Lorenzo Franceschi-Bicchierai / is on Nostr

Real-time cyber historian of the late capitalist era @TechCrunch. Tweets about infosec, surveillance by day. 🍕, ⚽️, 🎸, 🎮 by night.  ☎️ Signal: +1 917 257 1382 💻 Keybase/Telegram: @ lorenzofb ✉️ lorenzo@techcrunch.com Previously: VICE Motherboard, Mashable, WIRED's Danger Room.

Twitter: https://twitter.com/lorenzofb
Personal Site: https://lorenzofb.com
Pronouns: He/him
Searchable via: tootfinder
TechCrunch: https://techcrunch.com/author/lorenzo-franceschi-bicchierai/

Last Notes

2024-06-10 15:13:46

NEW: More bad news for 23andMe.
The U.K. and Canada's privacy watchdogs have launched a joint investigation into last year's hack, which impacted 6.9 million 23andMe customers' personal information.
People “need to trust that any organisation handling their most sensitive personal information has the appropriate security and safeguards in place,” said John Edwards of the U.K.'s Information Commissioner’s Office (ICO).
https://techcrunch.com/2024/06/10/uk-and-canada-privacy-watchdogs-investigating-23andme-data-breach/

2024-06-07 14:31:53

NEW: Two Bangladeshi anti-terrorist police agents are accused of selling citizens' data on Telegram.
The authorities allege they abused access to the countrywide internet and phone surveillance system to obtain “secret information” and then attempt to get money for it, according to a letter we obtained.
As a result, all police agents in the country can't access the database at the moment.
https://techcrunch.com/2024/06/06/bangladeshi-police-agents-accused-of-selling-citizens-personal-information-on-telegram/

2024-05-15 19:52:21

NEW: The FBI seized the notorious cybercrime forum Breachforums — again — along with two linked Telegram channels.
It's unclear how the FBI took control of the admin's Telegram channel, which to me is the most interesting part of all this right now.
Did the FBI arrest the admin and took control of their devices that were logged into the Telegram channels? Did Telegram collaborate?
We don't know, as Telegram did not immediately respond to a request for comment.
https://techcrunch.com/2024/05/15/fbi-seizes-hacking-forum-breachforums-again/

2024-05-14 16:55:13

SCOOP: There's another Dell breach.
The same threat actor who said he scraped 49M customer records told me that he has now scraped data of around 30,000 customers (and counting), abusing a new flaw in a different Dell portal.
Data includes customer phone numbers, user-uploaded photos, computer logs, and, in some cases, GPS location coming from the EXIF data on those photos.
https://techcrunch.com/2024/05/14/threat-actor-scraped-dell-support-tickets-including-customer-phone-numbers/

2024-05-07 14:40:45

NEW: U.S. and U.K. police claim to have unmasked the mastermind behind LockBit, one of the most prolific ransomware gangs in history.
Authorities say Dmitry Khoroshev, who is 31 and from Russia, is the group's leader LockBitSupp.
And there's now a $10 million bounty on his head.
https://techcrunch.com/2024/05/07/us-uk-police-identify-and-charge-russian-leader-of-lockbit-ransomware-gang/

2024-05-01 19:45:45

NEW: Until today UnitedHealth only said "a substantial proportion of people in America" were affected by the Change Healthcare cyberattack.
In a hearing today, when pushed to be more precise and provide a percentage, UnitedHealth CEO Andrew Witty estimated that "maybe a third" of Americans had their health data stolen by hackers.
It's still unclear when UnitedHealth will begin notifying victims.
https://techcrunch.com/2024/05/01/united-healthcare-ceo-says-maybe-a-third-of-u-s-citizens-were-affected-by-recent-hack/

2024-05-01 15:22:04

NEW: UnitedHealth CEO told Senators that the company has now enabled multi-factor authentication on "all of our external facing systems."
The CEO revealed yesterday that a server that did not have multi-factor enabled was the cause of the recent cyberattack against UnitedHealth's subsidiary Change Healthcare, which impacted hospitals, pharmacies, and doctor's offices across the U.S.
As of yet, UnitedHealth still has to say how many patients were impacted by the hack.
https://techcrunch.com/2024/05/01/unitedhealth-ceo-tells-senate-all-systems-now-have-multi-factor-authentication-after-hack/

2024-04-17 13:26:42

- reply

UPDATE: We followed up with Trust Wallet, asking them to explain how they "verified the legitimacy of the potential threat” -- as they put it -- but they declined to provide any details.
And their CISO Eve Lam reiterated their advice to turn off iMessage, without citing evidence for this alleged imminent threat.
https://techcrunch.com/2024/04/16/a-crypto-wallet-makers-warning-about-an-imessage-bug-sounds-like-a-false-alarm/

2024-04-16 18:53:01

NEW: A crypto wallet maker said it had "credible intelligence" that hackers could target iPhone users with a zero-day, and even recommended turning off iMessage.
But the "credible intelligence" was actually just an ad on a scammy-looking dark web site.
Zero-days exist and it's good for people to be aware, but this post went viral and basically just spread FUD.
https://techcrunch.com/2024/04/16/a-crypto-wallet-makers-warning-about-an-imessage-bug-sounds-like-a-false-alarm/

2024-04-12 14:58:16

NEW: We spoke to Yevhenii Panchenko, the chief of division of Ukraine's Cyberpolice, about how they are fighting Russian hackers, and about how their work has changed since the invasion.
We also touched on crypto, ransomware and documenting war crimes.
"[Our mission] almost totally changed," he said. "We crave information about Russian soldiers."
https://techcrunch.com/2024/04/12/how-ukraines-cyber-police-fights-back-against-russias-hackers/

2024-04-06 16:35:00

NEW: A startup is offering up to $7 million for iPhone zero-days, up to $5 million for Android zero-days, and up to $5 million for WhatsApp and iMessage zero-days.
The prices of zero-days have multiplied in the last few years, and it shows security of our devices is getting better, according to experts, as well as people who work in the zero-day industry.
“The mitigations that vendors are implementing are working, and it’s leading the whole trade to become much more complicated, much more time consuming, and so clearly this is then reflected in the price,” said the director of research at Crowdfense, the company offering these new bounties.
https://techcrunch.com/2024/04/06/price-of-zero-day-exploits-rises-as-companies-harden-products-against-hackers/

2024-03-26 21:09:02

NEW: Facebook snooped on Snapchat users' encrypted network traffic to study how they behaved, unsealed court documents reveal.
This was part of a secret program called "Project Ghostbusters," and even inside the company, it was very controversial.
“I can’t think of a good argument for why this is okay. No security person is ever comfortable with this, no matter what consent we get from the general public. The general public just doesn’t know how this stuff works,” Pedro Canahuati, Facebook's then-head of security engineering, wrote in an email.
https://techcrunch.com/2024/03/26/facebook-secret-project-snooped-snapchat-user-traffic/