Software company One Identity has acquired identity access management (IAM) solutions provider OneLogin. 

News of the acquisition by the Quest Software business was announced yesterday; however, the terms of the deal were not disclosed. 

One Identity said that combining OneLogin with its existing privileged access management (PAM), identity governance and administration (IGA), and active directory management and security (ADMS) solutions will allow customers “to take a holistic approach to identity security with trusted, proven technology in each major category.”

Together, the customer bases of OneLogin and One Identity cover a vast cross-section of the world’s enterprises. OneLogin manages more than 40 million identities for 5,500 customers, while One Identity takes care of more than 250 million identities for 5,000 organizations.

“Joining One Identity provides us with the ability to further accelerate our growth and provide additional value for both of our [companies’] customers,” said Brad Brooks, CEO of OneLogin. “With OneLogin’s robust unified platform for both workforce and CIAM, combining forces with One Identity’s suite of products including their PAM solution, will allow new and existing customers, on a global scale, to tap into the market’s only unified identity security platform.”

Citing Verizon’s Data Breach Investigations report that found 61% of breaches are caused by the improper management of credentials used to access data and applications, and roughly 70% are linked to the abuse of accounts with “privileged” access, One Identity said that an end-to-end approach to identity security was important to protect the way organizations work.

“With the proliferation of human and machine identities, the race to the cloud and the rise of remote working, identity is quickly becoming the new edge – and protecting identity in an end-to-end manner has never been more important,” said Bhagwat Swaroop, president and general manager of One Identity. 

“By adding OneLogin to our portfolio, and incorporating it into our cloud-first Unified Identity Security Platform, we can help customers holistically correlate all identities, verify everything before granting access to critical assets and provide real-time visibility into suspicious login activity. With identity at the core, customers can now implement an adaptive zero trust strategy and dramatically improve their overall cybersecurity posture.”

Netflix has axed some scenes from its hit show Squid Game because the phone numbers it featured turned out to be genuine and in use by people in the real world. 

The deletions were made after the owners of the phone numbers received thousands of text messages and phone calls from curious Squid Game fans located around the globe.

Since premiering on the streaming platform on September 17, Squid Game looks set to become one of the most popular Netflix shows in history. The South Korean fictional drama depicts contestants who are deeply in debt playing children’s games to win a life-altering amount of cash. In a disturbing twist, players who lose are executed. 

A Korean man from Gyeonggi province, who claims his digits were exposed in a subway scene featured in the first episode of the show, said that his phone has been overwhelmed with thousands of nuisance calls. 

Speaking to Korean publication Money Today, he said: “It has come to the point where people are reaching out day and night due to their curiosity.”

The constant contact from Squid Game fans has prevented the man from receiving calls and messages that are actually intended for him.

“It drains my phone’s battery, and it turns off,” he said. 

He added: “At first, I didn’t know why, then my friend told me that my number came out in Squid Game.”

The man’s phone number allegedly appeared on a business card passed to Lee Jung-Jae’s character, Seong Gi-Hun, by a mysterious man in a black suit.

Changing his number to avoid nuisance calls is not something the man said he wanted to do, since he has used it for business calls for the past decade. 

The man said that his wife, whose phone number is identical to his with the exception of one digit, has also been receiving nuisance calls from Squid Game fans with careless fingers. 

A spokesperson for Netflix and the show’s maker Siren Pictures said: “Together with the production company, we are working to resolve this matter, including editing scenes with phone numbers where necessary.”

A voucher scheme launched by the Northern Ireland Assembly to stimulate economic growth following Covid-19 lockdowns is having an identity crisis. 

Under the £145m High Street Spend Local Scheme, the approximately 1.4 million residents of Northern Ireland who are aged 18 and over are eligible to apply for a £100 Spend Local voucher. 

The voucher takes the form of a prepaid card, which is accepted by businesses across Northern Ireland. To apply for the card, residents must submit their email address along with their National Insurance number (NINO). 

However, it has been reported that the voucher applications of around 1,000 eligible individuals were denied because their NINO had already been used to successfully complete an earlier voucher application. 

It is unclear whether the issue is the result of a system glitch, human error on the part of the applicants, or fraudsters who have been applying for vouchers using stolen NINOs. 

A spokesperson for the Department for the Economy told the BBC that “no fault” had been found in its voucher application system that might account for the situation.

The husband of a woman impacted by the issue told The Nolan Show: “She tried to apply for the card – went online, gave her email address, got her link back and then you click on the link and put in your National Insurance number.

“A screen popped up and said: ‘We’re sorry but it appears your National Insurance number has been entered already and used by someone else making an application.’ And that was it, and the only thing she could do about it was to email [the Department for the Economy].”

The woman subsequently reported the issue to the Department via email. The only response she has received is a message saying that they were aware of the issue.

Her husband told the Belfast Telegraph that as a test, he applied for a voucher using an altered version of his own NINO and was able to advance to the next stage of the application.

The Department for the Economy stated: “The scheme has robust anti-fraud measures in place and this issue will be kept under close review.”

Google has announced financial backing for a new initiative designed to incentivize proactive security improvements to open source code.

Unlike bug bounty programs which offer financial rewards to researchers who discover critical software bugs, the Secure Open Source (SOS) project will do the same for developers whose work prevents major vulnerabilities appearing in the first place.

“SOS rewards a very broad range of improvements that proactively harden critical open source projects and supporting infrastructure against application and supply chain attacks,” Google explained.

“To complement existing programs that reward vulnerability management, SOS’s scope is comparatively wider in the type of work it rewards, in order to support project developers.”

The selection process for in-scope projects will take into account NIST guidelines and the new Presidential executive order on cybersecurity, as well as criteria such as how many users will be affected, and how serious an impact a compromise would have.

The initial list of projects includes software supply chain improvements such as hardening of CI/CD pipelines, adoption of software artifact signing and verification, and enhancements that produce higher OpenSSF Scorecard results.

SOS will also look at projects which use OpenSSF Allstar and remediate any discovered issues, and ones capable of earning a CII Best Practice Badge.

Google’s $1m investment will help to fund awards of $10,000 or more for “complicated, high-impact and lasting improvements that almost certainly prevent major vulnerabilities in the affected code or supporting infrastructure.”

Smaller amounts ranging from $505 to $10,000 are available depending on the complexity and benefits.

“This $1 million investment is just the beginning — we envision the SOS pilot program as the starting point for future efforts that will hopefully bring together other large organizations and turn it into a sustainable, long-term initiative under the OpenSSF,” Google concluded.

“We welcome community feedback and interest from others who want to contribute to the SOS program. Together we can pool our support to give back to the open source community that makes the modern internet possible.”

A recent report from Sonatype revealed a 650% year-on-year increase in upstream supply chain attacks impacting open source software components.

A major telecoms service provider has revealed it was the victim of a five-year breach impacting hundreds of customers.

Syniverse routes text messages for hundreds of global telco customers — allowing it to boast of reaching “more people and devices than anyone on Earth.”

However, in a filing with the SEC last week ahead of the firm going public via a merger with a special purpose acquisition company (SPAC), it admitted discovering a major incident back in May.

The unauthorized access to its operational and IT systems was subsequently found to have been ongoing since May 2016.

“Syniverse’s investigation revealed that the individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers,” it continued.

“All EDT customers have been notified and have had their credentials reset or inactivated, even if their credentials were not impacted by the incident. All customers whose credentials were impacted have been notified of that circumstance.”

Although the firm claimed it has seen no efforts to disrupt operations or monetize the attack, it could not rule out further discoveries.

“While Syniverse believes it has identified and adequately remediated the vulnerabilities that led to the incidents described above, there can be no guarantee that Syniverse will not uncover evidence of exfiltration or misuse of its data or IT systems from the May 2021 Incident, or that it will not experience a future cyber-attack leading to such consequences,” it said.

“Any such exfiltration could lead to the public disclosure or misappropriation of customer data, Syniverse’s trade secrets or other intellectual property, personal information of its employees, sensitive information of its customers, suppliers and vendors, or material financial and other information related to its business.”

It’s unclear exactly what information the attackers would have gained access to with the EDT compromise, but it could theoretically include metadata or even the content of text messages, including one-time passcodes, which could unlock two-factor authentication-protected accounts.

The firm claims to process over 740 billion messages every year for 300+ global mobile operators.

An audacious supply chain raid like this bears the hallmarks of nation-state intelligence gathering or a highly organized cybercrime group.

Facebook has apologized for a major global outage that left users unable to access the social network and other platforms for hours, blaming the incident on a configuration error.

The outage began at around 11.40 Eastern Time on Monday morning and lasted well into the evening of the same day — affecting not just Facebook and Messenger but Instagram and WhatsApp.

The recovery effort was also impacted as Facebook engineers found it difficult to access internal tooling which used the same internet infrastructure. Global staff were left high-and-dry for similar reasons.

The issue appears to have stemmed from an update to the firm’s Border Gateway Protocol (BGP) records. BGP is critical to the seamless functioning of the internet, allowing networks of addresses such as Facebook’s to advertise their presence to others.

“It’s a mechanism to exchange routing information between autonomous systems (AS) on the internet,” explained Cloudflare in a technical blog about the incident.

“The big routers that make the internet work have huge, constantly updated lists of the possible routes that can be used to deliver every network packet to their final destinations. Without BGP, the internet routers wouldn’t know what to do, and the internet wouldn’t work.”

Although some commentators had speculated foul play, the cause of the outage appears to be human error..

Vice president of infrastructure, Santosh Janardhan, said no user data was compromised and that the root cause of the issue was a “faulty configuration change.”

“Our engineering teams have learned that configuration changes on the backbone routers that coordinate network traffic between our datacenters caused issues that interrupted this communication. This disruption to network traffic had a cascading effect on the way our datacenters communicate, bringing our services to a halt,” he explained.

“People and businesses around the world rely on us every day to stay connected. We understand the impact outages like these have on people’s lives, and our responsibility to keep people informed about disruptions to our services. We apologize to all those affected, and we’re working to understand more about what happened today so we can continue to make our infrastructure more resilient.”