Weekend Short: Two Arrests, One Five Minute Security Job
It's Saturday, so this one is brief. Two stories worth your attention, and one job you can finish in five minutes.
Two arrests, one lesson
Dutch police have arrested a suspect in the Shiny Hunters investigation, a person who had reportedly presented as a reformed hacker. Separately, the FBI arrested another ShinyHunters suspect linked to a jobs portal hack, and the founder of a firm that negotiates with ransomware gangs.
Those stories matter for the same reason: a reputation for being trustworthy, or for being on the right side, is not proof of anything. If you ever see someone advertising a criminal past as a reason to trust them with your systems, or turning up during a crisis to negotiate with criminals, take independent advice first.
There is no need to panic about this. Most households will never be in that room. But businesses should know that when a breach happens, the sensible route is your insurer, your solicitor and the police, not one stranger who arrived at speed.
Who the developer story is for
Security researchers have found credential stealing workflows planted in tens of thousands of code repositories. If you don't manage software, this one isn't about you, and you can safely move on. If you do, ask your developer which accounts have access, whether multi-factor authentication is switched on, and whether anyone has reviewed the automated workflows running in your projects.
Your one job this weekend
Open your email app, your banking app and your main shopping account. Switch on two-step verification for each one, then check that the recovery phone number and email attached to each account are still yours and still current. Old landlines and abandoned addresses are a quiet gap in an otherwise protected account.
That's it. Three accounts, five minutes. Do it before Monday.
Related reading