Here is our latest news roundup of articles about network and TLS security. Click here to see the whole series.

TLS/SSL news

• The Dutch government, the last EU country to run its own certificate authority, announced that they will stop issuing TLS certificates starting in December 2021.
• GitHub will be depreciating TLS 1.0 and TLS 1.1 for the public NPM registry starting Oct. 4, 2021.

Data security

• A new phishing campaign that uses emails spoofing as PayPal is using live chat to bypass secure email gateways.
• The FTC issued a warning about a new phishing scam impersonating state agencies via SMS.
• Amazon will provide AWS customers free FIDO Security Keys so that they can better protect account security.
• Firefox will block mixed content downloads, or insecure file downloads. Chrome rolled out a similar feature in 2020.
• Firefox will also use HTTPS by default in private browsing in their next update.

Data breaches

• T-Mobile announced a breach that exposed names, date of birth, and social security numbers for over 40 million customers, including former and prospective customers.
• JPMorgan Chase recently warned customers in Montana that other customers could have seen their personal data due to a glitch on their mobile app and website.

Vulnerabilities

• A vulnerability that could allow hackers to look through a camera feed and remotely control devices was found that can affect millions of IoT devices.
• Microsoft found a vulnerability in cloud software Azure which left the data of many customers, including Fortune 500 companies, exposed for the past two years.

Government regulation

• A new U.S. bill would require federal agencies, federal contractors and organizations critical to national security to report security breaches to the Cybersecurity Infrastructure Security Agency (CISA) within 24 hours of discovery.
• A new bill in the U.S. Senate would require digital signatures for important court orders.
• A new Surveillance Legislation Amendment bill in Australia allows police to collect device data and social media account information without a warrant.

Malware

• The largest oil pipeline in the United States, Colonial Pipeline reopened operations this month after a major hack.