Cyber Security News for 8May2020

May08
by Shahid Sharif on May 8, 2020 at 9:30 pm
Posted In: Compliance, cyber security, cybersecurity, Privacy, Risk Management, Security
  1. “Passwords are something you use almost every day, from accessing your email or banking online to purchasing goods or accessing your smartphone.  However, passwords are also one of your weakest points; if someone learns or guesses your password they can access your accounts as you, allowing them to transfer your money, read your emails, or steal your identity.” https://www.sans.org/security-awareness-training/ouch-newsletter/2017/passphrases
  2. “Yesterday Apple released iOS 13.5 beta 3 (seemingly renaming iOS 13.4.5 to 13.5 there), and that killed one of my bugs. It wasn’t just any bug though, it was the first 0day I had ever found. And it was probably also the best one. Not necessarily for how much it gives you, but certainly for how much I’ve used it for, and also for how ridiculously simple it is. So simple, in fact, that the PoC I tweeted out looks like an absolute joke. But it’s 100% real.” https://siguza.github.io/psychicpaper/
  3. “Talking to Naked Security, Denley explained that he finds new ones each day. He pointed us to this Pastebin entry showing the original 49 he reported in April, along with another 22. The new ones impersonated the Ledger, KeepKey, MetaMask, and Jaxx wallets. The IDs on the left are extension IDs, which show up at the end of an extension’s URL when viewed in the Chrome store.” https://nakedsecurity.sophos.com/2020/05/08/more-crypto-stealing-chrome-extensions-swatted-by-google/
  4. “Three more high-profile databases are being offered for sale by the same group claiming the Tokopedia and Unacademy breaches, and the more recently reported theft of Microsoft’s private GitHub repositories.  Going by the name Shiny Hunters, the group is now selling user records from meal kit delivery service HomeChef, from photo print service ChatBooks, and Chronicle.com, a news source for higher education.” https://www.bleepingcomputer.com/news/security/hackers-sell-stolen-user-data-from-homechef-chatbooks-and-chronicle/
  5. “When we talk about the second most popular Content Management System (CMS), then Joomla is there. It enables the user to do website publishing conveniently, and it is user-friendly. Although Joomla is one of the most used systems to build sites, there are still chances of a hack. If you are not keeping a check on updating its plugins, then soon you can face such a problem. Therefore you must learn several things related to fix Joomla hack.” https://hackercombat.com/learn-five-easy-steps-to-fix-joomla-hack/
  6. “Since the beginning of the calendar year, Palo Alto Networks has detected an uptick in Maze ransomware samples across multiple industries. As a result, we’ve created this general threat assessment post on the Maze ransomware activities and a full visualization of these techniques can be viewed in the Unit 42 Playbook Viewer.” https://unit42.paloaltonetworks.com/threat-brief-maze-ransomware-activities/
  7. “From strained, remote security teams to an increase in e-commerce shopping, there are more risks than ever to web applications. For instance, Klaviyo reported a 25% increase in online shopping in the New York area since March 6, 2020, and Forrester reported that web applications and software vulnerabilities are the top two ways external attacks are carried out.” https://blog.rapid7.com/2020/05/08/best-practices-for-securing-e-commerce-applications/
  8. “The Sodinokibi ransomware group threatens to release hundreds of gigabytes of legal documents from a prominent entertainment and law firm that counts dozens of international stars as their clients. Grubman Shire Meiselas & Sacks (GSMLaw) is based in New York and represents dozens of heavyweight artists. Looking at its list of clients, you can spot names that are known all over the world: Madonna, Lady Gaga, Elton John, Robert de Niro, Nicki Minaj, Chris Brown, Usher, U2, Timbaland, Rick Ross, and many others.” https://www.bleepingcomputer.com/news/security/revil-ransomware-threatens-to-leak-a-list-celebrities-legal-docs/
  9. “The credentials of 3.5 million users of MobiFriends, a popular dating app, have surfaced on a prominent deep web hacking forum, according to researchers.” https://threatpost.com/hackers-breach-3-5-million-mobifriends-dating-app-credentials/155590/
  10. “Google has released the first update for Google Authenticator in years and it comes with the long-awaited feature of being able to move 2FA accounts between devices.  When securing online accounts, many sites offer a feature called 2-factor authentication (2FA), or as 2-step verification (2SV), which requires a user to scan a unique QR code on an authentication app.” https://www.bleepingcomputer.com/news/security/new-google-authenticator-update-makes-it-worth-using-again/
  11. “When hackers lock the computer systems of a big company with ransomware, the gears of corporate damage control kick into action. Lawyers are mobilized, spokespeople are tight-lipped, and negotiation experts are sometimes brought in to talk to the hackers. Those triage teams strictly limit the information on the incident available to the public.” https://www.cyberscoop.com/maze-ransomware-mandiant-lessons-learned/
  12. “Microsoft is rolling out protection against Office 365 Reply-All email storms, an issue impacting Exchange Online users who are members of large and improperly locked down mail distribution lists. Reply-All storms (also known as reply-allpocalypses) are huge chain reaction sequences of emails that start when a member of a large organization’s email distribution list send a reply to all its members using the “Reply All” feature, in some cases effectively pinging the inboxes of thousands of people with a single mouse click.” https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-protection-against-office-365-email-storms/
  13. “In the May 6 webinar, “Positioning for What’s Beyond the Horizon: What Digital Transformation and the Data Economy Mean for You,” the panelists provided insight into how companies and individuals are reacting to COVID-19. They discussed how hiring trends indicate the larger role digital transformation and the data economy will have, both now and in a post-COVID-19 world.” https://www.dataprivacymonitor.com/digital-transformation/positioning-for-whats-beyond-the-horizon-what-digital-transformation-and-the-data-economy-mean-for-you/
  14. “According to the breach notification email that affected customers [1, 2] received, the data leak happened due to negligence where DigitalOcean ‘unintentionally’ left an internal document accessible to the Internet without requiring any password.” https://thehackernews.com/2020/05/digitalocean-data-breach.html

#security #cybersecurity #itsecurity #privacy #risk #compliance #shinyhunters #chrome #extensions #tokopedia #unacademy #revil #sodinokibi #digitalocean #2fa

└ Tags: , , , , , , , , , , , , , ,
Comments Off on Cyber Security News for 8May2020

Cyber Security News for 7May2020

May07
by Shahid Sharif on May 7, 2020 at 8:37 pm
Posted In: Compliance, cyber security, cybersecurity, Privacy, Risk Management, Security
China hacked state security. Cyberattack on the financial and banking structure. Theft of secret information. On a background of a flag the binary code.
  1. “Samsung released this week a security patch that addresses a critical vulnerability, tracked as CVE-2020-8899, impacting all smartphones sold since 2014. The flaw is tracked as SVE-2020-16747 in the Samsung security bulletin.” https://securityaffairs.co/wordpress/102841/hacking/samsung-fixes-a-zero-click.html
  2. “On Tuesday, when Facebook released its third Coordinated Inauthentic Behavior (CIB) report, it said that every one of the eight networks it took down in April were created before the COVID-19 pandemic began. Before the gravity of the pandemic was understood worldwide, the threat actors were already doing their policy-violating work of ripping people off, spreading conspiracy theories or trying to influence political discourse. But once the disease settled into its place as the world’s foremost worry, the people behind the campaigns all pivoted to jump on the coronavirus bandwagon” https://nakedsecurity.sophos.com/2020/05/07/fake-news-facebook-accounts-used-coronavirus-to-attract-followers/
  3. “Up first on the patch priority list this month is a patch for VMware vCenter Server. This patch resolves an information disclosure vulnerability. This patch has highest priority as proof-of-concept code to exploit the vulnerability exists on the Web as well as in Metasploit.” https://www.tripwire.com/state-of-security/vert/tripwire-patch-priority-index-april-2020/
  4. “The Chinese APT group was first uncovered by Kaspersky researchers in 2015, in attacks against top-level government agencies around the South China Sea. After 2015, Naikon seemingly went silent. However, a recently discovered, widespread campaign reveals the group has actually spent the past five years quietly developing their skills and introducing the “Aria-body” backdoor into their arsenal of weapons.” https://threatpost.com/naikon-apt-five-year-espionage-attack/155492/
  5. “Focusing on one of the most active subsets of the global threat landscape, Palo Alto Networks Unit 42 tracks Nigerian cyber criminals involved in Business Email Compromise (BEC) activities under the name SilverTerrier. Over the past 90 days (Jan. 30 – Apr. 30), we have observed three SilverTerrier actors/groups launch a series of 10 COVID-19 themed malware campaigns. These campaigns have produced over 170 phishing emails seen across our customer base. While broad in their targeting, these actors have exercised minimal restraint in terms of targeting organizations that are critical to COVID-19 response efforts. Specifically, we find it alarming that several of these campaigns recklessly included targets at government healthcare agencies, local and regional governments, large universities with medical programs/centers, regional utilities, medical publishing firms, and insurance companies across the United States, Australia, Canada, Italy, and the United Kingdom.” https://unit42.paloaltonetworks.com/silverterrier-covid-19-themed-business-email-compromise/
  6. “The modus operandi of this piece of malware is not new in Portugal. At least since the year of 2014 that new variants have been observed, with minor changes, and with the objective of collecting bank details of the victims.One of the last occurrences was last December 2019, where the Lampion trojan operated in a very similar way, changing only the way the malware was distributed (via AWS S3 buckets and with the first stage encoded in a highly obfuscated VBS file).” https://securityaffairs.co/wordpress/102858/cyber-crime/brazilian-trojan-banker-targets-portugal.html
  7. “Snake ransomware first attracted the attention of malware analysts in January 2020 when they observed the crypto-malware family targeting entire corporate networks. Shortly after this discovery, the threat quieted down. It produced few new detected infections in the wild for the next few months. That was until May 4, when ID Ransomware registered a sudden spike in submissions for the ransomware.” https://www.tripwire.com/state-of-security/security-data-protection/massive-spike-in-snake-ransomware-activity-attributed-to-new-campaign/
  8. “Researchers from Secureworks Counter Threat Unit (CTU) have observed an increase in various threat activity against taxpayers as well as on underground hacker forums aimed at fraudulently obtaining these various government payouts, they said in a report. Some of these efforts trace back to tax preparation services that dispose of customer hard copy paperwork insecurely via the trash. Customer data culled from that paperwork then ends up on illicit online markets where it is bought and resold.” https://threatpost.com/hackers-dumpster-dive-covid-19-relief-scams/155537/
  9. “The sLoad malware was discovered for the first time in 2018. It delivers various Trojans to the infected computers, including but not limited to the banking Trojans Ramnit, Gootkit and Ursnif.” https://resources.infosecinstitute.com/starslord-2-0-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
  10. ” IT teams vs. security teams Building a strong security team should be a priority for all organizations today. This includes companies that already have a good IT team on board made of experienced systems managers and information systems engineers.  Although the two teams are often intertwined, the scope of work is different.” https://resources.infosecinstitute.com/how-to-turn-your-it-team-into-a-security-team/
  11. “Security is a multi-faceted responsibility. First, you need visibility into vulnerabilities across your organization. Then, you need to ensure that various stakeholders in the organization have visibility into the goals, objectives, and impact of security initiatives.”  https://blog.rapid7.com/2020/05/07/how-to-increase-your-security-teams-visibility-within-your-organization-and-what-happens-when-you-do/
  12. “The bad news is that whoever wrote this malware decided to be doubly destructive: it scrambles the files on your C: drive using a secret decryption key, but it wipes out the files on all your other drives, looping through all the letters A: to Z: except C:, issuing commands to delete all the files and directories it can find.” https://nakedsecurity.sophos.com/2020/05/07/vcrypt-ransomware-holds-your-files-hostage-without-encrypting-them/
  13. “Red Canary Intel is monitoring a potentially novel threat that is deploying Monero cryptocurrency-mining payloads on Windows machines at multiple organizations.” https://redcanary.com/blog/blue-mockingbird-cryptominer/
  14. “Hackers are actively exploiting two security vulnerabilities in the Elementor Pro and Ultimate Addons for Elementor WordPress plugins with the end goal of remotely executing arbitrary code and fully compromising unpatched targets. Reports of threat actors attempting to abuse the two bugs in ongoing attacks have surfaced on May 6th as reported by Wordfence’s Threat Intelligence team today.” https://www.bleepingcomputer.com/news/security/critical-wordpress-plugin-bug-lets-hackers-take-over-1m-sites/
  15. “Nowadays, info-stealer is one of the most common threats. This category of malware includes famous malware like Azorult, Agent Tesla, and Hawkeye. Infostealer market is one of the most remunerative for cyber criminals, information gathered from infected systems could be resold in the cybercrime underground or used for credential stuffing attacks.” https://securityaffairs.co/wordpress/102894/malware/poulight-info-stealer.html
  16. “Microsoft urges users not to update their Microsoft Teams iOS client to the latest version as it comes with a bug that causes intermittent call drops on the desktop client after answering if logged in with the same account.  Users who haven’t updated their Teams iOS app to the 2.0.9 build will not experience any issues as this is the only version containing the bug.” https://www.bleepingcomputer.com/news/security/microsoft-teams-call-drops-on-desktop-caused-by-ios-bug/
  17. “Cisco has stomped out 12 high-severity vulnerabilities across several network security products. The flaws can be exploited by unauthenticated remote attackers to launch an array of attacks – from denial of service (DoS) to sniffing out sensitive data.” https://threatpost.com/cisco-fixes-high-severity-flaws-in-firepower-security-software-asa/155568/
  18. “NIST has many helpful resources for small businesses like the popular NIST Cybersecurity Framework, our relaunched website, the Small Business Cybersecurity Corner, just for the small business community. The site features a range of NIST products to address small business cybersecurity concerns and links to curated materials from other federal agencies.” https://www.nist.gov/blogs/cybersecurity-insights/small-businesses-are-big-priority-nist
  19. “Cybercriminals are exploiting the increasing number of layoffs during the current pandemic to recruit new money mules which can later be used to help them launder money gained from illicit activities. Some phishing messages discovered by PhishLabs researchers are trying to convince targets from Canada and the United States who might have lost their jobs due to the COVID-19 outbreak to start working from home, promising them $5,000 per month” https://www.bleepingcomputer.com/news/security/unemployed-americans-offered-remote-jobs-as-money-mules/
  20. “The Ruhr University Bochum (RUB), Ruhr-Universität Bochum in German, announced today that it was forced to shut down large parts of its central IT infrastructure, also including the backup systems, due to a cyberattack that took place overnight, between May 6 and May 7.” https://www.bleepingcomputer.com/news/security/ruhr-university-bochum-shuts-down-main-servers-after-cyberattack/

#security #cybersecurity #itsecurity #privacy #risk #compliance #samsung #naikon #apt #china #aria-body #bec #silverterrier #lampion #trojan #snake #ransomware #Ramnit #Gootkit #Ursnif #sLoad #vcrypt #wordpress #poulight #azorult #agenttesla #hawkeye

└ Tags: , , , , , , , , , , , , , , , , , , , , , , , , , ,
Comments Off on Cyber Security News for 7May2020

Cyber Security News for 6May2020

May06
by Shahid Sharif on May 6, 2020 at 8:43 pm
Posted In: Compliance, cyber security, cybersecurity, Privacy, Risk Management, Security
  1. “A hacker claims to have stolen over 500GB of data from Microsoft’s private GitHub repositories, BleepingComputer has learned.  This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant’s ‘Private’ repositories.” https://www.bleepingcomputer.com/news/security/hacker-claims-to-have-breached-microsofts-github-private-repos/
  2. “Maze has been the ransomware of choice during the current proliferation of attacks and, as might be expected, it comes with a clever (some might say evil) twist. In addition to the typical Bitcoin payment, Maze, which was discovered in May 2019, also threatens to post patient records online.” https://www.tripwire.com/state-of-security/healthcare/maze-ransomware-targets-hospitals-labs-fighting-coronavirus/
  3. “Zoom has exploded in the last couple months, going from 10 million meeting participants as of December to over 200 million as of today.  With this increase in usage, Zoom’s security has been drawn into the light. Several friends and family have asked me if using Zoom was safe to use and the answer is that it depends on several things, but using a few security tips, they can keep their online conferences safe and protected.” https://www.tripwire.com/state-of-security/security-data-protection/getting-zoom-security-right-8-tips-family-friends/
  4. “The database contains personally-identifiable and subscription information for 44,000,000 Pakistanis, including customer full names, home addresses (city, region, street name), National identification (CNIC) numbers, mobile phone numbers, landline numbers, and dates of subscription.” https://securityaffairs.co/wordpress/102795/data-breach/pakistani-mobile-users-leak.html
  5. “SAP continuously reviews and optimizes its cybersecurity infrastructure. The company has identified that some of its cloud products do not meet one or several contractually agreed or statutory IT security standards at present. Specifically, the affected products are limited to the acquired entity products SAP Success Factors, SAP Concur, SAP/CallidusCloud Commissions, SAP/Callidus Cloud CPQ; as well as C4C/Sales Cloud, Cloud Platform and Analytics Cloud.” https://securityaffairs.co/wordpress/102819/security/sap-cloud-products-flaws.html
  6. “National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) introduced a project to help organizations to detect and respond effectively to data integrity attacks across multiple industries. This project includes a wide range of design rules and technologies to develop a best fit solution that can help the market fight this emergent threat.” https://resources.infosecinstitute.com/nist-ransomware-recovery-guide-what-you-need-to-know/
  7. “More than six years after Facebook launched its ambitious Free Basics program to bring the Internet to the masses, the social network is back at it again with a new zero-rating initiative called Discover.” https://thehackernews.com/2020/05/facebook-discover-free-internet.html
  8. “Even a single liability can cause colossal damage.  Therefore one must learn about WordPress security issues to avoid any such problem. The goal of the hackers is visible, which is using the site maliciously. Hence, you must gather the ways to keep your website away from their sight.” https://hackercombat.com/keep-your-data-safe-get-a-glimpse-of-basic-wordpress-security-issues/
  9. “Since at least February 2019, the hackers, who have begun impersonating CEOs and banks in their lure documents, have introduced at least seven updates to the malicious software known as EVILNUM, which enables attackers to upload and download files, harvest tracking cookies, and run arbitrary commands.” https://www.cyberscoop.com/evilnum-financial-malware-prevailion/
  10. “Automation is a powerful asset to any company — unfortunately, automation is also a powerful tool that cybercriminals leverage to attack their targets. Threat actors can use it to control the distribution and communication of malware, provide commands, and initiate future phases of an attack — such as deploying additional malware.”  https://www.recordedfuture.com/automated-cyber-threats/
  11. “Microsoft has launched a bug-bounty program for its Azure Sphere offering, which is a security suite for the internet of things (IoT) that encompasses hardware, OS and cloud elements. The top reward will come in at $100,000.” https://threatpost.com/microsoft-100k-iot-security-azure-sphere/155517/
  12. “Fresenius Group, a big European health care conglomerate, said Wednesday that a computer virus had infected at least one of its businesses’ IT systems. It’s another sign that malicious hackers see medical organizations as fair game despite a global health crisis.” https://www.cyberscoop.com/fresenius-health-care-cyberattack-coronavirus/
  13. “Online learning platform Unacademy has suffered a data breach after a hacker gained access to their database and started selling the account information for close to 22 million users.” https://www.bleepingcomputer.com/news/security/hacker-sells-22-million-unacademy-user-records-after-data-breach/
  14. “Hackers have created and used a fake icon portal to host and load a JavaScript web skimmer camouflaged as a favicon onto compromised e-commerce portals to steal their customers’ credit card and personal information.” https://www.bleepingcomputer.com/news/security/hackers-use-website-favicon-to-camouflage-credit-card-skimmer/
  15. “Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.” https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2020-060/
  16. “Chinese hackers have long been known to collect information on government contracting work in the U.S. But the group singled out in this alert, known as Electric Panda, is not as well-known in the cybersecurity community as its peers. Prior to the DCSA alert, the only reference to this group is from a 2013 presentation from CrowdStrike. The security company declined to comment on the bulletin.” https://www.cyberscoop.com/dcsa-cybersecurity-bulletin-leaking-sinkhole-electic-panda-anubis/
  17. “The Windows 10 Insider Preview Build 19624 fixes “an issue resulting in Windows Update failing with error code 0x800700b7,” Windows Insider Program senior program manager Brandon LeBlanc explained.” https://www.bleepingcomputer.com/news/microsoft/windows-10-build-19624-released-with-windows-update-fixes/
  18. “The operators of the Snake Ransomware have launched a worldwide campaign of cyberattacks that have infected numerous businesses and at least one health care organization over the last few days. This past January, BleepingComputer reported on the new Snake ransomware that was targeting enterprise networks.” https://www.bleepingcomputer.com/news/security/large-scale-snake-ransomware-campaign-targets-healthcare-more/
  19. “The North Korea-linked cyberthreat group known as Lazarus Group has added a new variant of the Dacls remote-access trojan (RAT) to its arsenal of spy gear, designed specifically for the Mac operating system. Dacls was first discovered last December targeting Windows and Linux platforms. The new version for Mac is now spreading via a trojanized two-factor authentication (2FA) application for macOS called MinaOTP, mostly used by Chinese speakers, according to a Malwarebytes analysis.” https://threatpost.com/lazarus-macos-spyware-2fa-application/155532/
  20. “A highly convincing series of phishing attacks are using fake certificate error warnings with graphics and formatting lifted from Cisco Webex emails to steal users’ account credentials.” https://www.bleepingcomputer.com/news/security/cisco-webex-phishing-uses-fake-cert-errors-to-steal-credentials/

#security #cybersecurity #itsecurity #privacy #risk #compliance #maze #ransomware #pakistan #evilnum #malware #emotet #Fresenius #lazarusgroup #dacls #rat #minaotp

└ Tags: , , , , , , , , , , , , , , , ,
Comments Off on Cyber Security News for 6May2020

Cyber Security News for 5May2020

May05
by Shahid Sharif on May 5, 2020 at 6:26 pm
Posted In: Compliance, cyber security, cybersecurity, Privacy, Risk Management, Security
  1. “Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution within the context of a privileged process. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.” https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-arbitrary-code-execution_2020-059/
  2. “If you’ve been ignoring their copyright infringement notices, the record companies may soon be calling. Last week, a court-appointed arbiter ordered the internet provider to give a group of major record labels the personal details of alleged pirates. Charter Communications, an ISP in the US, has been ordered to hand over personally identifying information (PII) for over 11,000 alleged pirates.” https://nakedsecurity.sophos.com/2020/05/05/reveal-the-identities-of-alleged-pirates-court-tells-isp/
  3. “At the weekend Mozilla announced that it is testing an experimental service called Firefox Private Relay that it thinks will offer an appealing solution to this issue.  Installing as an extension, Private Relay will let users generate a random, temporary email addresses at the click of a button, explains Mozilla” https://nakedsecurity.sophos.com/2020/05/05/firefoxs-private-relay-service-tests-anonymous-email-alias-feature/
  4. “In a regulatory notice published on its website, FINRA revealed that malicious actors had sent out fraudulent emails in which they had impersonated officers at the regulatory authority including Bill Wollman and Josh Drobnyk. All of those fraudulent messages originated from the domain “broker-finra[.]org,” and they demanded that the recipient dedicate their “immediate attention” to sending back sensitive firm data.” https://www.tripwire.com/state-of-security/security-data-protection/digital-fraudsters-masquerading-as-finra-in-phishing-emails/
  5. “The smartphone maker has begun rolling out an update to its Mi Browser/Mi Browser Pro (v12.1.4) and Mint Browser (v3.4.3) after concerns were raised over its practice of transmitting web browsing histories and device metadata to the company servers.  The new privacy setting now allows Mi Browser users to disable aggregated data collection feature while in Incognito Mode, but it bears noting that it’s not enabled by default.”  https://thehackernews.com/2020/05/xiaomi-browser-history.html
  6. “Recently, the OpenSSL Project released a security update for OpenSSL that patches a high-severity vulnerability, tracked as CVE-2020-1967, that can be exploited by attackers to launch denial-of-service (DoS) attacks. The CVE-2020-1967 vulnerability has been described as a “segmentation fault” in the SSL_check_chain function, it is the first issue addressed in OpenSSL in 2020.” https://securityaffairs.co/wordpress/102763/hacking/cve-2020-1967-dos-openssl-exploit.html
  7. “When I first joined Shopify, we were challenged to scale our team alongside our relatively new bug bounty program. I was excited to bring my insights and improve upon a program that hackers would engage with. Our goal has always been to build upon the success of our hacker-powered security programs with a concerted effort to promote transparency and attract talent. With the extra sets of eyes, we are able to implement more checks and balances to harden our attack surfaces.” https://www.cyberscoop.com/shopify-bug-bounty-five-years/
  8. “With many organizations in search of qualified security managers, it’s a great time for professionals to prepare for a cybersecurity manager or information security manager career with great opportunities and salary projections. In addition to a college degree in computer science, cybersecurity or a related technical field, candidates need years of experience managing security operations and teams and, above all, the ability to prove continued training and solid security and management certifications.” https://resources.infosecinstitute.com/cybersecurity-manager-certifications-compared-cipm-vs-cism-vs-gslc-vs-cissp/
  9. “This past Tuesday (April 28, 2020), Adobe released several out-of-band security patches that fixed these issues. These vulnerabilities are identified as CVE-2020-9570, CVE-2020-9571, CVE-2020-9572, CVE-2020-9573 and CVE-2020-9574. All these vulnerabilities have different root causes related to a multitude of Illustrator Plugins. Due to the critical rating of these vulnerabilities, we suggest users apply these Adobe patches as soon as possible.”  https://www.fortinet.com/blog/threat-research/fortiguard-lab-researcher-discovers-multiple-critical-vulnerabilities-in-adob-illustrator-cc-2020.html
  10. “We don’t just believe security intelligence is for everyone — we’re also making it happen. Today, we’re thrilled to introduce Recorded Future Express — our new browser extension that delivers elite security intelligence at zero cost.” https://www.recordedfuture.com/free-security-intelligence/
  11. “The U.S. Department of Homeland Security’s cybersecurity division and the U.K.’s National Cyber Security Centre (NCSC) “are currently investigating a number of incidents in which threat actors are targeting pharmaceutical companies, medical research organizations, and universities,” the agencies said in a joint advisory. They did not point the finger at particular governments.” https://www.cyberscoop.com/coronavirus-research-hacking-warning/
  12. “Recently, security researcher Juan Andres Guerrero-Saade revealed a previously misidentified and unknown threat group, called Nazar, which was part of the last leak by the Shadow Brokers. In this research, we will expand upon the analysis done by Juan and another which was written by Maciej Kotowicz, and will provide an in-depth analysis of each of the Nazar components. But the real question is, do those new revelations add a missing piece to the puzzle, or do they show us how much of the puzzle we are missing?” https://research.checkpoint.com/2020/nazar-spirits-of-the-past/
  13. “Kaiji, which was discovered in late April by security researcher “MalwareMustDie” and researchers with Intezer, is unique in its custom tooling, created in the Golang programming language. Previous types of IoT malware have mainly derived their tooling from previous botnets (including multiple botnets that are variants of Mirai), which are typically written in the C or C+ programming language.” https://threatpost.com/kaiji-botnet-iot-linux-devices/155463/
  14. “Since the past few weeks, software giant Citrix has privately been rolling out a critical software update to its enterprise customers that patches multiple security vulnerabilities affecting Citrix ShareFile content collaboration platform.” https://thehackernews.com/2020/05/citrix-sharefile-vulnerability.html
  15. “A security flaw in patches from game developer Naughty Dog gave hackers access to unreleased content from the upcoming The Last of Us Part II that was stored in an Amazon S3 bucket.” https://www.bleepingcomputer.com/news/security/game-patch-gives-hackers-access-to-development-content-on-amazon-s3/
  16. “Europol announced today that Polish and Swiss law enforcement authorities dismantled the ‘InfinityBlack’ hacker group after arresting five of its members in Poland last week.  This cybercrime gang was involved in distributing hundreds of millions of stolen user credentials in the form of collections of hundreds of millions of credentials (1, 2, 3) via the Infinity Black marketplace, in creating and distributing malware and hacking tools, as well as fraud.” https://www.bleepingcomputer.com/news/security/infinityblack-hacker-group-dismantled-by-european-authorities/
  17. “The Toll Group has suffered its second ransomware cyberattack in three months, with the latest one conducted by the operators of the Nefilim Ransomware. Toll Group is Asia Pacific’s leading provider of trans portion and logistics services, employing roughly 44,000 people at 1,200 locations in more than 50 countries.” https://www.bleepingcomputer.com/news/security/toll-group-hit-by-ransomware-a-second-time-deliveries-affected/
  18. “In the company’s first action against the QAnon group, Facebook says it removed 20 accounts, six groups and five pages caught fabricating personas to like and comment on their own posts to build engagement. Some 133,000 accounts followed one or more of the pages, while 30,000 accounts were involved in at least one of the groups, according to Facebook. That large influence network came without the individuals behind the effort spending more than $1 on Facebook ads.” https://www.cyberscoop.com/qanon-facebook-removal-vdare/
  19. “CPC Corp., an important national asset responsible for importing liquefied natural gas (LNG), said Tuesday that, after hackers attacked its IT network, the company had restored some of it computers and servers. Although the attack didn’t affect the company’s energy production, it did disrupt some customers’ efforts to use CPC Corp.’s payment cards to purchase gas.” https://www.cyberscoop.com/cpc-corp-ransomware-attack-taiwan-trend-micro/
  20. “Highly targeted emails have been sent to a few executives – including one at a leading financial firm – purporting to be from British internet service provider EE, which as of 2019 is one the largest mobile network operators in the UK, with around 32 million customers. The phishing campaign comes with a few sloppy red flags that eagle-eyed recipients might pick up on – but researchers say its use of HTTPS and SSL certificates for its landing page help it evade detection.” https://threatpost.com/spear-phishing-attack-spoofs-ee-to-target-executives/155480/
  21. “Microsoft released the May 2020 non-security Microsoft Office updates with fixes for several issues and performance improvements to Windows Installer (MSI) editions of Office 2016 and Office 2013.  For instance, the KB4484328 update fixes an issue leading to blank authentication prompts being displayed when offline auth is enabled in Microsoft Office 2016. KB4484337 fixes another auth issue affecting PowerPoint 2016 where the password dialog box remains enabled even after disabling it using the DisablePasswordUI registry key.” https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-may-office-updates-with-fixes-for-auth-issues/
  22. “The COVID-19 Cyber Threat Coalition has released a block list of known URLs and domain names associated with Coronavirus-themed scams, phishing attacks, and malware threats.  The coalition is a volunteer organization created towards the end of March 2020 to disseminate information about new threats trying to take advantage of the Coronavirus pandemic.” https://www.bleepingcomputer.com/news/security/cyber-volunteers-release-blocklists-for-26-000-covid-19-threats/
  23. “Hackers have launched a massive attack against more than 900,000 WordPress sites seeking to redirect visitors to malvertising sites or plant a backdoor if an administrator is logged in.  Based on the payload, the attacks seem to be the work of a single threat actor, who used at least 24,000 IP? addresses over the past month to send malicious requests to more than 900,000 sites.” https://www.bleepingcomputer.com/news/security/massive-campaign-targets-900-000-wordpress-sites-in-a-week/

#security #cybersecurity #itsecurity #privacy #risk #compliance #piracy #android #google #firefox #finra #xiaomi #dos #openssl #shopify #bugbounty #dmca #bittorrent #popcorntime #ncsc #dhs #nazar #citrix #sharefile #naughtydog #s3 #infinityblack #wordpress

└ Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , ,
Comments Off on Cyber Security News for 5May2020

Cyber Security News for 4May2020

May04
by Shahid Sharif on May 4, 2020 at 9:41 pm
Posted In: Compliance, cyber security, cybersecurity, Privacy, Risk Management, Security
  1. “French daily newspaper Le Figaro exposed roughly 7.4 billion records containing personally identifiable information (PII) of employees, reporters, and at least 42,000 users.  The database was discovered by the Safety Detectives team of experts lead by the researcher Anurag Sen, it was over 8TB, the archive also included data of accounts registered between February and April 2020, as well as logs of accesses in the same period.” https://securityaffairs.co/wordpress/102623/data-breach/le-figaro-data-leak.html
  2. “Microsoft is testing a new version of Edge with Insiders and it comes with multiple new features including improved SmartScreen support. Microsoft Edge Dev v84.0.495.2 updates SmartScreen, which is a feature that blocks you from visiting web sites and download that are known to exhibit malicious behavior.” https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-getting-improved-security-work-at-home-features/
  3. “Coveware noticed that in Q1 ransomware operators(sodinokibi, ryuk) focused more on large enterprises, forcing payments out of them get unlock keys for their data. On average, the ransom payment for Q1 2020 was $111,605.” https://www.bleepingcomputer.com/news/security/sodinokibi-ryuk-ransomware-drive-up-average-ransom-to-111-000/
  4. “New research claims that China-based Xiaomi is tracking sensitive information and sending it to their servers if you use the Mi browser, which is bundled with all Redmi and Mi phones.” https://www.bleepingcomputer.com/news/technology/xiaomi-tracks-private-browser-and-phone-usage-defends-behavior/
  5. “On April 25, 2020, the Philippines National Privacy Commission (“NPC”) issued a statement that it is investigating several breach notifications it has received relating to the unauthorized disclosure of sensitive personal information of confirmed and suspected COVID-19 patients” https://www.huntonprivacyblog.com/2020/05/01/philippines-npc-investigating-covid-19-related-breaches/
  6. ” On Saturday, at around 8 pm (US Pacific coast), hackers have breached the LineageOS servers by exploiting an unpatched vulnerability. LineageOS is a free and open-source operating system for smartphones, tablet computers, and set-top boxes, based on the Android mobile platform. According to the LineageOS team, the attack was quickly detected and attackers had no time to not cause any problem.” https://securityaffairs.co/wordpress/102708/hacking/lineageos-hacked.html
  7. “The Better Business Bureau (BBB) last week raised the alarm on what it says is a spike in online puppy scams it’s seeing now that the pandemic has so many people stuck at home, wistfully imagining that it’s the perfect time to train and bond with a little fluff ball.” https://nakedsecurity.sophos.com/2020/05/04/coronavirus-pandemic-coincides-with-spike-in-online-puppy-scams/
  8. “Furthermore, there are several harmful activities that these hackers can execute from your site after hacking it. Hacking is nothing new to us, but still, we take it lightly. Even if you run a small business, you must learn how to shield it. Such evil minds target anything that they find open to them. Once they enter your site, they can send spam emails; can mislead the data of your consumers, and more. ” https://hackercombat.com/how-the-latest-plugin-and-theme-helps-to-avoid-wordpress-vulnerability/
  9. “Cybersecurity researcher Mordechai Guri from Israel’s Ben Gurion University of the Negev recently demonstrated a new kind of malware that could be used to covertly steal highly sensitive data from air-gapped and audio-gapped systems using a novel acoustic quirk in power supply units that come with modern computing devices.” https://thehackernews.com/2020/05/air-gap-malware-power-speaker.html
  10. “Unit 42 researchers analyzed 1.2 million newly registered domain (NRD) names containing keywords related to the COVID-19 pandemic from March 9, 2020 to April 26, 2020 (7 weeks). 86,600+ domains are classified as “risky” or “malicious”, spread across various regions , as shown in Figure 1. The United States has the highest number of malicious domains (29,007), followed by Italy (2,877), Germany (2,564), and Russia (2,456).  Unit 42 researchers found 56,200+ of the NRDs are hosted in one of the top four popular cloud service providers (CSPs), such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and Alibaba https://unit42.paloaltonetworks.com/covid-19-cloud-threat-landscape/
  11. “Tokopedia, which is backed by $2 billion in funding from investors including SoftBank and Alibaba, told Reuters Saturday it was investigating an alleged theft of user data, though it maintained that user passwords were still encrypted.” https://www.cyberscoop.com/indonesian-e-commerce-giant-probes-reported-breach-91-million-credentials/
  12. “The UK’s National Cyber Security Centre (NCSC) warned of targeted attacks against UK universities and scientific facilities that are involved in the COVID-19 research.  The NCSC reported that nation-state actors are carrying out cyber espionage campaigns aimed at gathering intelligence on studies conducted by UK organizations related to Coronavirus pandemic. The threat actors appear very interested in the progress of vaccination research. Intelligence experts belive that nation-state actors behind the attack operate for Russia, Iran, and China.” https://securityaffairs.co/wordpress/102731/cyber-warfare-2/hackers-covid-19-research.html
  13. “Cognizant’s clients are probably asking some tough questions right now including “Who were the third-party cybersecurity auditors providing the checks and balances risk assessment of Cognizant on behalf of their clients?” Did they even have a third-party audit/attestation?”  https://protocol46.com/cognizant-ransomware-attack-raises-concerns/
  14. “Adult live streaming website CAM4 exposed over 7TB of personally identifiable information (PII) of members and users, stored within more than 10.88 billion database records. The sensitive data was leaked after one of the site’s production databases was left open to Internet access on a misconfigured Elasticsearch cluster, with records dating back to March 16, 2020.” https://www.bleepingcomputer.com/news/security/cam4-adult-cam-site-exposes-11-million-emails-private-chats/
  15. “A new ransomware called VCrypt is targeting French victims by utilizing the legitimate 7zip command-line program to create password-protected archives of data folders.  BleepingComputer was told today about a new ransomware that was deleting all of a victim’s files found in Windows data folders and then creating new “encrypted” files named after the folder name.” https://www.bleepingcomputer.com/news/security/new-vcrypt-ransomware-locks-files-in-password-protected-7zips/
  16. “Microsoft is planning to put a stop to enterprise data theft via email forwarding by disabling Office 365’s email forwarding to external recipients by default.  The company also wants to add improved external email forwarding controls which will allow Office 365 admins to enable the feature only to select employees in their organizations.” https://www.bleepingcomputer.com/news/security/office-365-to-stop-data-theft-by-disabling-external-forwarding/
  17. “A feature of the LockBit ransomware allows threat actors to breach a corporate network and deploy their ransomware to encrypt hundreds of devices in just a few hours.  Started in September 2019, LockBit is a relatively new Ransomware-as-a-Service (RaaS) where the developers are in charge of the payment site and development and ‘affiliates’ sign up to distribute the ransomware.” https://www.bleepingcomputer.com/news/security/lockbit-ransomware-self-spreads-to-quickly-encrypt-225-systems/
  18. “GoDaddy notified some of its customers that an unauthorized party used their web hosting account credentials to connect to their hosting account via SSH.  The security incident took place on October 19, 2019, after the company’s security team discovered suspicious activity on a subset of GoDaddy’s servers.” https://www.bleepingcomputer.com/news/security/godaddy-notifies-users-of-breached-hosting-accounts/
  19. “The aircraft safety system known as the Traffic Alert and Collision Avoidance System (TCAS) can be coerced into sending an airplane on a mid-air rollercoaster ride – much to the horror of those onboard. Researchers were able to cobble together an effective method for spoofing the TCAS using a $10 USB-based Digital Video Broadcasting dongle and a rogue transponder, for communicating with aircraft.” https://threatpost.com/airplane-hack-exposes-weaknesses-of-alert-and-avoidance-systems/155451/
  20. “Last week experts from Microsoft detected a COVID-19-themed spam campaign, the messages are crafted to trick users into downloading and mounting ISO or IMG file attachments. The bait ISO or IMG files were infected with a strain of the Remcos remote access trojan (RAT).” https://securityaffairs.co/wordpress/102739/cyber-crime/malspam-campaigns-iso-img-files.html

#security #cybersecurity #itsecurity #privacy #lefigaro #sodinokibi #ryuk #npc #lineageOS #saltstack #wordpress #nrd #cam4 #lockbit #raas #remcos #rat #trojan #godaddy #cognizant

└ Tags: , , , , , , , , , , , , , , , , , , ,
Comments Off on Cyber Security News for 4May2020