Security: Deloitte, Ransomware, Equifax, Denmark, and macOS 0-Day

• Deloitte hack exposes secret emails and plans from firm's blue-chip clients

  Hackers [sic] are said to have accessed confidential emails and plans of Deloitte's blue-chip clients, along with usernames, passwords, IP addresses, architectural diagrams for businesses and health information.

• Deloitte hit by cyber-attack revealing clients’ secret emails

  Deloitte, which is registered in London and has its global headquarters in New York, was the victim of a cybersecurity attack that went unnoticed for months.

• A quarter of local UK councils have fallen victim to ransomware

  115 councils (27 per cent) said they had been victims of security ransoms, while 43 per cent said they hadn't.

• Equifax CEO Richard Smith Retires as Breach Fallout Continues

  Equifax's massive data breach has claimed another victim - Richard Smith, the company's CEO and Chairman of the Board. Equifax announced that Smith is retiring from his role at the company, effective Sept. 26. "The cybersecurity incident has affected millions of consumers, and I have been completely dedicated to making this right," Smith stated. "At this critical juncture, I believe it is in the best interests of the company to have new leadership to move the company forward." Equifax announced on Sept. 7 that it was the victim of a data breach the exposed personally identifiable information on 143 million Americans. The company initially reported that it first became aware of the breach on July 29, though subsequent reports have alleged that the company was breached as early as March.

• Denmark continues its work on cyber security plan

  Denmark’s Ministry of Finance is to finalise Denmark’s national strategy for cyber and information security. The ministry recently took over coordination of the plans, which previously were being prepared by the Ministry of Defence. The strategy is to be presented early next year, reports Denmark’s Agency for Digitisation (Digitaliseringsstyrelsen - DIGST).

• Password-theft 0-day imperils users of High Sierra and earlier macOS versions

  There's a vulnerability in High Sierra and earlier versions of macOS that allows rogue applications to steal plaintext passwords stored in the Mac keychain, a security researcher said Monday. That's the same day the widely anticipated update was released. The Mac keychain is a digital vault of sorts that stores passwords and cryptographic keys. Apple engineers have designed it so that installed applications can't access its contents without the user entering a master password. A weakness in the keychain, however, allows rogue apps to steal every plaintext password it stores with no password required. Patrick Wardle, a former National Security Agency hacker who now works for security firm Synack, posted a video demonstration here.

Facebook Licence-Patents Debacle

• Facebook’s About Face

  Thirty-five days after publicly stating, in response to objections from the Apache Software Foundation among others, that the company would not be re-licensing its React library, Facebook on Friday announced that it was re-licensing its React library. It was a surprising but welcome reversal for many in the industry, including Automattic’s Matt Mullenweg. Ten days ago, Mullenweg published a piece that was at once understanding and blunt announcing that React would be excised from WordPress related projects. The problem was not Automattic – their general counsel saw little problem with the license – but given the breadth of WordPress’ distribution, the decision was made to remove the software because of the uncertainties surrounding its license. As bad as it was being banished from Apache Software Foundation projects, this was worse. Depending on whose numbers you use, WordPress can account for something close to one in four websites. Given such extensive and escalating costs, the burden of proving the offsetting benefits to a patent clause required by virtually no one else in the industry presumably became too great, at which point the only rational decision would be to re-license the asset – difficult as such backtracking may have been.

• Facebook Relents on React.js License Issue

• Facebook Relents to Developer Pressure, Relicenses React

Firefox Quantum

• Firefox takes a Quantum leap forward with new developer edition

  Earlier this year we wrote about Project Quantum, Mozilla's work to modernize Firefox and rebuild it to handle the needs of the modern Web. Today, that work takes a big step toward the mainstream with the release of the new Firefox 57 developer edition. The old Firefox developer edition was based on the alpha-quality Aurora channel, which was two versions ahead of the stable version. In April, Mozilla scrapped the Aurora channel, and the developer edition moved to being based on the beta channel. The developer edition is used by a few hundred thousand users each month and is for the most part identical to the beta, except it has a different theme by default—a dark theme instead of the normal light one—and changes a few default settings in ways that developers tend to prefer.

• Start Your Engines – Firefox Quantum Lands in Beta, Developer Edition

  Engines are important, both in cars and in browsers. That’s why we’re so revved up this morning – we’re releasing the Beta of a whole new Firefox, one that’s powered by a completely reinvented, modernized engine. Since the version number – 57 – can’t really convey the magnitude of the changes we’ve made, and how much faster this new Firefox is, we’re calling this upcoming release Firefox Quantum.

Tux Machines is proud to be hosted by