Boris Johnson discovers phone passcode for WhatsApp The Register probe

Infosec in a nutshell Former British Prime Minister Boris Johnson has thrown a wrench into the work of the country’s COVID-19 investigation by claiming he cannot remember the password to unlock an old phone investigators are looking for.

Investigation searched for the device as it is believed to contain a wealth of WhatsApp messages from the early days of the COVID-19 pandemic when the encrypted chat app was widely used amid criticism from the Prime Minister and others ministers unable to meet in person.

Marry would have last used the device in question in May 2021 after it was revealed that his phone number was freely available to anyone online who knew where to look for a press release he issued in 2006 when he was MP for Henley and shadow minister for higher education. His phone number was still in use while PM was apparently unchanged in the 15 years since the press release was issued.

Johnson could not remember the password “with 100% confidence”, according For The temperatureraising fears that the device could be erased if the ex-Prime Minister was wrong too often.

Johnson’s oversight came after the UK High Court ruled that messages and logs were to be handed over without redaction, which the government objected to on the grounds that this would have led to the exposure of “unambiguously irrelevant” material.

The judges rejected that argument last week, saying the inclusion of irrelevant documents did not invalidate the order to hand everything over without taking the time to draft it first. Part of the inquiry’s message request included individual communications between Johnson, former Chancellor Rishi Sunak and Cabinet Secretary Simon Case.

However, everyone can rest easily. On Thursday, the government claimed it had found a record of the PIN code from Johnson’s old device and opened it up to the committee. By the BBC, the Cabinet Office has until 4 p.m. BST on Monday to deliver the requested messages in full.

This does not mean that those who are not part of the survey will see them. The Cabinet Office and the Inquiry itself retain the right to redact before wider dissemination to experts, witnesses or the public.

Cybercriminals love MOVEit: Two more high-profile victims admit to beatings

What do the financial giant Deutsche Bank and the American university elite Rutgers have in common? They have both become collateral damage as hackers continue to exploit vulnerabilities in MOVEit file transfer software.

In a statement to beeping computer earlier this week, Deutsche Bank admitted one of its external service providers in Germany experienced a security incident. Without saying that the attack was definitely caused by vulnerabilities in MOVEit, DB said BC that “In addition to our service provider, we understand that more than 100 companies in more than 40 countries are potentially affected.”

Combined with the fact that Deutsche Bank used the affected service provider to operate its account switching service, MOVEit is a probable cause due to the high volume of data transferred from one institution to another.

Rutgers University, on the other hand, said exposing some of its data processed by the National Student Clearinghouse was due to MOVEit vulnerabilities. Rutgers probably isn’t alone either: NSC works with 3,600 colleges across the United States to gather student data for the Department of Education.

Both Rutgers and Deutsche Bank said their internal systems were unaffected.

CVSS 4.0 is coming

The Forum for Incident Response and Security Teams (FIRST) this week unveiled the fourth version of its Common Vulnerability Scoring System (CVSS) with promises to “provide the highest vulnerability assessment fidelity for both industry and the public”.

There is a number of changes In CVSS 4.0such as removing the concept of “scope” and replacing it with “vulnerable” and “subsequent” system impacts, scoring vulnerabilities for software libraries, and considering multiple base scores.

Perhaps the most notable change is to the CVSS nomenclature, which is modified to include the metrics used to arrive at the score: base, environment, or threat. CVSS scores will be labeled as CVSS-B (basic only), CVSS-BE (basic, environmental), CVSS-BT (basic and threat), or CVSS-BTE when all three have been included in the calculations.

The reason for the new nomenclature, FIRST said, is that CVSS-B scores only measure the severity of a vulnerability, but do not reflect risks to individual environments or systems. CVSS-B scores “should be supplemented with an environmental scan,” FIRST said, and give environmental metrics and threats that are periodically updated.

Public preview and feedback for CVSS 4.0 ends July 31, with a targeted release date of October 1, 2023 for the new standard.