C410 A2BE CB73 EF77 746E 9682 E2C4 91CE D20D 800F

Infosec bits for week 06/21

2021-02-12 13:51 - Roderick Mooi

Higher Education
- SU data breach exposes nearly 10,000 names, Social Security numbers [Michael Sessa, The Daily Orange]
  - See also: Personal information of CU students, employees may have been compromised in cyberattack
Critical Infrastructure
- What’s most interesting about the Florida water system hack? That we heard about it at all. [Krebs on Security]
  - See also: Breached water plant employees used the same TeamViewer password and no firewall
- Eletrobras, Copel energy companies hit by ransomware attacks [Ionut Ilascu, Bleeping Computer]
Suppy Chain
- Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies [Alex Birsan, Medium]
Cloud
- Secure Service Configuration in AWS, Azure, & GCP [Brandon Evans & Eric Johnson, SANS Institute]
  - See also: Multiple Clouds Require Multiple Solutions: AWS, Azure, & GCP – SANS @Mic
Patch Tuesday
- Microsoft February 2021 Patch Tuesday fixes 56 flaws, 1 zero-day [Lawrence Abrams, Bleeping Computer]
- Swarm of Palo Alto PAN-OS vulnerabilities [Mikhail Klyuchnikov and Nikita Abramov, PT SWARM / Positive Technologies Offensive Team]
Other
- CD Projekt Red refuses to negotiate with hackers who stole Witcher 3 and Cyberpunk 2077 source code [Darryn Bonthuys, Critical Hits]
- Police seize $60 million of bitcoin! Now, where’s the password? [John O’Donnell, Reuters]
- Web shell attacks continue to rise [Microsoft]
- That Slack email you just got asking to reset your password is legit, not a scam [Ryne Hager, Android Police]
- Ransomware Attackers Set Their Sights on SaaS [Kelly Sheridan, Dark Reading / Informa Tech]
- Instagram Unmasks High Profile ‘OG’ Account Stealers, Threatens to Sue [Joseph Cox, Motherboard by Vice]

Contact Us:	csirt { a } sanren.ac.za

PGP Keys:
CSIRT		0xE2C491CED20D800F
Renier		0x11A7B70A4B81468E
Kgwadi		0x9FF01A35A5726937
Sicelo		0xA6CCD44FD770057B
Heloise		0x96371C4C9FA23CAC
Maajied		0xEE9BE86AD16D89C2