Oktacron - Cyber Security RSS Feeds History

It Takes an Average of 205 Days to Fix Critical Cybersecurity Flaws

softpedia Jun 24, 2021 Security

According to a new WhiteHat Security research, more than 66% of all utility programs had at least one exploitable vulnerability exposed on a yearly basis. Many of these vulnerabilities are "pedestrian," meaning they require little effort or skill to discover. The report, titled AppSec Stats Flash, shows that show more ...

utility companies have the widest exposure in their applications vulnerabilities. This underscores an issue that made national headlines last week, namely that more than 50,000 water treatment plants in the United States lack adequate cybersecurity. In addition to an attack on a Florida water treatment plant earlier this year, the study revealed that there had been lots of unreported attacks on utility companies. According to Setu Kulkarni, vice president of WhiteHat Security, more than 66% of apps in the manufacturing business had a 365-day window of exposure. In... (read more)

New ChaChi Trojan Targeting U.S. Schools

softpedia Jun 24, 2021 Security

BlackBerry Threat Research and Intelligence revealed Wednesday that a new ChaChi Trojan is being used as a critical component in executing ransomware operations against government organizations and U.S. schools, says ZDNet. The original version of the Remote Access Trojan (RAT), identified in the first half of 2020, show more ...

was linked to cyberattacks against French local governments, as listed in the Compromise Indicators (IoC) report from CERT France. The FBI has previously warned of a considerate rise in PYSA attacks on schools, both in the United Kingdom and the United States. The new ChaChi has evolved from the earlier variant, that had drawbacks such as poor obfuscation and low-level capabilities. The new malware type is capable of performing traditional RAT actions such as data exfiltration, backdoor creation, and credential dumping from the Wi... (read more)

New Ransomware Uses Virtual Machine to Launch Attacks

softpedia Jun 24, 2021 Security

Cybercriminals are running more and more malicious payloads via Virtual Machines, according to Symantec Threat Hunter Team. Help Net Security investigated an attempted ransomware attack that was executed via a VirtualBox Virtual Machine created on some compromised computers. Unlike the documented RagnarLocker attacks show more ...

using Virtual Machines with Windows XP, the new threat seems to be running Windows 7. Moreover, according to Dick O'Brien of the Symantec Threat Hunter Team, the VM was deployed via a malicious executable that was pre-installed during the reconnaissance and lateral movement phases of operations. So far, the researchers were unable to determine whether the payload in the VM was Mount Locker or Conti ransomware. The later ... (read more)

Cybercriminal Are Now Relying on Call Centres

softpedia Jun 24, 2021 Security

As ransomware attacks have become more sophisticated, Microsoft cybersecurity researchers are now on the hunt for BazarCall, cybercriminal call centers that manage to spread BazarLoader malware, according to ZDNet. BacarCall, also known as Bazacall, is a cybercriminal gang that has been active since January this year. show more ...

Their way of tricking victims is different from other cybercrime groups as they use call center operators to do so. The attack typically starts with phishing e-mails telling the victim that a subscription has expired and that a monthly fee is charged automatically unless a number is called to cancel the trial subscription. Brad Duncan from Palo Alto Networks explained the gang's attack method in a blog post: "After a client is infected, criminals use this backdoor access to send follow-up malware... (read more)

Cybersecurity in Middle-earth: Dwarven Technologies

kaspersky Jun 24, 2021 Special Projects

A couple of years ago, we reviewed the “Ring of Power” botnet created by famous cybercriminal Sauron (aka Annatar, aka Mairon, aka Necromancer). However, reports by famous cybersecurity expert J. R. R. Tolkien contain much more than just descriptions of the botnet’s modules. For example, Tolkien show more ...

frequently returns to information technology and security systems in discussions of the various races of Middle-earth. In particular, he describes several dwarven systems in detail. The “Doors of Durin” backdoor In the time of The Lord of the Rings, the ancient dwarven stronghold of Moria is deeply under the control of Evil. At some point, the dwarves became obsessed with mining Mithril (obviously a local cryptocurrency), let their guard down, and accidently unzipped and launched an ancient rootkit named Balrog. The rootkit, a part of an APT campaign, had remained in the depths under the mountains since the time of Melkor, a famous hacker and former leader of the group in which the abovementioned Sauron started his criminal career. The group may also have had some interest in Mithril (the Balrog rootkit and the dwarven mining operation didn’t end up in the same place by coincidence), but that’s not explicitly mentioned. Anyway, dwarves built every bit of Moria’s infrastructure, including the western backdoor called Durin’s Door, also known as the Elven Gate. But after years of abandonment, no one remembered the password that granted access through the gate. Tolkien presented the process of Durin’s Door opening humorously: Gandalf, having arrived at the gates with the Fellowship of the Ring, reads the inscription, “Speak, friend, and enter.” Naturally, the password is friend. In other words, the dwarves made the same mistake as many modern office workers do, and left a sticky note with the password right on the computer. The password strength is barely worth a sneer; imagine how well that would stand up to a simple brute-force attack. It is especially funny that the inscription tells us exactly who screwed up: “I, Narvi, made them. Celebrimbor of Hollin drew these signs.” In other words, the inscription contains not only the password but also a couple of logins that clearly belong to privileged users. Many people use the same passwords for accounts in different systems, and one can assume the practice is not alien to other races. It’s likely someone could use these logins and password for deeper penetration into Moria’s systems. It is not clear who made the mistake — dwarf developers or the Celebrimbor, a user — after all, the “doors” were made for trade and cooperation between dwarves and elves. I lean toward the second version; dwarves tend to have much better security practices. Steganography in a Thrór’s Map Tolkien describes one interesting example of dwarven defense technology implementation in The Hobbit: When advanced persistent threat Smaug infected and overtook Erebor (Lonely Mountain), he forced the dwarves to flee their homes (again). Thror, king of the Durin Folk, left his descendants a map with instructions for accessing Erebor’s systems through the backdoor (literally called the Back Door). He hoped that one day a team of security experts could eradicate the dragon infestation. The map’s implementation is very interesting from a cybersecurity point of view. Thror wrote the instructions to gain access to the backdoor on the map, but to keep it secret he not only used Angerthas Erebor (and the dwarves were very reluctant to share their language even with allies), but also used the extremely complex moon-letters method for the inscription. This dwarven technology allows writers to inscribe secret text visible only in the light of the moon — and not only the moon in general, but the moon either in the same phase as on the day of writing, or at the same time of the year. In other words, Thror used some form of steganography, placing secret information on a picture so as to make it not only unreadable but also undetectable to outsiders. The Lonely Mountain backdoor The Back Door’s protection mechanism is no less interesting. To open it, you need a “curious silver key with a long barrel and intricate wards.” However, according to instructions from Thror’s map, the timing is also key: “Stand by the grey stone when the thrush knocks, and the setting sun with the last light of Durin’s Day will shine upon the key-hole.” How the dwarves implemented the thrush part of the technology is unknown — Tolkien didn’t go into the details of the biotech — but what we have here is multifactor authentication, and cleverly implemented at that. Indeed, on Durin’s Day, in the evening, the thrush knocked, the last ray of sunset touched the door, and a fragment of stone broke off, revealing the keyhole. In this case, the calendar was an additional security factor; on the wrong day, even having the key wouldn’t have helped . Alas, Tolkien did not describe the mechanism for returning the breakaway piece to the door. Maybe the thrush took care of that part. Of course, Tolkien allegorically depicted many more cybersecurity and information technologies in his books. As readers rightly pointed out after the first part, analyzing the telecommunication protocol of the infamous palantirs would also be interesting. Unfortunately, the professor did not leave detailed instructions, and scraps of information from his published drafts leave us with more questions than answers. Nevertheless, we will try to talk about them in an upcoming post on elvish IT.

Transatlantic Cable podcast, episode 207 | Kaspersky official blog

kaspersky Jun 24, 2021 News

Welcome to the 207th edition of the Kaspersky Transatlantic Cable podcast! This week, Dave, Ahmed, and I chat about a number of topics — and we also have some changes to our big board of quiz points. We kick things off with a pair of stories about AI and surveillance. The first is from the UK, where AI can now tell show more ...

authorities if people were adhering to social distancing guidelines. The next is about a Chinese company using smile recognition for employees entering the office. Smile for the camera. After a short break for a tip from Ahmed, we’re on to the first round of the week’s quiz game. I won’t spoil it here, but let’s just say there is a bit of a shocker. Following the fun, we get back to business, discussing recent APT activity from the Persian-speaking Ferocious Kitten group with researchers Mark Lechtik and Aseel Kayal. After the interview, we look at the insecurity of America’s water facilities before wrapping up with a discussion of consent and the COVID-19 app in Massachusetts. If you liked what you heard, please consider subscribing and sharing with your friends. For more information on the stories we covered, see the links below: AI cameras introduced in London to monitor social distancing and lockdown restrictions Canon put AI cameras in its Chinese offices that only let smiling workers inside 50,000 security disasters waiting to happen: The problem of America’s water supplies Google force installs Massachusetts MassNotify Android COVID app

Episode 218: Denial of Sustenance Attacks -The Cyber Risk To Agriculture

securityledger Jun 24, 2021 Agriculture

Forget about Colonial Pipeline and JBS. A coordinated cyber attack on U.S. agriculture could, in short order, lead to foot shortages and hunger in the U.S. and abroad. And history has shown us that when food gets scarce, things get ugly - fast. How likely is such an attack? More likely than you might think, says Rob show more ...

Wood of NCC Group, our guest on...Read the whole entry... » Related StoriesEpisode 214: Darkside Down: What The Colonial Attack Means For The Future of RansomwareDeere John: Researcher Warns Ag Giant’s Site Provides a Map to Customers, EquipmentEpisode 217: What Fighting Pirates Teaches Us About Ransomware

Breach of Workforce West Virginia job seeker database reported

cyware Jun 24, 2021 Breaches and Incidents

Workforce says it learned of the breach on April 13, 2021, and ‘immediately took steps to secure the network.’ Workforce West Virginia reports that files were not downloaded, extracted or manipulated.

Data Security Company Symmetry Systems Raises $15 Million

cyware Jun 24, 2021 Companies to Watch

It was led by Prefix Capital and ForgePoint Capital, with participation from Accenture Ventures and individual investors Tom Gonser, Omkhar Arasarathnam, Bob Gleichauf, David Tsao, and Sameer Sait.

Brazilian Medical Diagnostics Firm Grupo Fleury Hit by REvil Ransomware Attack

cyware Jun 24, 2021 Breaches and Incidents

Brazilian medical diagnostic company Grupo Fleury has suffered a ransomware attack that has disrupted business operations and forced the company to take its systems offline.

BIOS Disconnect: New High-Severity Bugs Affect 128 Dell PC and Tablet Models

cyware Jun 24, 2021 Malware and Vulnerabilities

In all, the vulnerabilities affect 128 Dell models spanning across consumer and business laptops, desktops, and tablets, totalling an estimated 30 million individual devices.

VMware Patches Privilege Escalation Vulnerability in Tools for Windows

cyware Jun 24, 2021 Malware and Vulnerabilities

Tracked as CVE-2021-21999 and featuring a CVSS score of 7.8, the issue is a local privilege escalation that requires for an attacker to have normal access to a VM for successful exploitation.

Splunk Gets $1 Billion Investment From Silver Lake

cyware Jun 24, 2021 Companies to Watch

The investment from Silver Lake comes in the form of convertible notes and Splunk says it plans on using the money to “fund growth initiatives and manage its capital structure.”

Hackers leak 260,000 accounts from Pakistani music streaming site Patari

cyware Jun 24, 2021 Breaches and Incidents

Patari.pk, a Pakistani music streaming site has suffered a data breach in which its database containing personal data and login credentials of over 257,000 users has been leaked on hacker forums.

Fashion Firm French Connection Suffers Breach of Internal Data Due to REvil-linked Ransomware Attack

cyware Jun 24, 2021 Breaches and Incidents

French Connection has become the latest victim of ransomware, with a gang understood to be linked to REvil having penetrated its back-end - making off with a selection of private internal data.

Ursnif Leverages Cerberus Android Malware to Automate Fraudulent Bank Transfers in Italy

cyware Jun 24, 2021 Malware and Vulnerabilities

Once infected by Ursnif and upon attempting to access their banking account, victims are advised that they won’t be able to continue to use their bank’s services without downloading a security app.

VMs Help Ransomware Attackers Evade Detection, but It's Uncommon

cyware Jun 24, 2021 Expert Blogs and Opinion

While effective in hiding ransomware activity, the tactic of using virtual machines is more complex than a traditional ransomware attack and may hamper the attackers' efforts.

Researchers Discover New DNS Name Server Hijack Attack That Exposes Businesses, Government Agencies

cyware Jun 24, 2021 Malware and Vulnerabilities

Researchers found a novel class of DNS vulnerabilities in AWS Route53 and other DNS-as-a-service offerings that leak sensitive information on corporate and government customers.

Global Surge in Ransomware Attacks: To pay or not to pay is not the only question - Check Point Software

cyware Jun 24, 2021 Trends, Reports, Analysis

The number of ransomware attacks is growing for a simple reason, hackers are getting paid. The willingness to pay creates a dangerous loop and increases the motivation of attackers.

Cyberattack at IT Service Provider InfoSolutions Impacts Swedish COVID-19 Testing Lab

cyware Jun 24, 2021 Breaches and Incidents

Even though the motive behind the breach is not clear, local media reports that it is suspected to be a warning shot from hackers as the little noticeable damage has yet to come out from the breach.

Illumio Raises $225 Million at $2.75 Billion Valuation

cyware Jun 24, 2021 Companies to Watch

Zero trust segmentation solutions provider Illumio announced that it has raised $225 million in a Series F funding round, which brings the total raised by the company to more than $550 million.

One-Click Exploit Could Have Let Attackers Hijack Any Atlassian Account

cyware Jun 24, 2021 Malware and Vulnerabilities

Researchers disclosed critical flaws in the Atlassian platform that could be exploited for account takeover attacks and to control some of the apps connected through its SSO capability.

Zyxel says a threat actor is targeting its enterprise firewall and VPN devices

cyware Jun 24, 2021 Breaches and Incidents

Zyxel has emailed customers this week to alert them about a series of attacks that have been targeting some of the company’s high-end enterprise-focused firewall and VPN server products.

Malicious spam campaigns delivering banking Trojans

cyware Jun 24, 2021 Malware and Vulnerabilities

In mid-March 2021, Kaspersky researchers observed two new spam campaigns. The messages in both cases were written in English and contained ZIP attachments or links to ZIP files.

Pakistan-linked Hackers Targeted Government and Energy Firms in South and Central Asia Regions

cyware Jun 24, 2021 Breaches and Incidents

A Pakistan-linked threat actor has been striking government and energy organizations in the South and Central Asia regions to deploy a trojan on compromised Windows systems, according to new research.

Arrested Clop gang members laundered over $500M in ransomware payments

cyware Jun 24, 2021 Threat Actors

The members of the Cl0p ransomware gang that were arrested in Ukraine as part of an international law enforcement action also operated money laundering services for multiple cybercrime groups.

New GoLang-based ChaChi Trojan Used as Part of Ransomware Campaigns Against US Schools

cyware Jun 24, 2021 Malware and Vulnerabilities

The research team from BlackBerry Threat Research and Intelligence said on Wednesday that the malware, dubbed ChaChi, is also being used as a key component in launching ransomware attacks.

Malicious Cryptominers Target Software Repositories to Burn a Hole in Your Wallet

cyware Jun 24, 2021 Malware and Vulnerabilities

Sonatype researchers have recently discovered malicious packages in PyPI, a software code repository, that turns developers’ workstations into cryptomining machines.

Manufacturing Sector Still Not Safe from Cyberattacks

cyware Jun 24, 2021 Trends, Reports, Analysis

Manufacturers are still pelted by cyberattacks left, right, and center. A survey published by Morphisec has found that one in five manufacturing companies in the sector has been compromised in a cyber incident.

The Linux Version of DarkSide Ransomware

cyware Jun 24, 2021 Malware and Vulnerabilities

Experts analyzed a Linux version of the DarkSide ransomware, the group responsible for the Colonial Pipeline attack, and claimed that it targeted VMware virtual machines. Though DarkSide has purportedly shut down its operations, organizations are recommended to implement adequate security measures to stay protected against ransomware infections.

US Seizes 33 Iranian State-Run Media Sites Accused Of Election Disinformation

packetstormsecurity Jun 24, 2021 headline,government,usa,fraud,cyberwar,i

BIOSConnect Code Execution Bugs Impact Millions Of Dell Devices

packetstormsecurity Jun 24, 2021 headline,flaw

Hackers Use Fake Call Center To Trick Victims Into Installing Ransomware

packetstormsecurity Jun 24, 2021 headline,malware,cybercrime,fraud,crypto