Our bimonthly Security Reports
SWITCH Security Report 2022-03/04
The new SWITCH Security Report is online, covering the following topics:
- Google Chrome – 100 does it better. Zero-day attacks on the popular browser are multiplying
- Huge hole on the Ronin Bridge: hacker steals more than USD 600 million from the Ronin blockchain
- POP is king – patches on printers yet again
- Mission Impossible, but in real life
- Road hack: ransomware attack spares 3,000 road racers fines and other penalties
Read the English report. Read the German report.
SWITCH Security Report 2022-01/02
The new SWITCH Security Report is online, covering the following topics:
- Good and evil in one square package: the comeback of the QR code
- A first look at the Metaverse: hackers launch severe and targeted attacks on special data of the Red Cross and Red Crescent
- The Ukraine war and the duplicity of the Metaverse
- Apple AirTags – the “next big thing” in data misuse?
Read the English report. Read the German report.
SWITCH Security Report 2021-10/11
The new SWITCH Security Report is online, covering the following topics:
- GoldDust but no nuggets: seven REvil partners caught, but the real orchestrators are still out there
- EasyHack? Data belonging to COVID-19 loan recipients stolen from EasyGov platform
- Tor under siege: massive de-anonymisation attacks target Tor network
- No end to the virus in sight – do we need a patch campaign alongside a vaccination campaign?
Read the English report. Read the German report.
SWITCH Security Report 2021-09/10
The new SWITCH Security Report is online, covering the following topics:
- Covid collateral damage: how the pandemic impacts IT security
- Malware-as-a-service – advertised via Google Ads and supported by brazen PR
- Advertising and reality: data stolen from 50 million T-Mobile US Inc. customers
- Facebook face down – the temporary fall of the Zuckerberg empire
Read the English report. Read the German report.
SWITCH Security Report 2021-07/08
The new SWITCH Security Report is online, covering the following topics:
- Perhaps 1984 WAS like 1984 – a big blunder by Apple or simply brilliant advertising?
- Pegasus: what IT users can learn from the ancient Greeks
- The biggest hack in cryptocurrency history – finger-wagging or hacker vanity in its purest form?
- In bed with Siri, Alexa and Uber – what is the privacy and data security situation for working from home?
Read the English report. Read the German report.
SWITCH Security Report 2021-05/06
The new SWITCH Security Report is online, covering the following topics:
- Back and forth in the pipeline: hacking and rehacking the US fuel firm Colonial Pipeline with Ransomware as a Service
- Meat and greed – the world’s largest meat processing company pays a hefty USD 11 million ransom after a ransomware attack
- When Android devices catch the flu: FluBot, the banking trojan, spreads to Android devices
- Russian cyber spies attack government and NGO networks
Read the English report. Read the German report.
SWITCH Security Report 2021-03/04
The new SWITCH Security Report is online, covering the following topics:
- Exploit on Exchange – vulnerabilities in Microsoft Exchange servers trigger a red alert
- Learning by doing – data leaks discovered in the Swiss Army’s cyber training school
- Rocky start(up) at Verkada – 150,000 surveillance cameras hacked
- Refunds from the remorseful Ziggy ransomware gang
- Data scraping on Facebook and LinkedIn: big data brings big damage
Read the English report. Read the German report.
SWITCH Security Report 2021-01/02
The new SWITCH Security Report is online, covering the following topics:
- Dependency confusion – when trust is too good to be true
- Water hacking – not a new trendy sport, but a serious threat
- Emotet: the king is dead – let there be no successor!
- Rumours of its death are greatly exaggerated: how phishing mailers trick cutting-edge security filters with good old Morse code
Read the English report. Read the German report.
SWITCH Security Report 2020-11/12
The new SWITCH Security Report is online, covering the following topics:
- Choose your team carefully – hackers use fake MS Teams updates to attack networks, especially those of educational institutions
- Audacious coronavirus relief phishing delivers an extra malware ‘bonus’ on request and creates a challenge for BEC
- Stopping the attempt to stop online hate speech?
- Close the gates before it’s too late: what Sneakers and the Internet of Things have in common
Read the English report. Read the German report.
SWITCH Security Report 2020-09/10
The new SWITCH Security Report is online, covering the following topics:
- Ransomware – the new normal of digital extortion
- A murky supply chain – how hackers profited from Cumulus data
- Smisherman’s Friends – a new wave of smishing attacks is washing over Europe and Switzerland
Read the English report. Read the German report.
SWITCH Security Report 2020-07/08
The new SWITCH Security Report is online, covering the following topics:
- Aimless navigation – Garmin scrambling to regain its bearings after hacking incident
- Hacking with a heavy hand: German intelligence is making a push to install hardware directly with internet providers and reroute internet traffic
- A protection shield minus the protection – ECJ declares Privacy Shield unlawful
- A night(mare) of celebrities – The ‘biggest Twitter hack of all times’ raises questions about the security of the network
Read the English report. Read the German report.
SWITCH Security Report 2020-05/06
The new SWITCH Security Report is online, covering the following topics:
- The coronavirus: a blessing for some, a curse for others – where is IT security at with contactless payment?
- You’ve got mail (and malware too) – serious security gap in Apple’s Mail app on iPads and iPhones now closed
- Everything must go – ‘Shade’ hackers ‘shut down’ and publish hundreds of thousands of decryption keys
- Swiss users targeted by cybercriminals
- Elite targets – ETH supercomputers Euler and Leonhard (and more) hacked
Read the English report. Read the German report.
SWITCH Security Report 2020-03/04
The new SWITCH Security Report is online, covering the following topics:
- The coronavirus has company – a pandemic of computer viruses
- The ten most important rules for working securely from home
- Online meetings – how secure are Cisco Webex and Zoom?
- For real? Ransomware gangs develop a ‘code of honour’ in the coronavirus pandemic
Read the English report. Read the German report.
SWITCH Security Report 2020-01/02
The new SWITCH Security Report is online, covering the following topics:
- When backdoors become trapdoors: ‘Crypto Leaks’ hits Switzerland, Crypto Valley – and the entire ecosystem
- I, Robot, ZigBee and IoT
- Sure, it’s secure! Are you sure?
- A different kind of virus: China launches its Close Contact Detector app for smartphones
SWITCH Security Report 2019-11/12
- Is internal security just an issue for security companies?
- CNAME cloaking – the new privacy attack
- Emotet (& others): a devastating malware cocktail – now with added NextCry for Linux
- Account deletions and the tough battle against fake news on social media platforms
SWITCH Security Report 2019-09/10
- Data security becomes a challenge for challenger banks
- Break time is over: Emotet is back with a vengeance
- Hackers worm their way to Apple’s core – and spy on iOS devices for two years
Read the English report. Read the German report.
SWITCH Security Report 2019-07/08
- Attacks on PGP key server: is pretty good still good enough?
- We need to talk! About how virtual assistants are listening in.Privacy at Facebook, part two: when the lawyer contradicts the boss
- Breaking Binance: the world’s largest Bitcoin trading platform is hacked and blackmailed
Read the English report. Read the German report.
SWITCH Security Report 2019-05/06
- Brought to light: Federal Crime Office closes down the world’s second largest illegal dark web marketplace
- WhatsApp, state trojans? Or, why the city of San Francisco protects privacy better than Mark Zuckerberg’s messenger app
- Privacy at Facebook, part two: when the lawyer contradicts the boss
- Symmetry as a fundamental principle: now that we have software as a service, it is only a matter of time before we have cybercrime as a service
Read the English report. Read the German report.
SWITCH Security Report 2019-03/04
- Lenin and the detectives: Mobiispy stalkerware can make highly personal data collected while monitoring children and partners publicly accessible
- Ransomware trojan LockerGoga brings companies to their knees
- Straight talk at Facebook: when tech giants fail to meet even minimal security requirements
- Malware straight from the factory: when Shadow Hammer strikes the supply chain
Read the English report. Read the German report.
SWITCH Security Report 2019-01/02
- Company networks at serious risk: recent waves of malspam have been spreading the multifunctional trojan Emotet, targeting Windows devices in particular
- Phishing, porn, data theft: rogue apps appearing as a new and harmful type of ‘non-sellers’ on Google Play and other app stores
- Spy Time now also available for Apple devices – Serious security vulnerabilities allow outsiders to eavesdrop on FaceTime conversations and steal passwords from Keychain in MacOS
- Alexa home alone, nuclear attack via Nest and a new password law in California – what happens when IoT gadgets run amok?
Read the English report. Read the German report.
SWITCH Security Report 2018-11/12
- SiSyPHuS gives Windows 10 low marks for data protection and security
- Vivy app suffering from multiple diseases: security researchers uncover several vulnerabilities in the patient data app
- Facing court: Chinese facial recognition unfairly lands big entrepreneur in hot water
- Not exactly cuddly: data protection authority imposes first GDPR fines after hacking attack
Read the English report. Read the German report.
SWITCH Security Report 2018-09/10
- Turning Good instead of Breaking Bad? Hacking to fend off other hackers
- What do a firefighter and Google Chrome 69 have in common?
- 15 months later: new attacks, same old vulnerability
- Peekaboo exploits vulnerability in surveillance cameras in a major way
Read the English report. Read the German report.
SWITCH Security Report 2018-07/08
- An own goal and serious foul: Spanish football league’s app turns 10 million users into involuntarily spies
- Amazon Rekognition – useful security and convenience tool or total surveillance for pennies?
- An underestimated risk: the number of malware attacks on smartphones and tablets is exploding
- Phishing with the stars: scammers take advantage of our celebrity obsession and the crypto craze to cause harm to users
Read the English report. Read the German report.
SWITCH Security Report 2018-05/06
- Microsoft will never contact you by phone: support scam continues to gain momentum
- «Efail» between hype and disaster: the security world needs to learn how to communicate
- Sonic waves on the attack, recent incidents are reason to prick up your ears
- Waterholing attacks: infrastructure is and remains a target
Read the English report. Read the German report.
SWITCH Security Report 2018-03/04
- The dark side of the Data Force: Facebook, Cambridge Analytica, and the pressing question of who is using whose data for what
- News from the world of state trojans: Microsoft’s analysis of FinFisher
- Russian APT28 hackers’ month-long infiltration of the computer network of Germany’s federal government
- Bitcoin bounty or close encounter: bizarre side-effects of cryptomining
SWITCH Security Report 2018-01/02
- Meltdown and Spectre: security meltdown directly from the processor
- Leaks, fakes and cryptocurrency hacks: business models of a different kind
- Italianitá in the smartphone – state trojan monitors smartphone users
- Kaspersky shut out of Lithuania as well
- Strava leaks – fitness secrets of a different kind
SWITCH Security Report 2017-09/10
- Attack of the digital dolphins: hacking Alexa, Siri and their friends via ultrasound
- The anti-antivirus programme: US government bans agencies from installing Kaspersky software on their computers
- A hack of ‘epic proportions’ at Equifax
- Science fiction 4.0 – how to hack a computer with a drop of saliva
Read the English report. Read the German report.
SWITCH Security Report 2017-07/08
- Family business: Petya and its derivatives sweep over half the world as a new wave of ransomware
- Pay a ransom for your privacy: new «extortionware» exposes its victims
- Positive use of metadata – Cisco can detect malware activity even in encrypted network traffic
- Successful strike against the darknet drug and weapons trade – security services bust AlphaBay and Hansa
Read the English report. Read the German report.
SWITCH Security Report 2017-05/06
- Plenty of tears as WannaCry encrypts unpatched systems
- WannaCry’s siblings from the NSA toolbox
- Keyloggers fitted as standard – HP notebooks snooping on users
- Hakuna Metadata – the browsing goldmine
- Unboxed and hacked – new Samsung Galaxy S8 iris scanner
Read the English report. Read the German report.
SWITCH Security Report 2017-03/04
- Cybercriminals increasingly targeting Mac users
- Malware fitted as standard for Android
- Net neutrality: Casinos on a losing streak? Start blocking websites!
- Internet of Things toys spying on children of all ages
Read the English report. Read the German report.
SWITCH Security Report 2017-01/02
- The Guardian going post-truth with WhatsApp story?
- Fruitfly spyware lives long on Macs
- Good malware – FBI in absurdity trap
- Star Wars on Twitter – sleeping Twitter botnet with over 350,000 bots discovered
Read the English report. Read the German report.
SWITCH Security Report 2016-12
- Power and cybercrime – massive quantities of user data stolen in two recent hacks
- When supposed security add-ons actually spy on your browsing habits
- Mirai part II – botnet knocks out 900,000 Telekom routers
- It’s not all bad news – Avalanche botnet taken down
Read the English report. Read the German report.
SWITCH Security Report 2016-11
- IT security researchers reveal vulnerabilities in photoTAN procedure for mobile banking
- DDoS attack via IoT botnet shuts down parts of Internet
- Triple record: Yahoo loses half a billion customers’ details, more trust than ever and USD 1 billion from its acquisition price
Read the English report. Read the German report.
SWITCH Security Report 2016-10
- Swiss electorate votes in favour of Intelligence Service Act – making everyone a suspect?
- Your money or your device – mobile banking Trojan Gugi tricks Android users
- SWIFT, and it’s gone – banks lose money to hackers again following SWIFT data theft
- It was just a question of time – botnet discovered on Internet of Things
Read the English report. Read the German report.
SWITCH Security Report 2016-09
- Bug bounties and the Cyber Grand Challenge
- Pegasus spies on Apple devices, QuadRooter threatens Android
- A USD 22 billion investment pays off – WhatsApp shares phone numbers with Facebook
- Now you see them, now you don’t – another multi-million-dollar Bitcoin theft
- DiskFiltration and Fansmitter attempt to bridge the air gap
Read the English report. Read the German report.
SWITCH Security Report 2016-08
- Sheer tracking pleasure – debate on information sovereignty and transparency in relation to vehicle data shifts up a gear
- Improving security on the Internet of Things – latest news from the Guardian Project and Riffle, a joint venture between MIT and EPFL
- Summer 2013 revisited – could SFG/FURTIM make the nightmare scenario of a blackout reality?
- Cruel summer 2016 – cybercriminals jumping on the Pokémon GO bandwagon
- Not everyone is chasing Pokémon – Google Sheep View and the Faroe Islands
Read the English report. Read the German report.
SWITCH Security Report 2016-07
- DAO-ism on the ethereal plane – hacker bags cryptocurrency worth USD 50 million
- Ransomware – smart, greedy and unkillable
- CANVAS ready to launch – bridging cybersecurity and ethics
- US border guards want to be your Facebook friend – and other news on anti-terror measures
Read the English report. Read the German report.
SWITCH Security Report 2016-06
- A RUeful tale – unknown cyberattackers steal 20 gigabytes of data from RUAG
- Twitter shuts the door on US intelligence services
- iPhone stays locked – Touch ID demands a password after 48 hours
- Passwords for e-banking and suchlike? You can soon forget them!
Read the English report. Read the German report.
SWITCH Security Report 2016-05
- Faster than Odysseus – e-banking Trojan Gozi attacks Switzerland via news website
- Heartbreak remote – chip implants and the security of implanted, software-driven medical devices
- One point three million dollar phone – FBI spends big in iPhone hacking dispute with Apple
- It looks horrible, and it is – Jigsaw causing terror once again, this time in digital form
Read the English report. Read the German report.
SWITCH Security Report 2016-04
- Probably the most expensive typo ever foils probably the biggest attempted bank robbery ever
- Switzerland targeted by various hacker groups? Series of DDoS attacks on Swiss websites
- Connected cars "one of this generation’s biggest security risks"
- Done and dusted – the new Federal Act on the Surveillance of Post and Telecommunications
Read the English report. Read the German report.
SWITCH Security Report 2016-03
- Torpedoed for a fistful of dollars – university helps authorities spy on Tor users
- Crypto Wars 3.0 – will the FBI be given a licence to snoop, or can Apple successfully lock down the unlocking?
- Deadly bugs in hospital – ransomware Trojan Locky shuts down entire clinics and more
- Mission: Possible – Big Data and automated law enforcement
Read the English report. Read the German report.
SWITCH Security Report 2016-02
- ICSI’s Haystack looking for Android needles – and beta testers for its field study
- Staging a comeback with a blackout – macro-Trojans return and apparently cause Christmas power cut in western Ukraine
- Is it really smart? Many smart home solutions have security holes as big as a garage door
- From Mad Men to Bad Boys – malware becoming harder to monitor due to malvertising
Read the English report. Read the German report.
SWITCH Security Report 2016-01
- Does PrivaTegrity spell the end of crypto wars? David Chaum’s new encryption system bridges gap between completely anonymous communication and crime prevention
- The boss is listening, and it’s OK – controlled surveillance of private communications at work does not violate human rights
- Yesterday’s science fiction, today’s reality – forecasting software and systems to spot crimes before they are committed
- A patchy start to the year – reports of security issues read like a who’s who of network equipment suppliers
- The Clipboard: interesting presentations, articles and videos
Read the English report. Read the German report.
SWITCH Security Report 2015-12
- Pavlov in Paris – how the conditioned response to terrorist attacks links the real and online worlds
- «Added value» as standard – new devices delivered complete with malware and extra vulnerabilities
- Silent profilers – audio beacons allow advertisers to operate extensive tracking
- Ads, adblockers, anti-adblockers, anti-adblock killers – the arms race continues
- The Clipboard: interesting presentations, articles and videos
Read the English report. Read the German report.
SWITCH Security Report 2015-11
- No safe harbour in the Land of the Free – EU Court of Justice restricts data transfer to US
- A different kind of virus – medical equipment hackable online on a grand scale
- Viruses, scanned – free anti-virus programs almost as good as those you pay for
- Let’s hear it, buddy! ETH Zurich research team simplifies two-factor authentication with sound recognition
- Situation critical – researchers find vulnerabilities in 87% of all Android devices
Read the english report. Read the german report.
SWITCH Security Report 2015-10
- XcodeGhost and Stagefright hit industry heavyweights Apple and Google and pose questions
- BÜPF, NDG and government Trojans – debate on sense, senselessness, costs and risks of state surveillance enters next round
- Privacy B2B – growing number of attacks on SMEs and critical infrastructure
- Fingerprints of at least 5.6 million US federal employees stolen – who cares?
- DIY 007 – Deep Sweep project spies on satellite communications
Read the english report. Read the german report.
SWITCH Security Report 2015-09
- Ferengi in Redmond? Microsoft enters new dimension of data acquisition with Windows 10
- Digital revolution hacks its makers – ICANN hit by third attack, ISP 1blu hacked and blackmailed
- Car hacks, autonomous vehicles and telematics-based insurance premiums – threats to safety and privacy
- Home, smart home – betrayed by your fridge, exposed by your mobile
Read the english report. Read the german report.
SWITCH Security Report 2015-08
- What a hack – government Trojan Galileo, costing almost half a million francs, rendered useless after attack on Hacking Team
- Data stacked up sky-high – unprecedented dimensions of cyberattack on US Office of Personnel Management
- Forget about doping tests – Team Sky data theft brings Tour de France into digital age
- IMSI catchers – don’t let them catch you...if you can!
- Do androids dream of electric horses? New variant of mTan Trojan ZeuS targets Android users
- VPNs – how IPv6, DNS and co. can still turn virtual private networks into very problematic nuisances
Read the english report. Read the german report.
SWITCH Security Report 2015-07
- Taking cybercrime to the next level – Duqu 2.0 attack on Kaspersky has implications for Switzerland
- Taking friendship to the next level – scope of NSA spying on German and French governments continues to widen
- A whole lot of problems – cyberattack grounds Polish airline LOT’s aircraft
- Detoxing – the last resort when Darknet dealings come to light?
- Pass the password – attacks on LastPass and Apple Keychain
Read the english report. Read the german report.
SWITCH Security Report 2015-06
- What do tax authorities and contact sites have in common?Neither can protect customer data
- Good friends listen, and so does the BND – the scandal continues
- A new kind of government Trojan – cyberattack on German parliament’s secure network
- Reset, then reload – Android smartphones keep data even after factory reset
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2015-05
- «Massive snooping attack» or successfully treading the fine line between security and freedom? On the reform of Switzerland’s intelligence services legislation
- Barbie turns Bond girl – toy manufacturers spying on children’s bedrooms
- Only those who get involved get hurt – latest e-banking Trojans harness social engineering
- E-health made in Switzerland – electronic patient records
- Fear of flying 2.0 – US authorities warn of in-flight hacking
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2015-04
- Shades of grey, made in Germany – SAP and the NSA
- David, Goliath and the search for a truly safe haven
- Apple with its head in the sand? Entire anti-virus and anti-malware category of apps removed from iOS App Store
- Bankrupts have no respect for privacy – RadioShack to auction customer data
- Look before you leap – hackers fake profiles on dating app
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2015-03
- Fish bites angler – Lenovo, Komodia and Superfish
- Gemalto-gate – secret service hack goes right to the roots of mobile security
- Carbanak – digital bank robbery on a grand scale
- It’s not all bad news – Europol takes down Ramnit botnet
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2015-02
- Attacks in the wake of the attack – privacy after the horror of Paris
- A brave new world of e-banking
- Gone in less than 60 seconds – from car theft to automotive data hacking
- Microsoft versus Google and vice versa – biblical short-sightedness?
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2015-01
- iBeacons: the next big thing for 2015?
- «Locate. Track. Manipulate.»: a new level of mobile snooping
- How to steal fingerprints with a 200-mm zoom lens
- Drones – buzzing business, more stringent rules and fewer benefits than expected
- The Golden Globes in the wake of the Sony hack
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2014-12
- No «Land of the Free» in sight: NSA allowed to continue gathering data, BND puts forward EUR 300 million wish list
- Censorship culture in the UK
- The new PR: how parties, companies and organisations manipulate web chat to propagate opinions
- Regin and the Detekt-ives: new software finds known government Trojans – Symantec discovers a new one
- Generali cheaper: lower premiums in exchange for personal information
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2014-11
- The «long tail» effect of Shellshock, Heartbleed & co.
- Malvertising: hackers learning from advertising professionals
- Legitimate defence of the right to protection versus opening Pandora’s box
- Taxing the Net: a Hungarian posse gets serious
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.
SWITCH Security Report 2014-10
- Same again? Fingerprint sensor on new iPhone 6 hacked using same method as for previous model
- Up in the air: drones, balloons and unresolved security issues
- Google’s Transparency Report shows Swiss authorities becoming more data-hungry
- Hacked through your fridge: how secure is the Internet of Things?
- The Clipboard: Interesting presentations, articles and videos
Read the english report. Read the german report.
SWITCH Security Report 2014-09
- Hacked, tweeted and exposed: Inside information on government Trojans used internationally published on Twitter
- Page not found: Network blocking in Switzerland and neighbouring countries
- Breaking bad – malvertising ransomware: ZeroLocker / CryptoLocker / CryptoWall / SynoLocker
- Canvas or cookies – choosing between Scylla and Charybdis
- The Clipboard: Interesting Presentations, Articles and Videos
Read the english report. Read the german report.