Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Targeted cyberthreat ...

 Business

Some professions are simply more susceptible to cyberattacks than others, regardless of the type of business. Today, we’re focusing on the cyberthreats aimed at professionals who work in human resources. The simplest, but far from the only, reason is that HR employees’ e-mail addresses are published on   show more ...  

corporate sites for purposes of recruitment — they’re easy to find. Cyberthreats targeting HR In human resources, employees occupy a rather unusual position: They receive mountains of correspondence from outside the company, but they also tend to have access to personal data that the company cannot afford to leak. Incoming mail Typically, cybercriminals penetrate the corporate security perimeter by sending an employee an e-mail containing a malicious attachment or link. That’s why we always advise readers not to open suspicious e-mails with attachments or click on links sent by unknown individuals. For an HR professional, that advice would be ridiculous. The majority of external e-mails they get are likely to be from strangers, and many include an attachment with a résumé (and sometimes a link to sample work). As a guess, we’d say at least half of them look suspicious. Moreover, portfolios or samples of past work sometimes come in uncommon formats, such as highly specialized CAD program files. The very nature of the job requires HR employees to open and review the contents of such files. Even if we forget for the moment that cybercriminals sometimes disguise a file’s true purpose by altering the file extension (is it a CAD file, RAW photos, a DOC, an EXE?), not all such programs are kept up to date, and not all have been thoroughly tested for vulnerabilities. Experts often find security holes that allow arbitrary code execution even in widespread, regularly analyzed software, such as Microsoft Office. Access to personal data Large companies might have a variety of specialists responsible for communication with job seekers and for work with current employees, but small businesses are more likely to have just one HR rep for all occasions. That one person most likely has access to all personnel data held by the company. However, if you’re looking to cause trouble, compromising just the HR specialist’s mailbox usually does the trick. Applicants who send résumés might explicitly or tacitly give a company permission to process and store their personal data, but they’re definitely not agreeing to hand it over to unknown outsiders. Cybercriminals can leverage access to such information for blackmail. And on the topic of extortion, we also must consider ransomware. Before depriving the owner of access to data, the latest strains often steal it first. If that sort of malware lands on an HR computer, the thieves can hit a personal data jackpot. A foothold for more convincing BEC attacks Relying on credulous or uneducated employees to make mistakes is risky. The more difficult but more effective business e-mail compromise (BEС) attack is now a major player. Attacks of this type often aim to seize control of an employee’s mailbox and convince their colleagues to transfer funds or forward confidential information. To ensure success, cybercriminals need to hijack the mail account of someone whose instructions will probably be followed — most often, an executive. The active phase of the operation is preceded by the long and painstaking task of finding a suitably high-ranking employee. And here, an HR mailbox may come in very handy indeed. On the one hand, as mentioned above, it is easier to get HR to open a phishing e-mail or link. On the other hand, company employees are likely to trust an e-mail from human resources. HR regularly sends applicants’ résumés to department heads. Of course, HR also sends internal documents to the company at large. That makes a hijacked HR mail account an effective platform for launching a BEС attack and for lateral movement across the corporate network. How to protect HR computers To minimize the likelihood of intruders penetrating the HR department’s computers, we recommend following these tips: Isolate HR computers on a separate subnet if possible, minimizing the likelihood of threat spread to the corporate network even in the event that one computer gets compromised; Do not store personally identifiable information on workstations. Instead, keep it on a separate server or, better yet, in a system made for such information and protected with multifactor authentication; Heed HR professionals’ advice regarding cybersecurity awareness training for the company — and place them first in line for that training; Urge HR reps to pay close attention to the formats of files sent by applicants. Recruiters should be able to spot an executable file and know not to run it. Ideally, work together to draw up a list of acceptable file formats for résumés and work samples, and include that information in listings for bona fide applicants. Last but by no means least, adhere to basic security practices: Update software on HR computers in a timely manner, maintain a strict and easy-to-follow password policy (no weak or duplicate passwords for internal resources; change all passwords regularly), and on every machine install a security solution that responds promptly to new threats and identifies attempts to exploit vulnerabilities in software.

 Malware and Vulnerabilities

The TeamTNT cybercrime group is known for cloud-based attacks, including targeting Amazon Web Services (AWS) credentials in order to break into the cloud and use it to mine the Monero cryptocurrency.

 Trends, Reports, Analysis

An Infoblox report reveals a disruptive year of workforce transformation forced by COVID-19 shutdowns during which respondents also handled expensive fallouts from network outages and data breaches.

 Malware and Vulnerabilities

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

 Identity Theft, Fraud, Scams

The FTC issued a unique consumer alert this week, warning that scammers pretending to be the U.S. regulatory agency have been attempting to bilk the public out of their bank accounts and life savings.

 Trends, Reports, Analysis

The number of distributed denial-of-service attacks launched in 2020 surpassed 10 million, up from 8.5 million in 2019, according to NetScout's Atlas Security Engineering and Response Team.

 Trends, Reports, Analysis

Breaches and leaks of sensitive information from organizations doubled last year, even as consumer concerns over data privacy surged, according to two new reports published on Data Protection Day.

 Malware and Vulnerabilities

Although Microsoft deemed the bug “very difficult” to exploit and therefore only fixed it in Windows 8, researcher Adam Zabrocki says that he was able to rework the attack for use against Windows 7.

 Malware and Vulnerabilities

The code, its execution, the ways the operators communicate with victims and the threats to the stolen data have been labeled “unprofessional.” This does not mean that the malware is harmless.

 Feed

This Metasploit module exploits an authenticated remote code execution vulnerability in PRTG Network Monitor. Notifications can be created by an authenticated user and can execute scripts when triggered. Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command   show more ...  

allowing command execution under the context of privileged user. The module uses provided credentials to log in to the web interface, then creates and triggers a malicious notification to perform remote code execution using a Powershell payload. It may require a few tries to get a shell because notifications are queued up on the server. This vulnerability affects versions prior to 18.2.39.

 Feed

This Metasploit module exploits two vulnerabilities, that when chained allow an attacker to achieve unauthenticated remote code execution in Micro Focus UCMDB. UCMDB included in versions 2020.05 and below of Operations Bridge Manager are affected, but this module can probably also be used to exploit Operations Bridge Manager (containerized) and Application Performance Management.

 Feed

Ubuntu Security Notice 4706-1 - Olle Segerdahl found that ceph-mon and ceph-mgr daemons did not properly restrict access, resulting in gaining access to unauthorized resources. An authenticated user could use this vulnerability to modify the configuration and possibly conduct further attacks. Adam Mohammed found that   show more ...  

Ceph Object Gateway was vulnerable to HTTP header injection via a CORS ExposeHeader tag. An attacker could use this to gain access or cause a crash. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4707-1 - It was discovered that TCMU lacked a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request.

 Feed

Ubuntu Security Notice 4712-1 - USN-4576-1 fixed a vulnerability in the overlay file system implementation in the Linux kernel. Unfortunately, that fix introduced a regression that could incorrectly deny access to overlay files in some situations. This update fixes the problem.

 Feed

Ubuntu Security Notice 4713-1 - It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify data.

 Feed

Ubuntu Security Notice 4711-1 - It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify   show more ...  

data. Kiyin discovered that the perf subsystem in the Linux kernel did not properly deallocate memory in some situations. A privileged attacker could use this to cause a denial of service. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4710-1 - Kiyin discovered that the perf subsystem in the Linux kernel did not properly deallocate memory in some situations. A privileged attacker could use this to cause a denial of service.

 Feed

Red Hat Security Advisory 2021-0290-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.7.0 ESR. Issues addressed include an information leakage vulnerability.

 Feed

Red Hat Security Advisory 2021-0289-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.7.0 ESR. Issues addressed include an information leakage vulnerability.

 Feed

Red Hat Security Advisory 2021-0288-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.7.0 ESR. Issues addressed include an information leakage vulnerability.

 Feed

Ubuntu Security Notice 4709-1 - It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify   show more ...  

data. Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4708-1 - Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service. It was discovered that the btrfs file system   show more ...  

implementation in the Linux kernel did not properly validate file system metadata in some situations. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service. Various other issues were also addressed.

 Feed

Red Hat Security Advisory 2021-0285-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.7.0 ESR. Issues addressed include an information leakage vulnerability.

 Feed

Ubuntu Security Notice 4705-2 - USN-4705-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain unintended access to the administrator account. Various other issues were also addressed.

 Feed

Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.

 Feed

U.S. and Bulgarian authorities this week took control of the dark web site used by the NetWalker ransomware cybercrime group to publish data stolen from its victims. "We are striking back against the growing threat of ransomware by not only bringing criminal charges against the responsible actors, but also disrupting criminal online infrastructure and, wherever possible, recovering ransom

 Feed

Law enforcement agencies from as many as eight countries dismantled the infrastructure of Emotet, a notorious email-based Windows malware behind several botnet-driven spam campaigns and ransomware attacks over the past decade. The coordinated takedown of the botnet on Tuesday — dubbed "Operation Ladybird" — is the result of a joint effort between authorities in the Netherlands, Germany, the U.S.

 Feed

Researchers have disclosed a new family of Android malware that abuses accessibility services in the device to hijack user credentials and record audio and video. Dubbed "Oscorp" by Italy's CERT-AGID, the malware "induce(s) the user to install an accessibility service with which [the attackers] can read what is present and what is typed on the screen." So named because of the title of the login

 Google

Google warns security researchers that North Korean hackers are pretending to be their buddies, sensitive information connected to Coronavirus testing is available for sale in the Netherlands, and is a Peeping Tom at your home security provider spying on you through CCTV? All this and much more is discussed in the   show more ...  

latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Maria Varmazis.

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Orca Security. Thanks to the great team there for their support! You’re probably familiar with the shared responsibility model. The basic idea is that public cloud providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud   show more ...  

Platform keep their platforms secure, … Continue reading "How do most cloud security breaches happen? Orca’s “State of Public Cloud Security” report reveals all"

 Botnet

Law enforcement agencies across the globe say that they have dealt a blow against Emotet, described by Interpol as "the world's most dangerous malware", by taking control of its infrastructure. Read more in my article on the Tripwire State of Security blog.

2021-01
Aggregator history
Thursday, January 28
FRI
SAT
SUN
MON
TUE
WED
THU
JanuaryFebruaryMarch