As winter draws to an end, and the days are getting lighter - the Queens are counting down until spring here in the UK!

We've been absolutely swept off our feet with 2022 now in full swing, and we are so excited to announce that Sarah has been nominated for the "Inspirational Gloucestershire Women in Tech" award by Hub8 in partnership with CyNam!

As always, we're also happy to report on all the breaking industry news this month...

Late January, a vulnerability was discovered in Polkit's pxexec module that could allow for local privilege escalation in Unix environments. Polkit is installed by default on all major Linux distributions and successful exploitation of this vulnerability could result in privilege escalation to root privileges.

KP Snacks was also hit by a major ransomware attack by the Conti ransomware group, affecting distributions nationwide in the UK. The company's internal network had been breached with threat actors gaining access to and encrypting sensitive files, including employee records and financial documents.

The Foreign Office was also recently targeted by threat actors, and fell victim to a "serious cyber security incident" of which details could not be disclosed. Urgent support was required to support remediation and investigation. 

Following the military invasion of Ukraine by Russian government, Anonymous have declared cyberwar on Russia. Anonymous have claimed to have hacked the Russian Ministry of Defence Database as well as several state TV channels to broadcast pro-Ukraine content. 

Nvidia have also fell victim to a ransomware attack, a ransomware group called "Lapsus" has supposedly claimed responsibility for the attack, posting redacted screenshots of directory listings and proprietary source code they are threatening to release in full if Nvidia does not pay.

To round things off, we're asking all our connections and followers to help our good friend Anjuli if you have the time... 

"My name is Anjuli Shere and I am a cyber security PhD student at the University of Oxford, a research analyst for the Association for International Broadcasting (AIB), and pre-doctoral fellow at Harvard’s Shorenstein Center on Media, Politics and Public Policy. My research aims to help members of the media understand and counter threats to journalism from novel networked devices, known as the Internet of Things. 

This research is necessary because journalists face many threats - from physical attacks while covering protests and riots, to laws citing national security justifications that encroach on source protections, and increasingly, technologies such as spyware. All of these threats can be facilitated and exacerbated by the so-called “consumer Internet of Things” (the IoT): a variety of common networked devices that include gaming systems, smart cars and fitness trackers. While there has been a lot of reporting on the topic of spyware, there is relatively little awareness of the dangers that the IoT poses to journalists and press freedom generally. Like spyware, IoT can monitor messages, location information and daily actions. Unlike spyware, the IoT can also facilitate cyber-physical threats. In an article for The Journalist's Resource, I discussed the issues with ubiquitous and designed-for-subtly IoT technologies being effectively an “unknown unknown”.

I am writing to ask you to participate in an online survey about the threats and protections that my research explores. This survey is intended to evaluate a framework I have developed which labels and categorises these threats to journalists and possible countermeasures, to assess if and how these can be useful for journalist risk assessment and management.

This survey will cover basic biographical information to establish your expertise and experience in cyber security, as well as questions to collect your thoughts on my research. It will take approximately 45-60 minutes to complete, with a deadline of 1st April.

While the ways in which journalists defend themselves against threats regarding smartphones and laptops are known and documented, I am researching the impact of novel networked technologies (known as the Internet of Things) on journalism. My goal is to determine which factors (e.g. aspects of logistics, preparation, personnel, etc.) might be sources of best practice and effective for cyber protection for the journalistic ecosystem in the future. I hope that this research will be an important step towards protecting media freedom in a world with a rapidly evolving attack environment.

This research study has been approved by The University of Oxford’s Central Ethics Committee (reference: CS_C1A_021_027), and contributes to my doctoral research. Full removal from the study can be offered if a participant withdraws consent up to 2 weeks after completing, if they withdraw later, all identifying information (e.g. quotes) can be removed or anonymised but the quantitative data cannot be removed.

If you are interested in participating, please visit the following webpage: https://oxford.onlinesurveys.ac.uk/threat-countermeasure-matching-survey"

As always, you can find our recent posts below.

Lots of love,

The Security Queens xxx