News Items

  • news

    Visible to the public "Oil and Gas Sector Lags Behind Other Industries in Gathering Dark Web Intel"

    According to new research by Searchlight Cyber, 27 percent of CISOs at oil and gas companies believe that dark web activity has no impact on their business, even though it is common for threat actors to hold auctions on the dark web to sell access to compromised Virtual Private Networks (VPNs) at energy companies. Seventy-two percent of oil and gas companies are already gathering dark web intelligence to defend their organizations from cyberattacks, according to Searchlight Cyber researchers. However, they are still behind many other leading industries, such as financial services (85 percent), manufacturing (83 percent), and transportation (81 percent). Energy companies may not have viewed themselves as the primary target of financially-motivated attacks from the dark web in the past, but the cybersecurity landscape has changed dramatically. Cybercriminals are increasingly targeting enterprises in industries such as healthcare, oil and gas, and manufacturing. This article continues to discuss key findings from Searchlight Cyber regarding dark web threats.

    SC Magazine reports "Oil and Gas Sector Lags Behind Other Industries in Gathering Dark Web Intel"

  • news

    Visible to the public "Rutgers Researchers Find Flaws in Using Source Reputation for Training Automatic Misinformation Detection Algorithms"

    Researchers from Rutgers University have discovered a significant flaw in how algorithms designed to detect "fake news" assess the credibility of online news stories. According to the researchers, most of these algorithms rely on a credibility score for the article's "source" rather than assessing the credibility of each individual article. Vivek K. Singh, an associate professor at the Rutgers School of Communication and Information and coauthor of the study "Misinformation Detection Algorithms and Fairness Across Political Ideologies: The Impact of Article Level Labeling," stated that not all news articles published by "credible" sources are accurate, nor are all articles published by "noncredible" sources "fake news." With article-level labels matching 51 percent of the time, the researchers concluded that using source-level labels to determine credibility is not a reliable method. This labeling procedure has significant implications for tasks such as the development of robust fake news detectors and audits of fairness across the political spectrum. To address this issue, the study provides a new dataset of individually labeled articles of journalistic quality, as well as a method for misinformation detection and fairness audits. This study's findings emphasize the need for more nuanced and trustworthy methods to detect misinformation in online news and provide valuable resources for future research. This article continues to discuss the flaws discovered in using source reputation for training automatic misinformation detection algorithms.

    Rutgers University reports "Rutgers Researchers Find Flaws in Using Source Reputation for Training Automatic Misinformation Detection Algorithms"

  • news

    Visible to the public "Carpet Bomb DDoS Attacks Rise 300 Percent"

    According to a new report from Corero Network Security, 'carpet bomb' Distributed Denial-of-Service (DDoS) attacks increased by 300 percent in 2022 compared to 2021. Carpet bomb attacks, also referred to as spread-spectrum or spray attacks, distribute traffic across wide IP address spaces. Legacy technology, such as standard victim-oriented detection and mitigation techniques, often fails to accurately identify these attacks, resulting in insufficient mitigation or false positives. Legacy solutions may also be overwhelmed by the number of IP addresses involved. Corero Network Security's DDoS Threat Intelligence Report reveals that there were over seven times as many Mirai-like DDoS attacks in 2022 compared to 2021. These botnet attacks are difficult to defend against and can cause significant harm to companies. In addition, there were double the number of DDoS attacks against Domain Name System (DNS) services in 2022 compared to 2020. This attack vector has become an easy method for attackers to disrupt communications between websites, Internet-connected devices, and applications. The analysis reveals a 600 percent increase in the share of malicious DDoS traffic carried by the IPv6 protocol and a 70 percent increase in TCP-based attack vectors. This article continues to discuss key findings from the DDoS Threat Intelligence Report.

    BetaNews reports "Carpet Bomb DDoS Attacks Rise 300 Percent"

  • news

    Visible to the public "4 Countries Join NATO Cyber Defense Center"

    The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) recently announced that four countries have joined as members: Ukraine, Ireland, Japan, and Iceland. The announcement was made on the cybersecurity center's 15th anniversary. The organization, based in Tallinn, Estonia, now has 39 members. The NATO cyber defense hub conducts cyber defense research, training, and exercises, focusing on areas such as technology, strategy, operations, and law. The CCDCOE recently conducted the annual Locked Shields cyber defense exercise, in which the representatives of 38 countries took part. In the exercise, Red Teams compete against Blue Teams, which are tasked with defending a country's information systems and critical infrastructure from large-scale attacks.

    SecurityWeek reports: "4 Countries Join NATO Cyber Defense Center"

  • news

    Visible to the public "Report Finds Just One Unpatched Vulnerability Increases the Risk of a Cyber Insurance Claim by 33%"

    The cybersecurity and cyber insurance company Coalition has discovered that policyholders with even one unresolved critical vulnerability are more likely to experience a claim. According to Coalition's 2023 Cyber Claims Report, having even a single unpatched vulnerability increased the risk of cyber insurance claims by 33 percent. The report also found that organizations that continued to use end-of-life software were three times more likely to face an incident. In addition to "human inaction" (not patching software), human error is also a primary risk factor for companies with cyber insurance. Seventy-six percent of reported incidents involved phishing, which is more than six times more prevalent than the next most common attack technique. Nearly all cyber insurance claims related to phishing were the direct consequence of employees falling for phishing tricks. Since the beginning of 2022, phishing-related claims have increased by 29 percent among insured Coalition members. With its insured members, successful phishing often results in funds transfer fraud or Business Email Compromise (BEC), but the report notes that phishing was also the most common method used to gain access to an organization's system for any reason. This article continues to discuss key findings from Coalition's 2023 Cyber Claims Report.

    SiliconANGLE reports "Report Finds Just One Unpatched Vulnerability Increases the Risk of a Cyber Insurance Claim by 33%"

  • news

    Visible to the public "US Offers $10m Reward For Alleged Prolific Ransomware Actor"

    A Russian national has recently been unmasked as a key player in the "development and deployment" of the Hive, LockBit, and Babuk ransomware strains. Mikhail Pavlovich Matveev (aka Wazawaka/m1x/Boriselcin/Uhodiransomwar) was recently charged with conspiring to transmit ransom demands, conspiring to damage protected computers, and intentionally damaging protected computers. If convicted, he faces over 20 years behind bars. However, that's not likely, as the suspect is thought to reside in Russia. The State Department has issued a $10m reward for information that leads to the arrest and/or conviction of Matveev, under its Transnational Organized Crime Rewards Program. The Department of Justice (DoJ) highlighted several alleged victims of Matveev, including a law enforcement agency and non-profit behavioral healthcare organization in New Jersey and the Washington DC Metropolitan Police Department. The DoJ estimated the combined ransom haul for the three variants at $200m, adding that the affiliates behind them demanded twice that. In addition to the indictments, the US Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against Matveev.

    Infosecurity reports: "US Offers $10m Reward For Alleged Prolific Ransomware Actor"

  • news

    Visible to the public "University Admission Platform Exposed Student Passports"

    The popular university admissions platform called Leverage EDU leaked nearly 240,000 sensitive files, including passports, financial documents, certificates, and exam results. The Cybernews research team discovered that Leverage EDU's misconfiguration of systems led to the leak of sensitive information. Since no authentication was required, anyone could access an impacted student's information required for university applications. Leverage EDU is an admission platform for students who wish to study abroad. It claims to have a global network of over 650 educational institutions and 80 million users. Cybernews researchers discovered a misconfigured, publicly accessible Amazon S3 bucket on January 31. The bucket had numerous zip folders containing nearly 240,000 files with sensitive data and Personally Identifiable Information (PII) belonging to prospective students. A malicious actor could have used the exposed information to commit identity theft and fraud. A data breach of this magnitude allows criminals to craft spear-phishing attacks and target individuals with greater specificity, placing their financial and other accounts at risk. This article continues to discuss the exposure of sensitive information by the university admission platform Leverage EDU.

    Cybernews reports "University Admission Platform Exposed Student Passports"

  • news

    Visible to the public "Chrome 113 Security Update Patches Critical Vulnerability"

    Google recently announced the release of a Chrome 113 security update that resolves a total of 12 vulnerabilities, including one rated "critical." Six of the flaws were reported by external researchers. The "critical" vulnerability, tracked as CVE-2023-2721 and reported by Qihoo 360 researcher Guang Gong, is described as a use-after-free flaw in Navigation. Google noted that a remote attacker could craft an HTML page to trigger a heap corruption when a user accesses the page. The attacker would have to convince the user to visit the page. Google stated that use-after-free vulnerabilities are memory corruption bugs that occur when the pointer is not cleared after memory allocation is freed, which could lead to arbitrary code execution, denial-of-service, or data corruption. In Chrome, use-after-free issues can be exploited to escape the browser sandbox, which also requires the attacker to target a vulnerability in the underlying system or in Chrome's browser process. Google noted that the latest Chrome update addressed three other externally reported use-after-free flaws, all rated "high" severity. The vulnerabilities impact the browser's Autofill UI, DevTools, and Guest View components. The new browser release also resolves a "high" severity type confusion bug in the V8 JavaScript engine and a "medium" severity inappropriate implementation issue in WebApp Installs. Google stated that it paid $11,500 in bug bounties to the reporting researchers. However, the company has yet to determine the amounts to be paid for two of the vulnerabilities, including the "critical" severity one, so the final amount could be higher. The latest Chrome iteration is now rolling out as version 113.0.5672.126 for macOS and Linux, and as versions 113.0.5672.126/.127 for Windows.

    SecurityWeek reports: "Chrome 113 Security Update Patches Critical Vulnerability"

  • news

    Visible to the public "Want to Keep AI From Sharing Secrets? Train It Yourself"

    Artificial Intelligence (AI) is subject to the same privacy regulations as other technologies. In March 2023, there was a security incident in which ChatGPT users were able to view the chat histories of other users, prompting Italy to temporarily ban ChatGPT. This problem could impact any system that stores user data. Italy lifted its ban after OpenAI added features that give users greater control over their data storage and use. However, there are other unique challenges faced by AI. Generative AI models are not designed to reproduce training data and generally cannot do so in any given instance, but it is not impossible. A paper titled "Extracting Training Data from Diffusion Models," which was published in January 2023, describes how Stable Diffusion can generate images that are similar to those in the training data. The Doe v. GitHub lawsuit has examples of code generated by GitHub Copilot, a tool powered by a Large Language Model (LLM) from OpenAI, that matches code in training data. This raises concerns that generative AI controlled by a third-party may inadvertently expose sensitive data. Some generative AI tools, such as ChatGPT, exacerbate this concern by incorporating user data into their training set. Companies concerned with data privacy have little choice but to prohibit its use. This article continues to discuss the privacy issues associated with AI and private AI as a potential solution.

    IEEE Spectrum reports "Want to Keep AI From Sharing Secrets? Train It Yourself"

  • news

    Visible to the public "Apple Blocked 1.7 Million Applications From App Store in 2022"

    Apple recently announced that it blocked 1.7 million applications from being published in the App Store in 2022. The rejected apps did not meet the required privacy, security, and content standards. The App Store has more than 650 million average weekly visitors globally, who can access content from more than 36 million registered Apple developers. Apple noted that last year, they terminated 428,000 developer accounts for fraudulent activity and rejected 105,000 Developer Program enrollments. The tech giant says it blocked 57,000 untrustworthy apps distributed through illegitimate storefronts and roughly 3.9 million attempts to deploy or launch applications distributed illicitly via the Developer Enterprise Program. In 2022, Apple revealed that they disabled more than 282 million customer accounts that engaged in fraudulent activities and prevented 198 million fraudulent new accounts from being created. According to Apple, its team reviews, on average more than 100,000 app submissions per week. Last year, the team reviewed over 6.1 million app submissions and rejected 1.7 million of them on various fraud and privacy concerns. Some of the rejected apps, Apple says, contained malicious code designed to steal user credentials, while others were disguised as financial management platforms but could morph into other applications. Other applications were spam, copycats, or misleading, contained undocumented features, or attempted to obtain users' data without their consent. According to Apple, over 147 million ratings and reviews were blocked and removed from the App Store last year out of a total of more than a billion that were processed. Apple also says it blocked roughly 3.9 million stolen credit cards from being used in its store and banned 714,000 accounts, thus blocking fraudulent transactions worth more than $2 billion.

    SecurityWeek reports: "Apple Blocked 1.7 Million Applications From App Store in 2022"

  • news

    Visible to the public "Threat Group UNC3944 Abusing Azure Serial Console for Total VM Takeover"

    Mandiant has observed a financially-motivated cyber actor abusing Microsoft Azure Serial Console on Virtual Machines (VMs) in order to install third-party remote management tools in compromised environments. The activity was attributed to a threat group tracked by Mandiant as UNC3944, also known as Roasted 0ktapus and Scattered Spider. According to Mandiant researchers, this attack method is unique because it circumvented many of the traditional Azure detection methods and granted the attacker full administrative access to the VM. Since at least May 2022, the adversary, which first emerged late last year, has been known to use SIM-swapping attacks to breach telecommunications and Business Process Outsourcing (BPO) companies. Mandiant later discovered UNC3944 using a loader named STONESTOP to install a malicious signed driver called POORTRY that is designed to terminate processes associated with security software and delete files as part of a Bring Your Own Vulnerable Driver (BYOVD) attack. This article continues to discuss the abuse of Microsoft Azure Serial Console on VMs by the threat group UNC3944.

    THN reports "Threat Group UNC3944 Abusing Azure Serial Console for Total VM Takeover"

  • news

    Visible to the public "FBI Warns Organizations of the New BianLian Ransomware Tactics"

    A joint Cybersecurity Advisory (CSA) issued by US and Australia government agencies and published by the US Homeland Security Department's Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of the most recent tactics, techniques, and procedures (TTPs) used by the BianLian ransomware group. Since June 2022, the BianLian ransomware and data extortion group has been targeting entities within US and Australian critical infrastructure organizations. As part of the #StopRansomware initiative, the advisory is based on investigations conducted by the FBI and the Australian Cyber Security Centre (ACSC). It seeks to provide defenders with information that enables them to adjust protections and strengthen their security posture against BianLian ransomware and other threats of a similar nature. BianLian used a double-extortion model at first, encrypting systems after stealing sensitive data from victim networks and then threatening to publish the data. However, since Avast released a decryptor for the ransomware in January 2023, the group has shifted to extortion based on data theft without encrypting systems. This article continues to discuss the BianLian group's TTPs.

    Bleeping Computer reports "FBI Warns Organizations of the New BianLian Ransomware Tactics"

  • news

    Visible to the public "TP-Link Routers Implanted With Malicious Firmware in State-Sponsored Attacks"

    According to Check Point researchers, a Chinese state-sponsored Advanced Persistent Threat (APT) group implanted malicious firmware into TP-Link routers as part of attack campaigns targeting European foreign affairs entities. The malicious firmware was developed exclusively for TP-Link routers. Among its numerous harmful components is a custom-made backdoor called "Horse Shell." Horse Shell enables attackers to take complete control of a compromised device and remain hidden while accessing impacted networks. The researchers are uncertain as to how the attackers infected the routers, but they believe they likely obtained access by exploiting known vulnerabilities or using default, weak, or easily guessable passwords. Although the campaigns targeted European foreign affairs entities, researchers do not know who the router implant victims are. This article continues to discuss the infection of TP-Link routers by malicious firmware for state-sponsored attacks.

    Help Net Security reports "TP-Link Routers Implanted With Malicious Firmware in State-Sponsored Attacks"

  • news

    Visible to the public "Unpatched Wemo Smart Plug Bug Opens Countless Networks to Cyberattacks"

    The Wemo Mini Smart Plug V2, which enables users to remotely control anything connected to it via a mobile app, contains a security flaw that cyberattackers can exploit to trigger a variety of undesirable outcomes. These include the ability to turn electronic devices on and off remotely, and the potential to move deeper into an internal network or jump to additional devices. The Smart Plug goes into an existing outlet, connecting to an internal Wi-Fi network and the Internet via Universal Plug-n-Play (UPNP) ports. Users can then control the device via a mobile app, providing a method to smarten traditional lamps, fans, and other utility items. In addition to integrating with Alexa, Google Assistant, and Apple Home Kit, the app provides features such as scheduling. According to researchers at Sternum, the flaw, tracked as CVE-2023-27217, is a buffer-overflow vulnerability that affects the device model F7C063 and allows remote command injection. However, when they contacted the device manufacturer, Belkin, for a patch, they were informed that no firmware update would be released because the device is now an end-of-life product. This article continues to discuss the command injection bug in the popular device that Belkin has no plans to address.

    Dark Reading reports "Unpatched Wemo Smart Plug Bug Opens Countless Networks to Cyberattacks"

  • news

    Visible to the public "Herman's Study Furthering Cybersecurity Curriculum Assessment Earns Best Paper Award"

    Geoffrey Herman is a Professor in the Department of Computer Science at the University of Illinois at Urbana-Champaign, whose most recent work came through a multi-institutional research project that resulted in a Best Paper Award from the 2023 Technical Symposium on Computer Science Education, organized by the ACM Special Interest Group on Computer Science Education (SIGCSE). Herman's paper, "Psychometric Evaluation of the Cybersecurity Curriculum Assessment," built upon collaborative research with the University of Maryland, Baltimore County (UMBC) and the University of Minnesota, Duluth. This paper explores effective cybersecurity teaching and learning among students. According to the paper, the project was inspired by a shortage of cybersecurity professionals, which cannot be addressed without an understanding of which cybersecurity curricula and teaching strategies provide students with a solid foundation. The group first worked on the Cybersecurity Assessment Tools project, which entailed the development of tools that accurately measure how well courses and curricula are forming students' conceptual knowledge. This effort advanced through the group's focus on a Cybersecurity Concept Inventory, which they use to assess students' conceptual knowledge of cybersecurity following a first course in the subject. The newest paper describes the Cybersecurity Curriculum Assessment used to evaluate students' cybersecurity knowledge after they have completed a multi-course curriculum. The main takeaway is that there are tools validated by research to evaluate how well cybersecurity courses and curricula prepare students to think broadly about cybersecurity. This article continues to discuss the "Psychometric Evaluation of the Cybersecurity Curriculum Assessment" paper that won the Best Paper Award from the 2023 Technical Symposium on Computer Science Education.

    The Grainger College of Engineering - University of Illinois reports "Herman's Study Furthering Cybersecurity Curriculum Assessment Earns Best Paper Award"

  • news

    Visible to the public "Illinois Tech's CARNATIONS Receives $10M Federal Grant as New Tier 1 Transportation Center to Bolster Cybersecurity in Navigation Systems"

    The US Department of Transportation has designated the Center for Assured and Resilient Navigation in Advanced Transportation Systems (CARNATIONS) at the Illinois Institute of Technology (Illinois Tech) as a Tier 1 University Transportation Center (UTC). As a Tier 1 UTC, CARNATIONS will receive a $10 million grant for increasing the resilience of transportation navigation systems against cyberattacks such as spoofing and jamming. CARNATIONS, a consortium of universities led by Professor of Mechanical and Aerospace Engineering Boris Pervan, conducts transformative research in resilient transportation systems, facilitates technology transfer to public agencies and industry, and advances workforce and educational development. Interference, such as jamming and spoofing, that targets critical infrastructure can cause delays and cascading failures across multiple modes of transportation. For example, a major aircraft manufacturer reported over 10,000 Global Navigation Satellite System (GNSS) interference events in 2021 alone, and repeated spoofing attacks have negatively impacted various military operations. Pervan and his team plan to approach the problem from different angles, including developing sophisticated algorithms that can distinguish between authentic and spoofed GPS signals and improving GPS receivers by combining them with other types of sensors resistant to jamming and spoofing. CARNATIONS will consider the possibility of a fully connected system in the future, in which self-driving cars exchange information with each other and with smart infrastructure such as traffic signals. This article continues to discuss CARNATIONS and its goal to enhance the resilience of transportation infrastructure against cyber threats.

    Illinois Institute of Technology reports "Illinois Tech's CARNATIONS Receives $10M Federal Grant as New Tier 1 Transportation Center to Bolster Cybersecurity in Navigation Systems"

  • news

    Visible to the public "Infiltration of Qilin Reveals Customizable Nature of RaaS Marketplace"

    The Russia-aligned Ransomware-as-a-Service (RaaS) group Qilin offers its affiliates sophisticated, user-friendly tools to trap their victims, as well as a significant portion of the proceeds they steal. Qilin, also known as Agenda ransomware, was first identified by Trend Micro in August 2022. The group has been targeting companies in the healthcare and education sectors. After infiltrating Qilin's operations, Group-IB recently revealed previously unknown information about the group's inner workings, including their claim to have compromised at least 12 victims since July 2022. The group provides affiliates with highly flexible tools to manage attacks on organizations. According to threat intelligence analyst Nikolay Kichatov, the RaaS provider recently switched from a solution written in the Go programming language to Rust-based ransomware that makes it easier to tailor attacks to Windows, Linux, and other operating system environments. Many Qilin ransomware attacks are customized in order to optimize their impact on each victim. Kichatov added that this customization and optimization involves modifying filename extensions of encrypted files and terminating specific processes and services. Group-IB threat intelligence researchers analyzed the affiliate program and found a six-section admin interface. This article continues to discuss researchers' findings and observations regarding the Qilin RaaS group.

    SC Media reports "Infiltration of Qilin Reveals Customizable Nature of RaaS Marketplace"

  • news

    Visible to the public "Is the New .zip Top-Level Domain a Cyber Security Risk?"

    According to security experts, the new '.zip' top-level domain (TLD) could drive an increase in the spread of malware and undermine legitimate sources. TLDs are the letters that follow the final period in a URL, such as '.com.' At the beginning of May, Google announced the release of eight new options, including .dad, .phd, .prof, .esq, .foo, .zip, .mov, and .nexus. Although most of the new TLDs were created to correspond with specific job titles, there are concerns that the two that resemble file extensions, which are '.zip' and '.mov,' could be used by hackers to deceive users into entering malicious domains. Zipped archives are widely used in business because they enable the sharing of large amounts of data in a compressed format and are compatible with macOS, Windows, and Linux. Using the '.zip' TLD to disguise illegitimate links as downloadable files could lead to increased phishing attacks or the delivery of malicious .zip files, such as those used in recent Emotet botnet campaigns through domains resembling innocent files. This article continues to discuss the cybersecurity risk posed by the new .zip TLD.

    ITPro reports "Is the New .zip Top-Level Domain a Cyber Security Risk?"

  • news

    Visible to the public "Lacroix Shuts Three Factories For a Week After Cyberattack"

    International electronics manufacturer Lacroix has recently intercepted a targeted cyberattack on its activity sites in France (Beaupreau), Germany (Willich), and Tunisia (Zriba). To assess the damages caused by the attack, the company said it temporarily shut down several online systems. The company stated that prior to restarting the systems of these sites, investigations are underway to ensure that the attack is completely contained. The company noted that some local infrastructures have been encrypted, and an analysis is also being carried out to identify any exfiltrated data. These operations, combined with the need to use backups to restore systems, are expected to require a few days, leading to the closure of the three sites for the week. The company stated that
    they are aiming for a reopening on Monday, May 22nd.

    Infosecurity reports: "Lacroix Shuts Three Factories For a Week After Cyberattack"

  • news

    Visible to the public "Millions of Deleted Files Recovered in Hard Drives Purchased Online"

    Secure Data Recovery shared the results of a data recovery project aimed at determining how many files could be recovered from hard drives purchased online. The company purchased 100 hard drives at random and used reasonable means to attempt data recovery. Secure Data Recovery was able to recover data from 35 drives, 34 of which were sanitized, 30 were damaged, and only one was encrypted. Over 5.7 million files were recovered, although that number was skewed by a single hard drive containing more than 3.1 million files. The findings emphasize a major problem among most users. After replacing damaged or obsolete hard drives, most users lack a thorough destruction or disposal plan. This article continues to discuss the recovery of millions of files from hard drives purchased online, users not properly destroying or disposing of damaged or obsolete hard drives, and how to securely dispose of a hard drive.

    TechRadar reports "Millions of Deleted Files Recovered in Hard Drives Purchased Online"

  • news

    Visible to the public "Bipartisan Bill Aims to Shut Rural Hospital Cyber Skill Gaps"

    New bipartisan legislation introduced in the US Senate seeks to address the cybersecurity skills shortage in rural hospitals, which hackers and ransomware operators increasingly target. The Rural Hospital Cybersecurity Enhancement Act would require the US Homeland Security Department's Cybersecurity and Infrastructure Security Agency (CISA) to develop a comprehensive cybersecurity workforce development strategy for healthcare facilities in "non-urbanized" areas that offer primary care, emergency care, and diagnostic services. Small and rural institutions often lack the means to invest in cybersecurity defenses and professionals in order to prevent breaches. For example, Uintah Basin Healthcare, a 42-bed hospital in rural eastern Utah, has recently begun notifying 103,974 patients whose health information may have been compromised due to a hacking breach. This article continues to discuss the Rural Hospital Cybersecurity Enhancement Act.

    DataBreachToday reports "Bipartisan Bill Aims to Shut Rural Hospital Cyber Skill Gaps"

  • news

    Visible to the public "WordPress Plugin Vulnerability Exposed Ferrari Website to Hackers"

    Security researchers at Char49 have discovered that a vulnerability in the official website of luxury sports car maker Ferrari could have exposed potentially sensitive information. The issue was discovered in March. Ferrari addressed the weakness within a week. The researchers noticed that the "media.ferrari[.]com" domain is powered by WordPress, and it was running a very old version of W3 Total Cache, a plugin installed on more than a million websites. The plugin was affected by CVE-2019-6715, a flaw that can be exploited by an unauthenticated attacker to read arbitrary files. Exploitation of the vulnerability allowed the researchers to obtain the "wp-config.php" file, which stores WordPress database credentials in clear text. The researchers stated that the exposed database stored information associated with the media[.]ferrari.com domain. While the researchers did not dig too deep in order to avoid breaking responsible disclosure rules, the vulnerability could have been exploited to access other files on the web server, including ones that could contain information that is of value for threat actors. After being notified, Ferrari patched the vulnerability by updating the WordPress plugin. The researchers stated that while in this case there is no indication that the security hole directly exposed customer or other sensitive information, it's important for high-profile companies such as Ferrari to ensure that none of their systems are vulnerable. In March, Ferrari admitted to being targeted in a ransomware attack in which hackers stole customer information.

    SecurityWeek reports: "WordPress Plugin Vulnerability Exposed Ferrari Website to Hackers"

  • news

    Visible to the public  "Lancefly APT Uses Powerful Merdoor Backdoor in Attacks on Asian Orgs"

    Symantec researchers have reported that the Lancefly Advanced Persistent Threat (APT) group is now using a custom-written backdoor called Merdoor in ongoing attacks against South and Southeast Asian organizations. The attacks are aimed at government, aviation, education, and telecommunications organizations. The intelligence-gathering campaign emerged in mid-2022 and is still ongoing. Merdoor is a fully-featured backdoor that supports multiple capabilities, such as installing itself as a service and keylogging. In addition, it has various ways to communicate with its command-and-control (C2) server (i.e., HTTP, HTTPS, DNS, UDP, TCP), and the ability to listen for commands on a local port. The only difference between the instances of Merdoor examined by the researchers is the embedded and encrypted configuration, which includes the C2 communication mechanism, service details, and installation directory. This article continues to discuss the Lancefly APT group's use of the powerful custom backdoor Merdoor in attacks against organizations.

    Security Affairs reports "Lancefly APT Uses Powerful Merdoor Backdoor in Attacks on Asian Orgs"

  • news

    Visible to the public "Industrial Cellular Routers at Risk: 11 New Vulnerabilities Expose OT Networks"

    Multiple security flaws have been discovered in the cloud management platforms of three industrial cellular router vendors, which could expose Operational Technology (OT) networks to attacks. The industrial cybersecurity company OTORIO presented its findings at the Black Hat Asia 2023 conference. The 11 vulnerabilities enable Remote Code Execution and complete control over hundreds of thousands of devices and OT networks. Specifically, the cloud-based management solutions provided by Sierra Wireless, Teltonika Networks, and InHand Networks for remotely managing and operating devices contain the vulnerabilities. Successful exploitation of the vulnerabilities could pose significant risks to industrial environments, allowing adversaries to bypass security layers, exfiltrate sensitive data, and remotely execute code on internal networks. The vulnerabilities could also be weaponized to gain unauthorized access to devices on the network and carry out malicious operations such as a shutdown with elevated permissions. This article continues to discuss the potential exploitation and impact of the vulnerabilities found in cloud-based management solutions offered by Sierra Wireless, Teltonika Networks, and InHand Networks.

    THN reports "Industrial Cellular Routers at Risk: 11 New Vulnerabilities Expose OT Networks"

  • news

    Visible to the public "Open-Source Cobalt Strike Port 'Geacon' Used in macOS Attacks"

    Geacon, a Go-based implementation of the beacon from the widely exploited penetration testing suite Cobalt Strike, is increasingly being used to target macOS devices. Geacon and Cobalt Strike are both utilities that legitimate organizations use to simulate attacks against their networks and strengthen their defenses, but threat actors have also used them to conduct attacks. In regard to Cobalt Strike, threat actors have been exploiting it to compromise Windows systems for years, and the information security industry has been fighting it. SentinelOne researchers monitoring Geacon activity in the wild have recently observed an increase in payloads on VirusTotal. While some exhibited signs of red team operations, others displayed traits of malicious attacks. This article continues to discuss the use of Geacon in attacks against macOS devices.

    Bleeping Computer reports "Open-Source Cobalt Strike Port 'Geacon' Used in macOS Attacks"

  • news

    Visible to the public "Attack Automation Becomes a Prevalent Threat Against APIs"

    According to Cequence Security, Application Programming Interfaces (APIs) have emerged as a primary attack vector in several high-profile incidents, posing a significant threat to the security posture of organizations. Numerous high-profile organizations have suffered API attacks in recent months, increasing the need for CISOs to prioritize API security. According to Ameya Talwalkar, CEO of Cequence Security, traditional prevention methods are no longer sufficient as attackers become more inventive. Talwalkar added that as attack automation becomes an increasingly prevalent threat against APIs, organizations must have the tools, knowledge, and expertise to defend in real-time. About 45 billion search attempts were made for shadow APIs in the second half of 2022, a 900 percent increase from the 5 billion attempts made in the first half of 2022. From June to October 2022, attackers favored traditional application security techniques, but as the holidays approached, API security tactics experienced a 220 increase. This article continues to discuss key findings from Cequence Security's "API Protection Report: Holiday Build-up Shows 550% Jump in Unique Threats."

    Help Net Security reports "Attack Automation Becomes a Prevalent Threat Against APIs"

  • news

    Visible to the public "Microsoft Follina Bug Is Back in Meme-Themed Cyberattacks Against Travel Orgs"

    A threat actor is exploiting the Follina Remote Code Execution (RCE) vulnerability discovered last year to deploy the XWORM Remote Access Trojan (RAT) and data-stealer against hospitality industry targets. Follina, tracked as CVE-2022-30190, is an RCE flaw with a "high" CVSS score of 7.8. It enables attackers to create specially crafted Microsoft Word files that trick Microsoft's Diagnostic Support Tool into downloading and executing malicious code from a server controlled by the attacker. On May 12, researchers from Securonix detailed the campaign, which uses Follina to drop Powershell code onto target machines and is packed with 4Chan references and memes. The researchers dubbed the campaign "MEME#4CHAN," because it blurs the line between stealth and Internet humor. MEME#4CHAN attacks start with a phishing email containing a hospitality-themed subject line, such as "Reservation for Room." This article continues to discuss the MEME#4CHAN campaign exploiting a patched Microsoft vulnerability to attack the hospitality industry.

    Dark Reading reports "Microsoft Follina Bug Is Back in Meme-Themed Cyberattacks Against Travel Orgs"

  • news

    Visible to the public "Transportation Dept Cyber Breach Exposes Data of Federal Employees"

    The Department of Transportation (DOT) has recently been hit with a data breach that may have exposed personally identifiable information of federal government employees. The DOT said it was working to notify affected individuals whose personally identifiable information may have been compromised due to the breach and to help mitigate potential risks. The data breach impacts individuals that are enrolled in the US Department of Transportation's transit benefit program (TRANServe). TRANServe manages the transit benefit program for DOT and other federal agencies. The breach occurred within the system that supports TRANServe. TRANServe is a commuting benefits system that reimburses staff across the federal government for certain transportation costs. According to the DOT, the information compromised as a result of the breach may include details such as the name of TRANServe transit benefit recipients, their agency, work email address, work phone number, work address, home address, SmarTrip card number, and/or TRANServe Card number. The breach is expected to affect 114,000 current DOT employees and 123,000 former DOT employees.

    FedScoop reports: "Transportation Dept Cyber Breach Exposes Data of Federal Employees"

  • news

    Visible to the public "Ransomware Group Claims 2.5 Terabytes of Stolen Data Less Than a Month After Emerging Online"

    Security researchers at Cisco Talos have discovered a ransomware group that has emerged recently and has already listed four victims, including three in the U.S., on its leak site. The "RA GROUP" is just the latest entity to use the Babuk ransomware source code, which a developer leaked in September 2021 on a Russian-language forum. The researchers noted that despite having emerged online on April 22, RA GROUP has already claimed to have stolen nearly 2.5 terabytes of data across just four victims, three in the U.S. and one in South Korea. Three of the victims were posted on April 27, and the next on April 28. The American targets include a smaller company in the insurance industry and two larger companies in financial services, and an electronics supplier servicing the computer, communication, aerospace, marine, and military industries. The researchers noted that the RA GROUP website has undergone cosmetic changes since it was first published, "confirming they are in the early stages of their operation." The researchers stated that the group uses custom ransom notes for each victim that informs them they have three days to pay before a sample is published and seven days before the full set is published. Victim entity names are also hardcoded into the executable files, a characteristic the researchers describe as "unusual" for ransomware groups.

    CyberScoop reports: "Ransomware Group Claims 2.5 Terabytes of Stolen Data Less Than a Month After Emerging Online"

  • news

    Visible to the public "US Says VoIP Firm Delivered Billions of Scam Robocalls"

    A Californian VoIP provider has recently been accused of breaking telemarketing rules by providing services that sent billions of illegal robocalls to US consumers. The Department of Justice (DoJ) and Federal Trade Commission (FTC) on Friday announced a civil enforcement action against Los Angeles-headquartered XCast Labs. The DoJ alleges that XCast Labs services delivered pre-recorded marketing messages to recipients, many of whom are listed on the National Do Not Call Registry. These included scam calls impersonating government agencies and "other false or misleading statements to induce purchases." The DoJ claimed that some calls also used spoofed caller ID information to hide the true origin of the caller and/or failed to identify the seller of the services being marketed. XCast Labs, which describes itself as "the nation's leading supplier of business enterprise solutions," is accused of continuing to allow its services to be used in this way, even after being told that the calls were illegal. The newly filed complaint seeks monetary civil penalties and a permanent injunction to prevent XCast Labs from future violations.

    Infosecurity reports: "US Says VoIP Firm Delivered Billions of Scam Robocalls"

  • news

    Visible to the public "PharMerica Discloses Data Breach Impacting 5.8 Million Individuals"

    National pharmacy network PharMerica recently started sending out notification letters to more than 5.8 million individuals to disclose a data breach that occurred in March. Owned by BrightSpring Health, a provider of home and community-based health services, PharMerica operates over 2,500 facilities across the US and offers more than 3,100 pharmacy and healthcare programs. The company stated that the data breach occurred between March 12 and March 13. Personal information compromised during the incident includes names, addresses, birth dates, Social Security numbers, health insurance, and medication information. The company noted that in some cases, the compromised information belongs to deceased individuals, and the company encourages executors or surviving spouses to contact the national credit reporting agencies to notify them of the situation. PharMerica's letter does not provide details on the type of cyberattack that it suffered, but it appears that the Money Message ransomware group is responsible for the incident. In April, the group started leaking personally identifiable information (PII) and protected health information (PHI) allegedly stolen from PharMerica.

    SecurityWeek reports: "PharMerica Discloses Data Breach Impacting 5.8 Million Individuals"

  • news

    Visible to the public "Discord Breached After Service Agent Targeted"

    Discord has recently notified users of a data breach that occurred when a threat actor gained unauthorized access to the support ticket queue of a third-party customer service agent. The company noted that due to the nature of the incident, "it is possible that user email addresses, the contents of customer service messages, and any attachments sent between users and Discord may have been exposed to a third party." The popular messaging platform said that when it discovered the issue, it deactivated the compromised account and completed malware checks on the machine. The company stated that while they believe the risk is limited, it is recommended that users be vigilant for any suspicious messages or activity, such as fraud or phishing attempts. It is expected that Discord's user base will reach nearly 200 million monthly active users by the end of 2023, making it an increasingly attractive target for attackers.

    Infosecurity reports: "Discord Breached After Service Agent Targeted"

  • news

    Visible to the public "The Philadelphia Inquirer Suffers Cyberattack, Newspaper's Largest Disruption in Nearly 30 Years"

    The Philadelphia Inquirer recently reported a cyberattack that disrupted newspaper operations, the biggest disruption to its publications since a massive blizzard in 1996. The cyberattack prevented the newspaper from being able to print the Sunday edition of the newspaper. The company stated that its website remained functional for posting and updating articles, although it was slower than normal. Publisher Lisa Hughes said they could not provide an exact timeline for the full restoration of newspaper operations. The cyberattack came just days before Tuesday's mayoral election. Hughes said employees will not be allowed to use offices through at least Tuesday because of the disruptions, meaning the newsroom would not be available to reporters on election night. Hughes said the FBI was notified of the cyberattack. The FBI's Philadelphia office said it was aware of the attack but declined to comment further. It is unclear when the cyberattack began, but Hughes said the news organization was "first alerted to the anomalous activity" on Thursday by Cynet, a vendor that manages the outlet's network security. Publication continued without disruption on Thursday and Friday. Employees first detected disruptions Saturday morning when they discovered that the newspaper's content-management system was not working.

    Fox Business reports: "The Philadelphia Inquirer Suffers Cyberattack, Newspaper's Largest Disruption in Nearly 30 Years"

  • news

    Visible to the public "New Technology Developed for Quantum Cryptography Applications"

    Quantum computing threatens to render the use of classic cryptography for secure communications obsolete. Quantum cryptography applies the laws of quantum mechanics to ensure security. Quantum Key Distribution (QKD) enables two parties to secure a message using a random secret key, which is generated by quantum particles known as photons. In order to accomplish this, scientists are increasingly using an alphabet based on specific properties of light particles (i.e., photons), namely their color composition. However, no equipment had been created to decode the information again. Therefore, researchers at Paderborn University have created such a decoder. They made a multi-output quantum pulse gate (mQPG) that separates incoming letters into various colors, which physicists can identify with a spectrometer. In addition, they have demonstrated a complete, high-dimensional mQPG-based decoder that enables encryption protocols based on individual photons. This article continues to discuss the new technology developed by researchers at Paderborn University for quantum cryptography applications.

    Paderborn University reports "New Technology Developed for Quantum Cryptography Applications"

  • news

    Visible to the public "Millions of Mobile Phones Come Pre-infected With Malware, Say Researchers"

    According to Trend Micro researchers at Black Hat Asia, millions of Android phones were infected with malicious firmware before they were ever shipped from their factories. Most of the devices affected are Android mobile devices, although smartwatches, TVs, and other devices are also involved. The manufacturing of the devices is outsourced to an Original Equipment Manufacturer (OEM). The researchers emphasized that this outsourcing allows someone in the manufacturing process, such as a firmware provider, to infect products with malicious code before they are shipped. The team examined dozens of firmware images in search of malware and discovered over 80 different plugins, many of which were not widely distributed. The most impactful plugins were those that had a business strategy built around them, were sold on the underground, and were openly marketed on sites such as Facebook and YouTube. The malware aims to steal information or make money from information obtained or provided. Trend Micro researchers noted that the malware makes the devices serve as proxies, which are then used to steal and sell SMS messages, hijack social media accounts, take control of online messaging accounts, and more. This article continues to discuss millions of mobile phones being infected with malware prior to being shipped.

    The Register reports "Millions of Mobile Phones Come Pre-infected With Malware, Say Researchers"

  • news

    Visible to the public "Feds Warn of Rise in Attacks Involving Veeam Software Flaw"

    Federal authorities have warned the healthcare industry about a rise in cyberattacks against Veeam's backup application. The attacks appear to be linked to the March disclosure of a high-severity vulnerability in the vendor's software. The vulnerability, tracked as CVE-2023-27532, exposes Veeam Backup and Replication (VBR)-stored encrypted credentials. According to a recent alert from the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HHS HC3), its exploitation could lead to unauthorized access to backup infrastructure hosts. These intrusions may result in data theft or ransomware deployment. The issue affects all versions of the Veeam software, which backs up, replicates, and restores data on Virtual Machines (VMs). The software supports transaction-level restores of Oracle and Microsoft SQL databases, according to HHS HC3. In addition to backing up and recovering VMs, VBR is also used to protect and restore individual files and applications for environments such as Microsoft Exchange and SharePoint, which are used in the healthcare and public health sector, making the threat significant. This article continues to discuss the healthcare sector facing a rise in cyberattacks on VBR.

    DataBreachToday reports "Feds Warn of Rise in Attacks Involving Veeam Software Flaw"

  • news

    Visible to the public "Lessons From 'Star Trek: Picard' – A Cybersecurity Expert Explains How a Sci-Fi Series Illuminates Today's Threats"

    Richard Forno, Principal Lecturer in Computer Science and Electrical Engineering at the University of Maryland, Baltimore County, emphasizes that the general public's understanding of technology and cybersecurity is often founded on simple stereotypes and sensationalized media portrayals. Forno has written about entertaining but misleading scenarios, such as black-clad teenage hackers navigating megacities and challenging corporate villains. However, Forno says that Hollywood sometimes depicts reality in entertaining and educational ways, which is important because everyone shares many of the same cybersecurity threats and vulnerabilities. As a former practitioner in the cybersecurity industry and current researcher in the field, Forno considers the final season of "Star Trek: Picard" to be the most recent example of entertainment media imparting valuable lessons about cybersecurity. This article continues to discuss Forno's views on how "Star Trek: Picard" relates to cybersecurity.

    The Conversation reports "Lessons From 'Star Trek: Picard' - A Cybersecurity Expert Explains How a Sci-Fi Series Illuminates Today's Threats"

  • news

    Visible to the public "Voting Machines Must Be Test Hacked for Certification, Under Proposed Bill"

    Lawmakers recently introduced bipartisan legislation to strengthen the cybersecurity of US election infrastructure and boost voter confidence by requiring penetration testing as part of voting machine certification. Senators. Mark Warner and Susan Collins introduced the "Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing" (SECURE IT) Act, which requires the Election Assistance Commission (EAC) to mandate that systems seeking certification undergo penetration testing, allowing researchers to search for vulnerabilities and simulate cyberattacks. Warner noted that the SECURE IT Act would enable researchers to assume the role of cybercriminals in order to identify vulnerabilities and flaws that might not otherwise be discovered. Under the SECURE IT Act, EAC and the National Institute of Standards and Technology (NIST) would accredit entities to conduct penetration testing. EAC must also establish a voluntary Coordinated Vulnerability Disclosure Program for election systems, in which researchers gain access to voting systems to identify and disclose vulnerabilities to the manufacturer and EAC. Discovered vulnerabilities will be submitted to the Common Vulnerabilities and Exposures database after 180 days. This article continues to discuss the SECURE IT Act.

    NextGov reports "Voting Machines Must Be Test Hacked for Certification, Under Proposed Bill"

  • news

    Visible to the public "Russia-Affiliated CheckMate Ransomware Quietly Targets Popular File-Sharing Protocol"

    The CheckMate ransomware group has targeted the Server Message Block (SMB) communication protocol to compromise their victims' networks. Cybernews researchers report that the group does not operate a data breach site, which is unusual for a ransomware campaign, given that many prominent gangs boast about targets and list them as victims on their data leak sites. This is done to increase the pressure on the victim to pay the demanded ransom. Recent research conducted by Cybernews has uncovered new CheckMate activity, revealing that the group has been actively targeting SMB shares with insufficient security. After gaining access to SMB shares, the malicious actors encrypt all files and demand payment in exchange for the decryption key. The ransomware group operates Kupidon, Mars, and CheckMate ransomware, all of which were discovered between 2021 and 2022. This article continues to discuss the CheckMate ransomware operators targeting the SMB communication protocol.

    Cybernews reports "Russia-Affiliated Checkmate Ransomware Quietly Targets Popular File-Sharing Protocol"

  • news

    Visible to the public "Brightly Says SchoolDude Data Breach Spilled 3 Million User Accounts"

    Software maker Brightly has recently confirmed that hackers stole close to three million SchoolDude user accounts in an April data breach. SchoolDude is a cloud-based work order management system used primarily by schools and universities to submit and track maintenance orders. Its users are school employees, like principals, executives, and maintenance workers, as well as students and other staff submitting repair requests. The company said it was notifying both past and present customers that the hackers took their names, email addresses, account passwords, and phone numbers if added to the account. The data also includes the names of school districts. Brightly said it reset customer passwords. The company warned users to change passwords on other online accounts that use the same credentials as they used on SchoolDude. This refers to credential stuffing, where hackers use passwords from previous data breaches to break into other user accounts with the same passwords. Brightly said it discovered the breach on April 28, more than a week after the mass data theft.

    TechCrunch reports: "Brightly Says SchoolDude Data Breach Spilled 3 Million User Accounts"

  • news

    Visible to the public "Sysco Data Breach Exposes Customer, Employee Data"

    In an internal memo sent recently, global food distribution company Sysco revealed that it had suffered a data breach earlier in the year when sensitive data on customers, employees, and the business, was stolen by hackers. The company said that it believes the network breach began on January 14, and they became aware of the breach on March 5. The company noted that the threat actor gained access to their systems without authorization and claimed to have acquired certain data. Though the investigation is ongoing, Sysco said customer and supplier data in the US and Canada and personal information of US employees such as names, Social Security numbers, and account numbers are likely to have been impacted or stolen due to this breach. Sysco operates with around 71,000 employees and 333 distribution facilities globally.

    Dark Reading reports: "Sysco Data Breach Exposes Customer, Employee Data"

  • news

    Visible to the public "New DownEx Malware Campaign Targets Central Asia"

    According to a report by Bitdefender, a previously undocumented malware campaign called DownEx has been targeting government institutions in Central Asia for cyber espionage. The first instance of the malware was discovered in 2022 during a highly targeted attack aimed at exfiltrating data from Kazakhstan's foreign government institutions. Another attack was observed by researchers in Afghanistan. Bitdefender noted that the involved domain and IP addresses do not appear in any previously documented incidents, and the malware does not share code similarities with previously identified malware. Researchers believe that a state-sponsored group is responsible for these incidents based on the specific targets of the attacks, the document metadata that impersonates a real diplomat, and the primary focus on data exfiltration. Although the attacks have not been attributed to any specific threat actor, a Russian group is likely responsible for the attacks. Bitdefender said that the use of a cracked version of Microsoft Office 2016 prevalent in Russian-speaking countries is an indication of the attack's origin, adding that it is unusual to see the same backdoor written in two languages. This was previously observed with the Russian-based group APT28 and their backdoor Zebrocy. This article continues to discuss the new DownEx malware campaign.

    CSO Online reports "New DownEx Malware Campaign Targets Central Asia"

  • news

    Visible to the public "Toyota: Data on More Than 2 Million Vehicles in Japan Were at Risk in Decade-Long Breach"

    A decade-long data breach in Toyota's online service put information on more than 2 million vehicles at risk, the Japanese automaker announced. The problem with Toyota's cloud-based Connected service is limited to vehicles in Japan. According to Toyota, the problem spans from January 2012 to April 2023. The Connected service notifies owners to schedule maintenance checks, provides connections to streaming entertainment, and offers assistance in the event of an emergency. For example, it can call for help after an accident and locate a stolen vehicle. There is no evidence that any information was leaked, copied, or misused as a result of the breach. However, the vehicle identification number, which is different from the license plate, the location of the vehicle and the time it was there, as well as video footage captured by the vehicle, are at risk. This article continues to discuss the decade-long Toyota breach.

    AP reports "Toyota: Data on More Than 2 Million Vehicles in Japan Were at Risk in Decade-Long Breach"

  • news

    Visible to the public "Virginia Tech, George Mason University Partner to Develop Networking Infrastructure for Satellite Constellations"

    The National Science Foundation (NSF) has awarded $2 million to Virginia Tech and George Mason University to develop distributed, mobile space and terrestrial networking infrastructure for multi-constellation coexistence. This work will be done through the agency's Computer and Information Science and Engineering Community Research Infrastructure (CCRI) program. Through developing the fundamental infrastructure and implementing cybersecurity protocols, the researchers hope to demonstrate the value and practicality of an open-source inter-constellation network with global benefits. The team will investigate software vulnerabilities and the physical security of satellites, ground stations, and more in order to ensure that future space communications remain secure from hacking or cyber threats. This article continues to discuss Virginia Tech and George Mason University teaming up to develop an open-source cyber-infrastructure and new space-based networking technology, and what they will do to bolster cybersecurity.

    Virginia Tech reports "Virginia Tech, George Mason University Partner to Develop Networking Infrastructure for Satellite Constellations"

  • news

    Visible to the public "A Massive Data Breach Has Left Intel Scrambling For Solutions"

    A security breach in March robbed MSI of up to 1.5TB of sensitive data. However, MSI is not the only company impacted. As a result of the breach, Intel is now investigating a major leak of Intel Boot Guard keys. The extent of the damage is still unclear, but the worst-case scenario is that the security feature is now useless on compromised devices. This whole fiasco seems to have begun with the MSI data breach that took place earlier this year. Intel Boot Guard prevents the loading of malicious firmware on Intel hardware. The fact that it's now compromised makes this as much Intel's problem as it is MSI's. According to Alex Matrosov, the CEO of Binarly, a security platform, if threat actors gain access to these keys, they might be able to create powerful malware that's capable of bypassing Intel's security measures. Matrosov claims that Intel Boot Guard may now be ineffective on some of Intel's best processors, including Tiger Lake, Alder Lake, and Raptor Lake chips running on MSI-based devices. In a statement to Bleeping Computer, Intel said: "Intel is aware of these reports and actively investigating. There have been researcher claims that private signing keys are included in the data, including MSI OEM Signing Keys for Intel BootGuard. It should be noted that Intel BootGuard OEM keys are generated by the system manufacturer, and these are not Intel signing keys." We'll have to wait for Intel and MSI to share more information on the data breach in order to know what happens next.

    Digital Trends reports: "A Massive Data Breach Has Left Intel Scrambling For Solutions"

  • news

    Visible to the public "The Internet of Things: Fire Sleuth, Fire Starter"

    A new study identifies multiple challenges associated with relying on Internet of Things (IoT) devices during investigations. Many IoT devices, for example, lack security controls. A determined adversary can configure IoT devices to generate a false narrative that can conceal their activities and complicate forensic investigations. Instead of considering IoT data as the gold standard, it is essential to corroborate them with physical evidence from fire or crime scenes and to promote stronger security controls in IoT smart home devices. Overall, research should not only concentrate on ensuring the security and reliability of IoT devices but also on preventing the misuse of data. This article continues to discuss the use of IoT devices in investigations and the associated privacy and security challenges.

    IEEE Spectrum reports "The Internet of Things: Fire Sleuth, Fire Starter"

  • news

    Visible to the public "Manufacturers Targeted as Ransomware Victim Numbers Spike 27%"

    Security researchers at GuidePoint Security have discovered that the number of ransomware victims appearing on data leak sites surged by 27% year-on-year (YoY) in April to 354, with manufacturing the most impacted industry. The researchers noted that the data was compiled from an analysis of 24 ransomware leak sites, so the real figure for victims could be many times greater, considering many victims choose to pay and, therefore, will not be featured on such sites. However, on those analyzed sites, a fifth (19%) of victims were manufacturing companies. The researchers stated that while victim volumes declined 22% between March and April this year, they increased 46% in the manufacturing sector. LockBit was once again the most prolific group, accounting for 31% of victims on leak sites in April, followed by Alphv (14%). Overall, however, the ransomware industry is increasingly characterized by a large number of smaller groups. The researchers stated that they observed a diverse slate of active threat groups in April 2023, with 27 unique groups.

    Infosecurity reports: "Manufacturers Targeted as Ransomware Victim Numbers Spike 27%"

  • news

    Visible to the public "Software Supply Chain Attacks Hit 61% of Firms"

    Security researchers at Capterra have discovered that more than three-fifths (61%) of US businesses have been directly impacted by a software supply chain threat over the past year. The researchers polled 271 IT and IT security professionals to better understand the risk exposure of US companies to vulnerabilities in third-party software. Half of the respondents rated the software supply chain threat as "high" or "extreme," with another 41% claiming the risk is moderate. The researchers pointed to open source software as a key source of supply chain risk. It is now used by 94% of US companies in some form, with over half (57%) using multiple open source platforms. The researchers claimed that app sprawl is contributing to cyber risk, revealing that retailers that have experienced a cyberattack in the past two years are more than twice as likely to report being impacted by app sprawl as those that did not experience an attack (53% versus 22%). Alongside reducing app sprawl, the researchers recommended organizations request a software bill of materials (SBOM) from vendors and open source providers so that they can better track individual components. Yet only half (49%) of respondents are doing so currently.

    Infosecurity reports: "Software Supply Chain Attacks Hit 61% of Firms"

  • news

    Visible to the public "A Flaw in the Essential 'Addons for Elementor' WordPress Plugin Poses 1M Sites at Risk of Hacking"

    The Essential Addons for Elementor WordPress plugin is a compilation of more than 90 creative elements and extensions that enable administrators to enhance the Elementor page-building experience. There are over one million active installations of the plugin. PatchStack researchers discovered that the plugin has an unauthenticated privilege escalation flaw, tracked as CVE-2023-32243, that could enable remote attackers to gain administrator privileges on a website. The vulnerability exists in the password reset functionality of the plugin and affects versions 5.4.0 to 5.7.1. By exploiting this vulnerability, it is possible to reset the password of any user as long as they know their username, thus allowing them to reset the administrator's password and log in to their account. This vulnerability exists because this password reset function does not validate a password reset key before changing the given user's password. Attackers can use the vulnerability to seize control of a website and use it for malicious purposes, such as malware distribution or traffic redirection. This article continues to discuss the unauthenticated privilege escalation flaw in the popular Essential Addons for Elementor WordPress plugin impacting over one million websites.

    Security Affairs reports "A Flaw in the Essential 'Addons for Elementor' WordPress Plugin Poses 1M Sites at Risk of Hacking"

  • news

    Visible to the public "New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe"

    An Advanced Persistent Threat (APT) actor called Red Stinger has been targeting Eastern Europe. Malwarebytes disclosed that the APT's targets included military, transportation, and critical infrastructure entities, as well as those involved in the September East Ukraine referendums. The attackers have been able to exfiltrate snapshots, USB drives, keyboard strokes, and microphone recordings, depending on the campaign. Red Stinger overlaps with a threat cluster known as Bad Magic that targeted Donetsk, Lugansk, and Crimea-based government, agriculture, and transportation organizations in April. Although there were signs that the APT group may have been active since at least September 2021, the most recent findings from Malwarebytes put the group's first operation in December 2020. Throughout the years, the attack chain has used malicious installer files to install the DBoxShell, also known as PowerMagic, implant on compromised systems. The MSI file is downloaded using a Windows shortcut file that is contained within a ZIP archive. It has been observed that subsequent waves detected in April and September 2021 use similar attack sequences, with slight variations in the MSI file names. According to security researchers, DBoxShell is malware that uses cloud storage services as a command-and-control (C2) mechanism. This article continues to discuss researchers' findings regarding the Red Stinger APT group.

    THN reports "New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe"