A series of technical problems plague Fitbit — and more specifically, Fitbit users — throughout the summer. On Tuesday this week, Fitbit Charge 5 owners found it impossible to sync their devices with Android and iOS systems due to widespread Fitbit outage for much of the day. Earlier in the season, Android users complained about an update to the Fitbit app that apparently broke the “estimated oxygen variation” graph, which describes how oxygen levels in the users’ blood change during sleep.
The update caused users to see false increases in their nightly oxygen variations, causing mass confusion. Earlier this year, the company recalled Fitbit Ionic smartwatches after 78 of them burned users. Customers have complained throughout the summer that the company is taking far too long to refund watches. Read more on The edge.
Twilio breach exposes Signal users’ phone numbers
According to a support notice by Signal, a phishing attack against Twilio, an SMS service company, revealed the phone numbers of 1,900 Signal users. The company stressed that no other data was breached. Signal uses Twilio to text verification codes to users registering their Signal app. The successful phishing attack provided momentary access to Twilio’s customer support console, which exposed verification codes confirming that these 1,900 phone numbers were stored on Signal devices and allowed attackers to potentially use the codes to activate Signal on different devices. Signal alerts all affected users and asks them to re-register their devices. To learn more, see Ars-Technica.
The SOVA Android Banking Trojan has become more dangerous
Researchers have discovered an updated version of the SOVA banking Trojan that has greatly extended its capabilities. Formerly equipped to target up to 90 apps, the malware can now attack up to 200, including banking apps, crypto exchanges, and crypto wallets. Other updated features include intercepting two-factor authentication codes, stealing cookies, and reaching a wider group of international targets. The new variant hides in fake apps posing as legitimate apps, like Amazon or Chrome. The researchers dubbed this latest version SOVA v4, but they believe a new version is already in the works that will include a mobile ransomware component. See pirate news for more.
Over 9,000 VNC servers exposed
At least 9,000 exposed Virtual Network Compute (VNC) endpoints have been discovered online, providing potential attackers with a gateway to connected internal networks. The VNC system offers control of a remote computer through the Remote Frame Buffer Protocol, which helps users connect to systems that require monitoring or adjustments. The researchers were alarmed that the exposed VNC endpoints were not password protected, as many of them connect to community and commercial services, such as industrial control systems and water treatment facilities. To find out more, see beeping computer.
Lots of confusion
In a bizarre case of mistaken identity, the Clop ransomware gang claimed to have attacked and breached British water company Thames Water, but the company insists the claim is a hoax. Meanwhile, another UK water company called South Staffordshire Water reported a cyberattack that caused disruption to its corporate IT network. Could it be that Clop attacked the wrong target and didn’t know it? Continuing the confusion, Clop said he accessed the company’s SCADA (supervisory control and data acquisition) which controls chemical supplements in the water, but South Staffordshire Water said the attack did not affect the company’s ability to provide drinking water to the community. For more on this strange story, see ZDNet.
The essentials of the week on the Avast blog
Today’s scammers rely on an internet connection and social engineering to make a living. To make sure you don’t fall victim to an online scammer, here are six common types of internet scams and how to avoid them.