C410 A2BE CB73 EF77 746E 9682 E2C4 91CE D20D 800F

Infosec bits for week 23/21

2021-06-11 11:42 - Roderick Mooi

Ransomware
- Alert: Further ransomware attacks on the UK education sector by cyber criminals [National Cyber Security Centre, UK]
- Ransomware-skewered meat producer JBS confesses to paying $11m for its freedom [Simon Sharwood, The Register]
- Ransomware – Do You Pay It Or Not? – Experts debate the costs and ethics surrounding ransomware payments [Jake Williams et al, SANS]
- How A New Team Of Feds Hacked The Hackers And Got Colonial Pipeline’s Ransom Back [Vanessa Romo, NPR]
  - See also: Pipeline Investigation Upends Idea That Bitcoin Is Untraceable
Patch Week
- Microsoft June 2021 Patch Tuesday: 50 vulnerabilities patched, six zero-days exploited in the wild [Charlie Osborne, Zero Day]
- New Chrome 0-Day Bug Under Active Attacks – Update Your Browser ASAP! [Ravie Lakshmanan, The Hacker News]
- Joomla Content System Vulnerable to Multiple Flaws [Akshaya Asokan, Information Security Media Group]
MFA / best practices
- 6 minimum security practices to implement before working on best practices [CSO / IDG Communications]
- Required MFA Is Not Sufficient for Strong Security: Report [Robert Lemos, Dark Reading/ Informa PLC]
- Best Defense? Our Red Team Lead Reveals 4 MFA Bypass Techniques [Shay Nahari, CyberArk]
Cloud Security
- The shared responsibility model explained and what it means for cloud security [Chris Hughes, CSO / IDG Communications]
- Confidential Computing: The Future of Cloud Computing Security [David Bisson, Security Intelligence]
Fun and Games
- How to Negotiate with Ransomware Hackers [Rachel Monroe, The New Yorker]
- Building a WebAuthn Click Farm — Are CAPTCHAs Obsolete? [Luke Young, better appsec / Medium]
Other news of interest
- Apple will not launch feature to hide online identity in South Africa or China [Jan Vermeulen, MyBroadband]
- How One Fastly Customer Broke the Internet [Shoshana Wodinsky, Gizmodo]
- Hackers can exploit bugs in Samsung pre-installed apps to spy on users [Ionut Ilascu, Bleeping Computer]
- Australian Federal Police and FBI nab criminal underworld figures in worldwide sting using encrypted app [Alison Xiao, ABC NEWS]
- Ransomware Is Not the Problem [Adam Shostack, Dark Reading/ Informa PLC]

Contact Us:	csirt { a } sanren.ac.za

PGP Keys:
CSIRT		0xE2C491CED20D800F
Renier		0x11A7B70A4B81468E
Kgwadi		0x9FF01A35A5726937
Sicelo		0xA6CCD44FD770057B
Heloise		0x96371C4C9FA23CAC
Maajied		0xEE9BE86AD16D89C2