Infosec bits for 2023 week 7

Renier van Heerden

2023-02-17 19:32

Ransomeware
- Ransomware gang uses new zero-day to steal data on 1 million patients [Carly Page, TechCrunch]
- City of Oakland declares state of emergency after ransomware attack [Sergiu Gatlan, BleepingComputer]
- Ransomware Attacks on Industrial Firms Increased by 87percent in 2022 [Jack Gillum, Bloomberg]
- Cryptocurrency users in the US hit by ransomware and Clipper malware [Cedric Pernet, TechRepublic]
Hacks
- FBI confirms it’s investigating a cyber incident on its own network [Carly Page, TechCrunch]
- Microsoft Exchange ProxyShell flaws exploited in new crypto-mining attack [Bill Toulas, BleepingComputer]
- Researchers unearth Windows backdoor that’s unusually stealthy [Dan Goodin, Arstechnica]
- A researcher tried to buy mental health data. It was surprisingly easy. [Kevin Collier, NBCnews]
Information
- How to manage third-party cybersecurity risks that are too costly to ignore [Jon Siegler, TechCrunch]
- CISA warns of Windows and iOS bugs exploited as zero-days [Sergiu Gatlan, BleepingComputer]
- Microsoft will forcibly remove Internet Explorer from most Windows 10 PCs today [Andrew Cunningham, Arstechnica]
- Hackers are selling a service that bypasses ChatGPT restrictions on malware [Dan Goodin, Arstechnica]
Patch
- Fortinet fixes critical RCE flaws in FortiNAC and FortiWeb [Bill Toulas, BleepingComputer]
- Microsoft February 2023 Patch Tuesday fixes 3 exploited zero-days, 77 flaws [Lawrence Abrams, BleepingComputer]

Infosec bits for 2023 week 6

Kgwadi Matenche

2023-02-10 12:42

Cybersecurity News:
- Google Chrome 110 arrives – but not all Windows PCs will get it [Danny Palmer, ZDNET]
- First Linux variant of Clop ransomware targeted universities, colleges but was flawed [Jonathan Greig, The Record]
Malware:
- ESXiArgs Ransomware Hits Over 3,800 Servers as Hackers Continue Improving Malware [Eduard Kovacs, SecurityWeek]
  - VMware Security Response Center (vSRC) Response to ‘ESXiArgs’ Ransomware Attacks [Edward Hawkins, VMware]
Vulnerabilities & Patches:
- Android’s February 2023 Updates Patch 40 Vulnerabilities [Ionut Arghire, SecurityWeek]
- Actively exploited GoAnywhere MFT zero-day gets emergency patch [Sergiu Gatlan, Bleeping Computer]
- Patch your Jira Service Management Server and Data Center and check for compromise! [Zeljka Zorz, Help Net Security]
Breaches & Leaks:
- Reddit Breached With Stolen Employee Credentials [Dark Reading Staff, Dark Reading]
- All classes canceled at Irish university as it announces ‘significant IT breach’ [Alexander Martin, The Record]
- Mortgage Broker 8Twelve Exposes Data of Canadian Residents [Habiba Rashid, HackRead]
- RSAWeb hit by ransomware attack [Jan Vermeulen, MyBroadband]
Others:
- PayPal and Twitter abused in Turkey relief donation scams [Ax Sharma, Bleeping Computer]
- Lessons Learned on Ransomware Prevention from the Rackspace Attack [Bleeping Computer]

Infosec bits for 2023 week 5

Heloise Meyer

2023-02-03 12:47

Cybersecurity News:
- Massive RSAWeb outage — fibre restored, cloud hosting and mobile still offline [Jan Vermeulen, MyBroadband]
- Hacker finds bug that allowed anyone to bypass Facebook 2FA [Lorenzo Franceschi-Bicchierai, TechCrunch]
- Reality check: Is ChatGPT really the next big cybersecurity threat? [Elias Groll, Cyberscoop]
Malware:
- Ransomware attack on data firm ION could take days to fix -sources [James Pearson, Reuters]
- Royal Mail cyberattack linked to LockBit ransomware operation [Lawrence Abrams, BleepingComputer]
- Titan Stealer: A New Golang-Based Information Stealer Malware Emerges [Ravie Lakshmanan, The Hacker News]
- Hackers weaponize Microsoft Visual Studio add-ins to push malware [Bill Toulas, BleepingComputer]
- Prilex POS malware evolves to block contactless transactions [Cedric Pernet, TechRepublic]
- New HeadCrab malware infects 1,200 Redis servers to mine Monero [Sergiu Gatlan, BleepingComputer]
- New Nevada Ransomware targets Windows and VMware ESXi systems [Bill Toulas, BleepingComputer]
Vulnerabilities:
- Over 29,000 QNAP devices vulnerable to code injection attacks [Sergiu Gatlan, BleepingComputer]
- New High-Severity Vulnerabilities Discovered in Cisco IOx and F5 BIG-IP Products [Ravie Lakshmanan, The Hacker News]
- Atlassian’s Jira Software Found Vulnerable to Critical Authentication Vulnerability [Ravie Lakshmanan, The Hacker News]

Infosec bits for 2023 week 4

Maajied Moos

2023-01-27 15:04

Security news
- Electronic health record giant NextGen dealing with cyberattack [Jonathan Greig, The Record]
- Riot Games hacked, delays game patches after security breach [Sergiu Gatlan, Bleeping Computer]
- Enterprises remain vulnerable through compromised API secrets [Help Net Security, Help Net Security]
- API Security Fundamentals: Everything You Need To Know [PJ Bradley, Tripwire]
- Ohio town working to restore municipal court systems after cyberattack [Jonathan Greig, The Record]
- Security and the Electric Vehicle Charging Infrastructure [Shachar Inbar, Dark Reading]
- Dutch hacker obtained virtually all Austrians’ personal data [Staff Writer, ITNews]
Malware
- Bots Are Now Robocalling to Phish For Your Two-Factor Authentication (2FA) Codes [Neetu Singh, Radware Blog]
- Bitwarden password vaults targeted in Google ads phishing attack [Lawrence Abrams, Bleeping Computer]
Vulnerabilities and Patches
- Around 19,500 end-of-life Cisco routers are exposed to hack [Pierluigi Paganini, Security Affairs]
- Exploits released for two Samsung Galaxy App Store vulnerabilities [Bill Toulas, Bleeping Computer]
- Over 4,500 WordPress Sites Hacked to Redirect Visitors to Sketchy Ad Pages [Ravie Lakshmanan, The Hacker News]
- Lexmark warns of RCE bug affecting 100 printer models, PoC released [Bill Toulas, Bleeping Computer]
- Apple Patches WebKit Code Execution in iPhones, MacBooks [Ryan Naraine, Security Week]

Infosec bits for 2023 week 3

Sicelo Ncekana

2023-01-20 13:51

Security news
- BackdoorDiplomacy APT Uses Turian Backdoor to Target Iranian Government [Cyware, Cyware]
- 37 million T-Mobile customers were hacked [David Goldman, CNN]
- Watch Out For This AnyDesk Phishing Campaign That Delivers Vidar Info Stealer [Abeerah Hashim, LHN]
- PayPal accounts breached in large-scale credential stuffing attack [Bill Toulas, BleepingComputer]
- A Sneaky Ad Scam Tore Through 11 Million Phones [Matt Burgess, Wired]
- LastPass users should move their crypto funds, experts warn [Pieter Arntz, Malwarebytes]
- Google sponsored ads lead to rogue imitation sites [Christopher Boyd, Malwarebytes]
Malware
- Ransomware attack hits nearly 300 fast food restaurants in UK, including KFC and Pizza Hut [Alexander Martin, The record]
- Phishers Use Blank Images to Disguise Malicious Attachments [Phil Muncaster, Info Security]
Vulnerabilities and Patches
- Researcher Finds Class Pollution – A Prototype Pollution Variant Affecting Python [Abeerah Hashim, LHN]
- Microsoft: Windows 11 apps might not start after system restore [Sergiu Gatlan, BleepingComputer]
- WAGO fixes config export flaw threatening data leak from industrial devices [Charlie Osborne, The Daily Swing]
- Drupal Patches Vulnerabilities Leading to Information Disclosure [Ionut Arghire, Scurity Week]
- Vendors Actively Bypass Security Patch for Year-Old Magento Vulnerability [Ionut Arghire, Scurity Week]

Control Web Panel

Renier van Heerden

2023-01-13 11:10

Vulnerability with 9.8 severity in Control Web Panel is under active exploit [Dan Goodin, Arstechnica]
CVE-2022-44877 Detail [NIST]
CVE-2022-44877 Tenable [Tenable]
CVE-2022-44877 Mitre [Mitre]

Infosec bits for 2023 week 2

Renier van Heerden

2023-01-13 10:48

Hacking
- Vulnerability with 9.8 severity in Control Web Panel is under active exploit [Dan Goodin, Arstechnica]
- A government watchdog spent Dollars 15,000 to crack a federal agency’s passwords in minutes [Zack Whittaker, Tech Crunch]
- Here’s how to remotely take over a Ferrari…account, that is [Jessica Lyons Hardcastle, The Register]
- Hackers hit websites of Danish central bank, other banks [Jacob Gronholt-Pedersen and Nikolaj Skydsgaard, Reuters]
- New SHC-compiled Linux malware installs cryptominers, DDoS bots [Bill Toulas, Bleeping Computer]
- Slack’s private GitHub code repositories stolen over holidays [Ax Sharma, Bleeping Computer]
Randsomeware
- Hackers stole data of 460,000 individuals in MFHS ransomware attack [Carly Page, Tech Crunch]
- Rackspace says hackers accessed customer data during ransomware attack [Carly Page, Tech Crunch]
Patches
- Microsoft ends Windows 7 security updates [Zack Whittaker, Tech Crunch]
- Microsoft fixes Windows database connections it broke in November [Jeff Burt, The Register]
- Cisco warns of auth bypass bug with public exploit in EoL routers [Sergiu Gatlan, Bleeping Computer]
Odds
- A corrupt file led to the FAA ground stoppage. It was also found in the backup system [Gregory Wallace and Pete Muntean,, CNN]
- Homeland Security, CISA builds AI-based cybersecurity analytics sandbox [Jeff Burt, The Register]
- GitHub makes it easier to scan your code for vulnerabilities [Sergiu Gatlan, Bleeping Computer]

Infosec bits for week 50/22

Heloise Meyer

2022-12-15 12:16

Hacking News:
- Details of 77,000 Uber employees exposed in hack — Report [Bloomberg, MyBroadband]
- By the way, the Reserve Bank was hacked [Bloomberg, BusinessTech]
- The FBI’s Cybersecurity Program for Critical Infrastructure Was Hacked [Lucas Ropek, Gizmodo]
- Cycling South Africa suspends Zwift racer caught hacking data during world championships qualifier [Dan Alexander, Road.cc]
- Elite Hackers Made Almost $1 Million Last Week, Here’s How [Davey Winder, Forbes]
Vulnerabilities:
- New Actively Exploited Zero-Day Vulnerability Discovered in Apple Products [Ravie Lakshmanan, The Hacker News]
- Fortinet confirms VPN vulnerability exploited in the wild [Arielle Waldman, TechTarget]
- Microsoft December 2022 Patch Tuesday fixes 2 zero-days, 49 flaws [Lawrence Abrams, BleepingComputer]
Malware:
- New Python malware backdoors VMware ESXi servers for remote access [Bill Toulas, BleepingComputer]
- Effective, fast, and unrecoverable: Wiper malware is popping up everywhere [Dan Goodin, Ars Technica]
- New GoTrim Botnet Attempting to Break into WordPress Sites’ Admin Accounts [Ravie Lakshmanan, The Hacker News]
- Clop ransomware uses TrueBot malware for access to networks [Bill Toulas, BleepingComputer]

Infosec bits for week 49/22

Renier van Heerden

2022-12-09 15:32

Hacking
- Cyberattack on top Indian hospital highlights security risk [Aniruddha Ghosal, AP News]
- Samsung Galaxy S22 hacked again on second day of Pwn2Own [Sergiu Gatlan, Bleeping Computer]
- Samsung’s Android app-signing key has leaked, is being used to sign malware [Ron Amadeo, Arstechnica]
- Hacked corporate email accounts used to send MSP remote access tool [Ionut Ilascu, Bleeping Computer]
Cyber Policies
- FBI Calls End-to-End Encryption Deeply Concerning’ as Privacy Groups Hail Apple’s Advanced Data Protection as a Victory for Users [Sami Fathi, Mac Rumors]
- U.S. to spend $1.5 billion to jumpstart alternatives to Huawei [Ina Fried, Axios]
- Governments seek ways to avert quantum’s encryption apocalypse [Sam Sabin, Axios]
Odd News
- Scammers Are Scamming Other Scammers Out of Millions of Dollars [Matt Burgess, Wired]
- Syntax errors are the doom of us all, including botnet authors [Kevin Purdy, Arstechnica]
- Automated dark web markets sell corporate email accounts for 2 dollars [Bill Toulas, Bleeping Computer]
- Here’s Why You Want To Stay Away From Eufy Security Cameras [Rahul Srinivas, SlashGear].

Infosec bits for week 48/22

Sicelo Ncekana

2022-12-02 17:51

Security News
- Postbank loses over R18-million to cybercrime attacks in three months [Marecia Damons, Algoa FM]
- Samsung, LG, Mediatek certificates compromised to sign Android malware [Nitzan Yaakov, Aqua Blog]
- Web browsers drop mysterious company with ties to U.S. military contractor [Joseph Menn, The Washington Post]
- LastPass Suffers Another Security Breach; Exposed Some Customers Information [Ravie Lakshmanan, The Hacker News]
Phishing and Malware
- Vanuatu officials turn to phone books and typewriters, one month after cyber attack [Christopher Cottrell, Tech Guardian]
- Ransomware group may have stolen customer bank details from British water company [Alexander Martin, The Record]
- Samsung, LG, Mediatek certificates compromised to sign Android malware [Sergiu Gatlan, Bleeping Computer]
- Android malware infected 300,000 devices to steal Facebook accounts [Gandalf_The_Grey, Malware Tips]
- New DuckLogs malware service claims having thousands of ‘customers’ [Bill Toulas, Bleeping Computer]
Vulnerabilities & Patches
- CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs [Ravie Lakshmanan, The Hacker News]
- Tailscale VPN nodes vulnerable to DNS rebinding, RCE [Ben Dickson, The Daily Swing]
- Secret Network resolves network vulnerability following white hat disclosure [ZHIYUAN SUN, Cointelegraph]
- Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services [Ravie Lakshmanan, The Hacker News]
- Remote Code Execution Vulnerability Found in Windows Internet Key Exchange [Alessandro Mascellino, Info Security]