-porn-on-suspects-computer-during-polk-state-college-data-breach-investigation/
- IP-Stealing Artist Gets Burned by His Own Game as Cyber-Sleuths Pirate ‘MetaBirkin' NFTs https://www.pymnts.com/nfts/2021/ip-stealing-artist-gets-burned-by-his-own-game-as-cyber-sleuths-pirate-metabirkin-nfts/

Other Security / Risk

Articles covering other types of risks.

Google's Manifest V3 Still Hurts Privacy, Security, and Innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation
Is Data Security Worthless if the Data Life Cycle Lacks Clarity? https://www.darkreading.com/risk/is-data-security-worthless-if-the-data-lifecycle-lacks-clarity-
Algorithms that detect cancer can be fooled by hacked images https://www.theverge.com/2021/12/14/22831966/hackers-mammogram-ai-cancer-fake-images
The Other Type of Shadow IT https://blog.isc2.org/isc2_blog/2021/12/the-other-type-of-shadow-it.html
It's Your Printer's Fault https://www.nytimes.com/2021/12/16/technology/printer-router-modem-consumer-electronics.html
Meta launched an investigation after a woman said she was groped by a stranger in the metaverse https://www.businessinsider.com/meta-investigated-woman-claims-she-was-groped-in-metas-metaverse-2021-12
90% of all bitcoins have now been mined — but the remaining 10% will take over 100 years to reach open market https://markets.businessinsider.com/news/currencies/bitcoin-price-outlook-90-percent-supply-mined-open-market-btc-miners-blockchain
The Stablecoin Problem https://www.pymnts.com/cryptocurrency/2021/the-stablecoin-problem/
Car involved in Niagara Falls rescue attempt has gone over the brink https://toronto.ctvnews.ca/car-involved-in-niagara-falls-rescue-attempt-has-gone-over-the-brink-1.5705701
Thousands of JFK assassination documents have just been made public https://www.businessinsider.com/jfk-assassination-documents-released-to-public-2021-12
Health, Safety & Environment:
- Waiting 60 Seconds Before Cutting The Umbilical Cord Can Save Lives, Study Finds https://www.sciencealert.com/waiting-60-seconds-to-cut-umbilical-cords-is-a-life-saving-decision-for-premature-babies-study-finds
- Alzheimer's drug aducanumab not approved for use in EU https://www.bbc.co.uk/news/health-59699907
- Massive cost, meager benefit https://scienmag.com/massive-cost-meager-benefit/
- New Maze-Like Surface Kills Bacteria in 2 Minutes: 120x Faster Than Normal Copper https://www.sciencealert.com/new-copper-surface-kills-bacteria-in-2-minutes-120x-faster-than-normal-copper
- Carbon Monoxide From Generators Poisons Thousands of People a Year. The U.S. Has Failed to Force Safety Changes. https://www.propublica.org/article/carbon-monoxide-from-generators-poisons-thousands-of-people-a-year-the-u-s-has-failed-to-force-safety-changes#1203690
- ‘Anti-5G' necklaces are radioactive and dangerous, Dutch nuclear experts say https://www.theguardian.com/technology/2021/dec/17/anti-5g-necklaces-radioactive-dutch-nuclear-experts-quantum-pendants
- Amazon driver was warned she'd be fired for returning with packages during a tornado https://www.theverge.com/2021/12/17/22841667/amazon-delivery-driver-illinois-tornado-warehouse-destruction
- Altered carbon: A carbon-air battery as a next-generation energy storage system https://scienmag.com/altered-carbon-a-carbon-air-battery-as-a-next-generation-energy-storage-system/
- Plastic-degrading enzymes increasing in correlation with pollution https://scienmag.com/plastic-degrading-enzymes-increasing-in-correlation-with-pollution/
- Quad-State Tornado May Be Longest-Lasting Ever https://www.scientificamerican.com/article/quad-state-tornado-may-be-longest-lasting-ever/
- Survivors of deadly tornadoes may go weeks without heat, water, electricity, Kentucky officials say https://www.cbc.ca/news/world/tornado-kentucky-storm-dec13-2021-1.6283500

COVID-19 updates.

COVID related articles. We have been following coronavirus risks since https://controlgap.com/blog/this-weeks-insecurity-issue-147.

The spread, curves, spikes, waves, reinfection, and variant strains:
- New York reports 21,027 new COVID-19 cases in a single day, the highest the state has ever recorded https://www.businessinsider.com/new-york-state-covid-19-record-breaking-daily-cases-2021-12
- Ontario reports highest case count since April with 4,177 new infections, two deaths https://toronto.ctvnews.ca/ontario-reports-highest-case-count-since-april-with-4-177-new-infections-two-deaths-1.5713354
- Provinces break COVID-19 case records as new restrictions set in https://globalnews.ca/news/8461897/canada-covid-19-cases-dec-19/
- Ontario could see 10,000 new COVID-19 cases daily by Dec. 31 as Omicron variant takes over, science table head says https://toronto.ctvnews.ca/ontario-could-see-10-000-new-covid-19-cases-daily-by-dec-31-as-omicron-variant-takes-over-science-table-head-says-1.5708496
- Omicron symptoms: Is a runny nose a cold or Covid? https://www.bbc.co.uk/news/health-54145299
- Don't Be Surprised When You Get Omicron https://www.theatlantic.com/health/archive/2021/12/omicron-breakthrough-vaccine-testing/621014/
- 800,000 Deaths https://www.theatlantic.com/ideas/archive/2021/12/america-800000-dead-covid-19/620997/
Guidance, Response, and Recovery:
- COVID-related travel insurance not guaranteed for trips abroad: specialist https://globalnews.ca/news/8457439/omicron-covid-international-travel-insurance/
- Quebec, Ontario, P.E.I., introduce new measures to slow Omicron spread https://globalnews.ca/news/8452182/quebec-ontario-p-e-i-omicron-spread/
- Ontario entertainment venues slash capacity over COVID-19 resurgence https://globalnews.ca/news/8458364/ontario-entertainment-venues-slash-capacity-covid-resurgence/
- City of Toronto extends mandatory mask bylaw to April 2022 amid rise in COVID cases https://globalnews.ca/news/8452951/toronto-mask-bylaw-covid-extension-april-2022/
- Vaccinated close contacts of COVID-19 cases should self-isolate but province needs 'backup' plan for health-care workers: Moore https://toronto.ctvnews.ca/vaccinated-close-contacts-of-covid-19-cases-should-self-isolate-but-province-needs-backup-plan-for-health-care-workers-moore-1.5707532
- Ontario runs out of COVID-19 rapid tests handed out at LCBO retailers in less than a day https://toronto.ctvnews.ca/ontario-runs-out-of-covid-19-rapid-tests-handed-out-at-lcbo-retailers-in-less-than-a-day-1.5712839
- Dalhousie University, King's to begin winter semester online as COVID-19 spreads in N.S. https://globalnews.ca/news/8459971/dal-kings-online-winter-term-covid-19/
- UK removes all 11 countries from red list https://www.bbc.co.uk/news/business-59653236
- British people have cancelled restaurant bookings and parties in a desperate attempt to keep Christmas with family https://www.businessinsider.com/brits-cancel-bookings-to-avoid-pandemic-restrictions-before-christmas-2021-12
Treatments, Testing, Triage, Trials, and things we Learned:
- High pressure (hyperbaric) oxygen resolves severe COVID-19 breathing difficulties faster than standard therapy https://scienmag.com/high-pressure-hyperbaric-oxygen-resolves-severe-covid-19-breathing-difficulties-faster-than-standard-therapy/
Immunity and Vaccinations:
- Ontario expands eligibility for COVID-19 booster shots, cuts capacity limits in some indoor spaces https://toronto.ctvnews.ca/ontario-expands-eligibility-for-covid-19-booster-shots-cuts-capacity-limits-in-some-indoor-spaces-1.5708047
- This is what it could look like to produce a vaccine that works on all COVID-19 variants https://www.cbc.ca/news/health/operation-warp-speed-vaccines-covid-1.6284038
- Africa might hit 70% COVID-19 vaccination goal in late 2024, WHO warns https://globalnews.ca/news/8449134/africa-covid-19-vaccination-2024-who/
- Things we learned:
- Why Is Omicron So Contagious? https://www.scientificamerican.com/article/why-is-omicron-so-contagious/
- Omicron variant multiplies 70 times faster in airways than Delta: study https://globalnews.ca/news/8455426/omicron-variant-multiplies-70-times-faster-airways/
- Scientists develop an RNA-based breath test to detect COVID-19 https://scienmag.com/scientists-develop-an-rna-based-breath-test-to-detect-covid-19/
Impact:
- Omicron may cause 100,000 cancelled operations in England this winter https://scienmag.com/omicron-may-cause-100000-cancelled-operations-in-england-this-winter/
More of the good, the bad, and the ugly:
- The great COVID-19 infodemic: How disinformation networks are radicalizing Canadians https://globalnews.ca/news/8450263/infodemic-covid-19-disinformation-canada-pandemic/

Off-Topic / Science & Tech / Lighter Side

A variety of scientific, technical, historical, and more light-hearted news.

It's Official: With 1306 Legs, This Millipede Has the Most of Any Animal https://www.mentalfloss.com/article/653618/1306-legged-millipede-has-most-legs-of-any-animal
An Ancient Greek Astronomical Calculation Machine Reveals New Secrets https://www.scientificamerican.com/article/an-ancient-greek-astronomical-calculation-machine-reveals-new-secrets/
This Robot Learned to Solve a Maze Using Mammal-Like 'Brain' Circuits For Memory https://www.sciencealert.com/a-human-like-brain-is-helping-robots-escape-from-mazes
Magnetic ‘hedgehogs' could store big data in a small space https://scienmag.com/magnetic-hedgehogs-could-store-big-data-in-a-small-space/
Astronomers See a Star Crash Through the Planetary Disk of Another Star https://www.universetoday.com/153706/astronomers-see-a-star-crash-through-the-planetary-disk-of-another-star/
This Incredible Photo of the Sun is Made up of 150,000 Individual Photographs https://www.universetoday.com/153683/this-incredible-photo-of-the-sun-is-made-up-of-150000-individual-photographs/

This Week's [in]Security - Issue 246 | insecurity | Control Gap

This Week’s [in]Security – Issue 34 | insecurity | Control Gap

This Week’s [in]Security – Issue 146 | insecurity | Control Gap

This Week's [in]Security - Issue 222 | insecurity | Control Gap