--- title: "Cyber Security News Update, Week 49 of 2020 | DuoCircle" description: "Phishing emails are all over the place, and the pandemic only made things worse." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/" --- Quick Answer Week 49 of 2020 covered seven items. Researchers at RedHunt found roughly 400,000 misconfigured CNAME records pointing at decommissioned cloud services, exposing the tied domains to subdomain takeover. Microsoft patched a flaw in Xbox Live that allowed enumeration of email addresses tied to Gamertags. CISA warned consumers about the surge in holiday-season phishing, fake retailer sites, and gift card scams. TikTok's bug bounty program awarded a 20-year-old researcher for an account-takeover chain. Joe Biden's presidential transition site was targeted with brute-force and credential-stuffing attempts that the team said failed to compromise donor data. Multiple celebrities reported being targeted in sextortion campaigns demanding cryptocurrency payments. Federal contractor Jacobs Engineering announced its acquisition of cyber-defense firm The Buffalo Group LLC to expand its national-security services. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2049%20of%202020&url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F&title=Cyber%20Security%20News%20Update%2C%20Week%2049%20of%202020 "Share on Reddit") [ ](mailto:?subject=Cyber%20Security%20News%20Update%2C%20Week%2049%20of%202020&body=Check out this article: undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F "Share via Email") ![DuoCircle blog post image](https://media.mailhop.org/duocircle/images/2020/12/dmarc-check-7474.jpg) _Phishing emails are all over the place, and the pandemic only made things worse_. If you have been deferring that subscription to [email security services](/), now is the time to get one! The adversaries are out there launching newer and more sophisticated cyberattacks, and your system might be the next one. The following news headlines shall help convince an unsuspecting _user to start investing in cybersecurity tools_ ## RedHunt Discovers 400,000 Misconfigured CNAME Records _Indian security firm RedHunt has recently discovered over 400,000 subdomains with misconfigured CNAME records_. Despite deleting cloud-hosted web pages, attackers can re-register the host and serve whatever they wish on the website. And once they have access, it’s obvious that the adversaries aren’t stopping at just posting malicious content on the compromised web pages, they can intercept internal emails and even launch mount [clickjacking](https://en.wikipedia.org/wiki/Clickjacking#:~:text=Clickjacking%20%28classified%20as%20a%20User,control%20of%20their%20computer%20while) or [broken-link hijacking](https://web.archive.org/web/20240717203629/https://ghostlulz.com/broken-link-hijacking/) attacks. But this isn’t all that [RedHunt researchers](https://portswigger.net/daily-swig/rampant-cname-misconfiguration-leaves-thousands-of-organizations-open-to-subdomain-takeover-attacks-nbsp-research?&web%5Fview=true) discovered! They found that _e-commerce operators are the most vulnerable to subdomain takeovers_, with **63% of vulnerable** DNS records hinting towards Shopify, followed by Unbounce (14%). Their research also revealed that ‘www,’ ‘store,’ ‘blog,’ and ‘shop’ are among the most vulnerable subdomains. The RedHunt study indicates that many large enterprises struggle to track their infrastructure, even after adopting [email protection](/) or **ransomware protection** measures. Google Chrome’s updates since Chrome 69 add to users’ woes by making it harder for them to identify attacker-controlled webpages. [![email protection](https://media.mailhop.org/duocircle/images/2020/12/dmarc-record-7475.jpg)](https://media.mailhop.org/duocircle/images/2020/12/dmarc-record-7475.jpg) ## Xbox Live Vulnerability Exposes Email Addresses Two anonymous hackers have recently informed about a _zero-day vulnerability in the Xbox Live enforcement portal_, which lets hackers trace the email address associated with any Xbox Gamertag. Although Microsoft was [reluctant to consider](https://www.vice.com/en/article/m7ag44/bug-allowed-hackers-to-get-anyones-email-address-on-xbox-live?&web%5Fview=true) this a significant bug, _it patched the vulnerability anyhow_. They believe that an email address isn’t as harmful a piece of sensitive information to lose, and as such, they aren’t tracking the issue. But to **ensure email protection**, Microsoft customers are required to update to the latest version. ## Beware Of Holiday Season Frauds: Warns CISA The holiday season is all about shopping, traveling, and merry-making but what people often overlook is that _this is also the most vulnerable period of the year in terms of cybersecurity_. The Cybersecurity and Infrastructure Security Agency (CISA) acknowledges this [rise in cyber incidents](https://www.darkreading.com/threat-intelligence/cisa-warns-of-holiday-online-shopping-scams/d/d-id/1339534?&web%5Fview=true) and has warned people against fake websites, **phishing emails**, and financial frauds. _The CISA has posted an advisory guiding people on the do’s and don’ts of online shopping in the holiday season_ and has emphasized the use of cybersecurity tools. Anyone suspecting a cyberattack must report the same to the local police and file an online report at the FTC’s fraud report page. ## TikTok’s Bug Bounty Program Awards 20-Year-Old Researcher Although the United States perceives TikTok as a national security threat, the latter is adamant about _strengthening its security by fixing all vulnerabilities_. The app’s bug bounty program has made it possible to identify and **patch 85 vulnerabilities** to date, for which _the app has paid over $85000_. The recent security flaw would have let the adversaries change passwords of TikTok accounts created through [third-party apps](https://www.securityweek.com/tiktok-awards-nearly-4000-account-takeover-vulnerabilities?&web%5Fview=true). _The security flaw was discovered by a 20-year-old German researcher Muhammed Taskiran_ in August. Taskiran rightly pointed out that by merely _making a targeted user click on a malicious link_, a hacker could exploit the XSS and CSRF vulnerabilities and quickly change account passwords. The vulnerability was found to be “high severity,” and this TikTok awarded the researcher with $3,860 for helping them to ensure **protection against cyberattacks** such as phishing. ## Hackers Target Joe Biden’s Presidential Campaign \`Vote Joe’ Website _Imagining the US elections without a few cyberattacks is impossible these days_. The latest [hack of Joe Biden’s](https://securereading.com/joe-bidens-vote-joe-website-defaced-by-hackers/?web%5Fview=true) Presidential campaign \`Vote Joe’ website is just another security incident added to the list! Turkish hacker group RootAyyildiz is responsible for the defacing attack, which lasted for more than a day. After the hack, the Vote Joe site displayed a message in Turkish which warned US political parties to stop manipulating politics in Turkey, and attached was a picture of Abdul Hamid, the 34th Sultan of the Ottoman Empire. It also mentioned the names of the hacker groups involved in the incident, **RootAyyildiz**, Turkish And Muslim Defacer, MarbeyliWerom, b4rbarøs as, and oneshot. It isn’t unusual to find that **ransomware protection** is overlooked in both Trump and Biden’s presidential apps. _The hackers are only exploiting the vulnerabilities which the websites left room for!_ [![ransomware protection](https://media.mailhop.org/duocircle/images/2020/12/what-is-dmarc-7476.jpg)](https://media.mailhop.org/duocircle/images/2020/12/what-is-dmarc-7476.jpg) ## Celebrities Become Victims of Sextortion Campaigns In a recent security breach, _the adversaries have stolen hundreds of private photos and videos from the phones of female sports stars and celebrities_. These nude photos and videos are [now leaked](https://securityaffairs.co/wordpress/111297/hacking/sports-stars-celebrities-naked-photos.html?web%5Fview=true), and the victims seem desperate to get the pictures off the internet. Four unnamed British athletes were victims of this attack, while one lost around 100 images to the attack, another had over 30 pictures and videos leaked! _One must always adopt advanced security measures to protect themselves from phishing_. The NCSC advises people to enable **multiple-factor authentication** for all online accounts that support it. Taking such sensitive content off the internet is an ordeal in itself because nothing goes off the internet! ## New Security Merger: Jacobs And The Buffalo Group LLC Amidst all the news of data breaches and cyberattacks, a new cybersecurity acquisition seems [promising](https://www.virginiabusiness.com/article/dallas-professional-services-company-acquires-reston-firm/?web%5Fview=true). _The professional services company Jacobs has recently purchased the cyber solutions company_ The Buffalo Group LLC. Although the deal’s financial terms haven’t been disclosed, the deal in itself heralds better defense to the growing complexities in the cyber realm. While the Buffalo Group is renowned for its incomparable intelligence and cyber capabilities, Jacobs provides exceptional technology solutions, and this merger shall only **enhance cybersecurity** at a national level. And that’s the week that was. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F) [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2049%20of%202020&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-49-of-2020%2F) Copy Related Articles - [ ![spam](https://media.mailhop.org/duocircle/images/2021/07/sender-policy-framework-7535.jpg) Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam News ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/) - [ ![Spam](https://media.mailhop.org/duocircle/images/2016/05/spf-permerror-3256.jpg) April Spam Filtering Uptime Report News ](/blog/announcements/april-spam-filtering-uptime-report/) - [ ![Spam Filtering](https://media.mailhop.org/duocircle/images/2023/02/spf-record-tester-7226.jpg) Changes to Spam Filtering Technology News ](/blog/announcements/changes-to-spam-filtering-technology/) - [ ![Cyber Security](https://media.mailhop.org/duocircle/images/2020/01/spf-permerror-7312.jpg) Cyber Security News Update, Week 1 of 2020 News ](/blog/announcements/cyber-security-news-update-week-1-of-2020/) ## Related Articles [ News 3m Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam Jul 20, 2021 ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)[ News 1m April Spam Filtering Uptime Report May 4, 2016 ](/blog/announcements/april-spam-filtering-uptime-report/)[ News 2m Changes to Spam Filtering Technology Feb 8, 2023 ](/blog/announcements/changes-to-spam-filtering-technology/)[ News 4m Cyber Security News Update, Week 1 of 2020 Jan 3, 2020 ](/blog/announcements/cyber-security-news-update-week-1-of-2020/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 49 of 2020","description":"Phishing emails are all over the place, and the pandemic only made things worse.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/","datePublished":"2020-12-03T20:00:06.000Z","dateModified":"2025-05-14T11:41:25.000Z","dateCreated":"2020-12-03T20:00:06.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/"},"articleSection":"announcements","keywords":"","wordCount":950,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/12/dmarc-check-7474.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Cyber Security News Update, Week 49 of 2020","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Cyber Security News Update, Week 49 of 2020","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 49 of 2020","description":"Phishing emails are all over the place, and the pandemic only made things worse.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/","datePublished":"2020-12-03T20:00:06.000Z","dateModified":"2025-05-14T11:41:25.000Z","dateCreated":"2020-12-03T20:00:06.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-49-of-2020/"},"articleSection":"announcements","keywords":"","wordCount":950,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/12/dmarc-check-7474.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```