Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Facebook grant scams ...

 Threats

Facebook is offering $100 million in cash grants to businesses affected by the coronavirus pandemic. Eligible applicants can receive a grant worth about $3,300, announced the company’s official blog, and, picked up by major media outlets, the news quickly spread. Unsurprisingly, cybercriminals wasted no time   show more ...  

hatching schemes to exploit this largesse. Knowing many had heard about the grants but banking on few having absorbed the details, cybercriminals presented the news as if Facebook was handing out money to all users of the social network affected by COVID-19. The bait Potential victims see an article seemingly from CNBC, a world leader in business news with a monthly audience in the hundreds of millions, saying Facebook is giving grants to users hit by COVID-19 and including a link to apply for a grant. The grammar should give away the game, and the URL, which does not start with cnbc.com, is another suspicious element. Those who turn a blind eye to the clumsy English and wrong URL are taken to another portal that bears more than a striking resemblance to the official site of Mercy Corps, a charity that helps victims of natural disasters and armed conflicts. However, the only topic on this one is Facebook grants, and the victim is asked to specify how many years they have been a user of the social network. The grammar on the website still stinks, and most of the links don’t work. It’s especially sad the that job announcement for the Facebook Grant CEO position is also unclickable — perhaps it could have been someone’s chance to land a job with a decent paycheck! And, of course, the site URL does not contain facebook.com, so it clearly has nothing to do with Facebook. If you persist in ignoring the blatant oddities and decide to apply, first you’ll be asked for your Facebook username and password. If you enter them, they’ll go straight to the cybercriminals. Then, to accept your application, the site requires a lot more information, supposedly to verify your account: your address, social security number (for US citizens), and even a scan of both sides of your ID. No fields can be left blank, and the site diligently prompts you about any omissions. When the form is filled out and submitted, the site displays a confirmation message that your application has been accepted and you will be contacted shortly. Don’t hold your breath. The verification procedure is simply a ruse to gain access to your Facebook account, which the cybercriminals can then use to try to trick your friends and extract money from them. Moreover, the form fields provide the crooks with enough personal information to steal your identity. Armed with this and scans of your documents, they will likely be able to get into any of your accounts, including online banking. The real CNBC site does indeed have an article about Facebook grants, but for businesses — the real beneficiaries of the program. And it was written by someone with a better grasp of the English language. As for the fake CNBC news, its only purpose is to fool you into believing that Facebook is now a charity for its users. How to avoid getting phished To keep safe from phishing, you need, first, vigilance and, second, a reliable security solution that won’t let you anywhere near phishing sites. And although the latter is straightforward (simply install the solution and you’re done), staying vigilant at all times requires a bit of effort: Look carefully at the URLs of the sites that you visit. If just one letter looks out of place, or if the usual .com has been replaced with .com.tk or something along those lines, your gut should tell you it’s phishing. Never enter personal information on such a site. Pay attention to grammar and layout. If something smells phishy, it probably is. Be naturally wary of any forms that want personal information. If you are asked for a passport scan, triple-check that you really are on the official site — and even if you are, think again about if the offer is really worth sending such sensitive data.

 Trends, Reports, Analysis

A data breach at Town Sports International affected almost a terabyte of sensitive customer data. In another incident, ArbiterSports paid off hackers to delete the stolen details of 540,000 referees.

 Expert Blogs and Opinion

In an environment where very limited transparency on the root cause and the true impact is afforded, we are left with isolated examples to point to the direct cost of a security incident.

 Malware and Vulnerabilities

ThreatFabric reported a new strain of Android malware called Alien that can steal credentials from 226 apps including Facebook, Gmail, Snapchat, and several popular banking apps.

 Identity Theft, Fraud, Scams

While some cybercriminals are attempting to break into Trump and Biden campaign systems, others are working to leverage those political brands to attack U.S. organizations and their employees.

 Malware and Vulnerabilities

Twitter last week started sending emails to developers to inform them of a vulnerability that might have resulted in the disclosure of developer information, including API keys.

 Breaches and Incidents

Georgia Tech and the WHO have apparently removed the files uploaded by the hacker, but the files are still present on the UNESCO and the Cuban government websites at the time of writing.

 Feed

This Metasploit module exploits an arbitrary file upload vulnerability in MaraCMS versions 7.5 and below in order to execute arbitrary commands. The module first attempts to authenticate to MaraCMS. It then tries to upload a malicious PHP file to the web root via an HTTP POST request to codebase/handler.php. If the   show more ...  

php target is selected, the payload is embedded in the uploaded file and the module attempts to execute the payload via an HTTP GET request to this file. For the linux and windows targets, the module uploads a simple PHP web shell. Subsequently, it leverages the CmdStager mixin to deliver the final payload via a series of HTTP GET requests to the PHP web shell. Valid credentials for a MaraCMS admin or manager account are required. This module has been successfully tested against MaraCMS 7.5 running on Windows Server 2012 (XAMPP server).

 Feed

This is a Linux/portable port of OpenBSD's excellent OpenSSH. OpenSSH is based on the last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms removed, all known security bugs fixed, new features reintroduced, and many other clean-ups.

 Feed

Ubuntu Security Notice 3968-3 - USN-3968-1 fixed several vulnerabilities in Sudo. This update provides the corresponding update for Ubuntu 14.04 ESM. Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use this issue to bypass configured restrictions and execute arbitrary commands. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4546-1 - Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, conduct cross-site scripting attacks, spoof the site displayed in the download dialog, or execute arbitrary code.

 Feed

Ubuntu Security Notice 4545-1 - It was discovered that libquicktime incorrectly handled certain malformed MP4 files. If a user were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause a denial of service. It was discovered that libquicktime incorrectly handled certain   show more ...  

malformed MP4 files. If a user were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause libquicktime to crash, resulting in a denial of service. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4541-1 - Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars discovered that Gnuplot did not properly validate string sizes in the df_generate_ascii_array_entry function. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in a denial of service   show more ...  

attack or arbitrary code execution. Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars discovered that Gnuplot did not properly validate string sizes in the PS_options function when the Gnuplot postscript terminal is used as a backend. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service attack or arbitrary code execution. Various other issues were also addressed.

 Feed

Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.

 Feed

Ubuntu Security Notice 4554-1 - It was discovered that libPGF lacked proper validation when opening a specially crafted PGF file. An attacker could possibly use this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 4553-1 - It was discovered that Teeworlds server did not properly handler certain network traffic. A remote, unauthenticated attacker could use this vulnerability to cause Teeworlds server to crash.

 Feed

Ubuntu Security Notice 4552-1 - Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as root.

 Feed

Ubuntu Security Notice 4550-1 - Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An attacker inside a guest could use these issues to perform multiple attacks, including denial of service attacks, obtaining sensitive information from the host, and possibly executing arbitrary code on the host.

 Feed

Ubuntu Security Notice 4551-1 - Alex Rousskov and Amit Klein discovered that Squid incorrectly handled certain Content-Length headers. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. Amit Klein discovered that Squid incorrectly validated   show more ...  

certain data. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4547-1 - It was discovered that an information disclosure vulnerability existed in the LibVNCServer vendored in iTALC when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. It was discovered that the LibVNCServer and LibVNCClient vendored   show more ...  

in iTALC incorrectly handled certain packet lengths. A remote attacker could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4548-1 - It was discovered that libuv incorrectly handled certain paths. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

 Feed

Ubuntu Security Notice 4549-1 - It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact.

 Feed

Cybersecurity researchers uncovered fresh evidence of an ongoing cyberespionage campaign against Indian defense units and armed forces personnel at least since 2019 with an aim to steal sensitive information. Dubbed "Operation SideCopy" by Indian cybersecurity firm Quick Heal, the attacks have been attributed to an advanced persistent threat (APT) group that has successfully managed to stay

 Feed

What is the difference between a penetration test and a red team exercise? The common understanding is that a red team exercise is a pen-test on steroids, but what does that mean? While both programs are performed by ethical hackers, whether they are in-house residents or contracted externally, the difference runs deeper. In a nutshell, a pen-test is performed to discover exploitable

 Privacy

The Coronavirus pandemic has pretty much killed off office romances, and the chances of a snog in the stationery cupboard, but now at least one firm might be pooping over romance outside of the workplace as well. Do you think relationships outside the office should be vetted for whether they pose a cybersecurity threat?

 Feed only

Many thanks to the great folks at Recorded Future, who have sponsored my writing for the past week. Recorded Future empowers your organization, revealing unknown threats before they impact your business, and helping your teams respond to alerts 10 times faster. How does it do this? By automatically collecting and   show more ...  

analyzing intelligence from technical, open … Continue reading "Elite security intelligence at zero cost – use Recorded Future Express… for FREE!"

 Business + Partners

Reading Time: ~ 2 min. “Ten years ago, you didn’t see state actors attacking [small businesses]. But it’s happening now,” warns George Anderson, product marketing director at Carbonite + Webroot, OpenText companies. Sadly, many of today’s managed service providers who serve small and medium-sized businesses   show more ...  

now have to concern themselves with these very threats. Independent and state-sponsored hacking groups use sophisticated hacking tools (advanced persistent threats or APTs), to gain unauthorized access to networks and computers, often going undetected for months or even years at a time. In fact, according to the 2020 Verizon Data Breach Investigations Report, cyber-espionage is among the top patterns associated with breaches targeting businesses worldwide. These attacks can be difficult even for highly sophisticated enterprise security teams to detect, stop or recover from. But all businesses, no matter their size, must be ready for them. As such, MSPs, themselves ranging in size from a few techs to a few hundred professionals, may find they need help protecting their SMB customers from APTs; that’s on top of the consistent onslaught of threats from ordinary, profit-motivated cyberattackers. That’s where the concept of cyber resilience comes in. What does cyber resilience look like? “Being [cyber] resilient – knowing that even if you’re knocked offline you can recover quickly – is essential for today’s businesses,” George says. The reality is that today’s organizations have to accept a breach is pretty much inevitable. Their level of cyber resilience is the measure of the organization’s ability to keep the business running and get back to normal quickly. “It’s being able to absorb punches and get back on your feet, no matter what threatens,” as George put it in a recent podcast with Joe Panettieri, co-founder MSSP Alert & ChannelE2E. Read more about how businesses can build a cyber resilient company culture. How can businesses and MSPs achieve cyber resilience? Because cyber resilience is about both defending against attacks and preparing for their inescapability,  a major component in a strong resilience strategy is the breadth of coverage a business has. In particular, having tested and proven backup and disaster recovery solutions in place is the first step in surviving a breach. If a business has reliable, real-time (or near real-time) recovery capabilities, then in the event of an attack, they could make it through barely skipping a beat. Now, George has clarified that “no single solution can offer complete immunity against cyberattacks on its own.” To reduce the risk of events like data loss from accidental deletion, device theft or hardware failure, your clients need multiple layers of protection that secure their devices and data from multiple angles. Here are George’s top data protection tips: All data must be continuously backed up and available.Data stored within collaboration tools, such as Microsoft® Teams or SharePoint, should be backed up too.A full cyber resilience strategy should include cybersecurity and threat prevention features, network protection and end user education, in addition to backup and recovery solutions.Choose vendors who are known within the channel for their easy management, integrations with RMMs and/or their reputation with your fellow MSPs. Ultimately, George says ensuring business continuity for MSPs and the businesses they serve through comprehensive cyber resilience solutions is the primary goal of the Carbonite + Webroot division of OpenText. “We want to up the advocacy and stop attacks from happening as much as we possibly can.  At  the  same time, when they inevitably do happen, we want to be able to help MSPs recover and limit lost time, reputation damage, and financial impact so businesses can keep functioning.” To learn more about cyber resilience, click here. The post Cyber Resilience for Business Continuity appeared first on Webroot Blog.

2020-09
Aggregator history
Monday, September 28
TUE
WED
THU
FRI
SAT
SUN
MON
SeptemberOctoberNovember