Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Typical startup cybe ...

 Business

You can find about a million tips on how to keep a startup afloat on the Internet. Usually advisers draw attention to the issues of business planning, marketing strategy, attracting additional investment and so on, but articles rarely talk about the problem of building a solid cybersecurity system. However, the lack   show more ...  

of a clear understanding of threats can cost a startup a potentially successful business. We decided to talk about most typical cybersecurity mistakes and, more importantly, how to prevent them. Source of the problem Here is a typical start-up story: you and your friend come up with a brilliant idea, you discuss it with your inner circle, you gather a group of enthusiasts, and the dream team is ready. This is how the stories of Airbnb, Pinterest, Twitter, Uber and many other famous projects famously started. However, problems arise when a startup moves from an initial idea to building real workflows and hiring additional staff. At this point, the small group of like-minded people expands and becomes a team of random people with different views on life and different life experiences. In such a team, employees may have very different understandings of what information should be considered as confidential and how to keep it secure. Here is an example: one employee decides that it would be convenient to write the password for an online service on a chalkboard — their thinking is, everyone who needs it can find it quickly and easily. Another member of staff posts a selfie in the office on a social network, writing who would write something confidential on the chalkboard, where everyone can see it? This kind of misunderstanding is one of the reasons why young startups can run into cyber-security issues. The problem can be solved only by developing a corporate cybersecurity culture. At the same time, people who come to work in startups are often enthusiasts and adventurers they quickly fall in love with the idea, and can often quickly change their interests and leave. In addition, quite often modern startups depend on IT specialists who generally tend to move from business to business over the course of several years. The combination of these two facts can create high employee turnover. In such conditions various mistakes can easily multiply, especially cybersecurity related ones. Therefore it is easy to overlook a cyberthreat that can easily be avoided. Typical cybersecurity mistakes Lets imagine: you hadnt noticed how your small startup became a fully-fledged business. What cybersecurity mistakes could you have made so far? Excessive access rights Often when a startup employee needs access to corporate resources or services, he immediately gets administrator rights. The person who shares those access rights usually thinks its easier to give access to everything once, without understanding the real needs of a particular employee and his responsibilities, than get new requests for access every week. But the more access rights an employee has, the chance of an error grows. If you want to minimize the number of cyberincidents, each workflow participant should have only those access rights that are necessary for their tasks. Lack of information storage system rules In general, this is bad for any business. But in a startup, due to the above-mentioned staff turnover, one day you may simply not be able to find important work files. Most likely they exist somewhere, but where exactly is the mystery. A developer or marketing intern knew about this once, but left the company recently without telling anyone. Forgotten passwords Another common problem is forgotten passwords for corporate social networks or other rarely used services. Perhaps a new staff member sets up a Facebook or LinkedIn account to help promote the business, but fails to share the account details with other members of staff, then promptly leaves for another role – the login credentials have gone, with little chance of recovery. Shared passwords Some people may think that with high turnover it may be a good idea to use shared accounts. But the more people know a password, the more likely it leaks due to phishing, negligence or malicious intent. In addition, it greatly complicates the investigation of an incident, when it happens. Lets say it turns out that someone has gained access to an account the experts suspect that the password was intercepted by malware and wants to check the computer of an employee who had access. Only to find that everyone had! Passwords in cloud services Another password-related mistake is to store them in some file in Google Docs, as incorrect setup means its usually accessible by anyone with the link. The obvious advantage is that it is very convenient to transfer the necessary information to all employees, it is enough to put all the necessary passwords in one document and send a link. However, such Google documents can be indexed by search engines. In other words, the file with all your passwords could potentially fall into the wrong hands. Lack of two-factor authentication Some of the problems associated with passwords would be less dangerous if startups did not neglect two-factor authentication on work accounts. This allows you to protect important data from various theft methods, such as phishing. First of all, two-step protection should be put on all financial services, such as Upwork. Universal cyberthreat prevention tips To avoid the typical mistakes that many small businesses and start-ups make, try to follow these tips: When it comes to granting access to resources or services you should follow the least privilege principle. That is, an employee must have the minimum set of access rights — enough only to perform their tasks. Know exactly where your startups important information is stored, and who has access to it. From this, develop guidelines when hiring new employees, including clearly defining which accounts are needed for each employee, and which ones should be limited only for certain roles. Mature corporate cybersecurity culture helps to prevent many cyberthreats. You can, for example, start with creating a cybersecurity manual for employees so that everyone is on the same page. Heres a good example for new employees. All passwords must be stored in a secure password manager. It will help your employees not to forget or lose them and also to minimize the chance that an outsider will get access to your accounts. Also use two-factor authentication mechanisms wherever possible. Advise your employees to lock their computer when they walk away from the desk. They should keep in mind that an office can be visited by all kinds of third parties, including couriers, clients, subcontractors or job seekers. Consider installing antivirus software in order to protect devices from viruses, trojans and other malicious programs A large number of threats can be prevented with Kaspersky Small Office Security. This solution not only protects your employees devices from ransomware and other common cyberthreats, it also includes a password manager.

image for Microsoft Patch Tues ...

 Time to Patch

Microsoft today released software updates to plug security holes in its Windows operating systems and related software. This month’s relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it does fix four dozen flaws, including several that   show more ...  

Microsoft says will likely soon be exploited by malware or malcontents. While none of the patches address bugs that earned Microsoft’s most dire “critical” rating, there are multiple “remote code execution” vulnerabilities that Redmond believes are ripe for exploitation. Among those is CVE-2022-22005, a weakness in Microsoft’s Sharepoint Server versions 2013-2019 that could be exploited by any authenticated user. “The vulnerability does require an attacker to be authenticated in order to exploit it, which is likely why Microsoft only labeled it ‘Important,'” said Allan Liska, senior security architect at Recorded Future. “However, given the number of stolen credentials readily available on underground markets, getting authenticated could be trivial. Organizations that have public-facing SharePoint Servers should prioritize implementing this patch.” Kevin Breen at Immersive Labs called attention to CVE-2022-21996, an elevation of privilege vulnerability in the core Windows component “Win32k.” “In January we saw CVE-2022-21882, a vulnerability in Win32k that was being actively exploited in the wild, which prompted CISA to issue a directive to all federal agencies to mandate that patches be applied,” Breen said. “February sees more patches for the same style of vulnerability in this same component. It’s not clear from the release notes whether this is a brand new vulnerability or if it is related to the previous month’s update. Either way, we have seen attackers leverage this vulnerability so it’s safer to err on the side of caution and update this one quickly.” Another elevation of privilege flaw CVE-2022-21989 — in the Windows Kernel — was the only vulnerability fixed this month that was publicly disclosed prior to today. “Despite the lack of critical fixes, it’s worth remembering that attackers love to use elevation of privilege vulnerabilities, of which there are 18 this month,” said Greg Wiseman, product manager at Rapid7. “Remote code execution vulnerabilities are also important to patch, even if they may not be considered ‘wormable.’ In terms of prioritization, defenders should first focus on patching server systems.” February’s Patch Tuesday is once again brought to you by Print Spooler, the Windows component responsible for handling printing jobs. Four of the bugs quashed in this release relate to our friend Mr. Print Spooler. In July 2021, Microsoft issued an emergency fix for a Print Spooler flaw dubbed “PrintNightmare” that was actively being exploited to remotely compromise Windows PCs. Redmond has been steadily spooling out patches for this service ever since. One important item to note this week is that Microsoft announced it will start blocking Internet macros by default in Office. This is a big deal because malicious macros hidden in Office documents have become a huge source of intrusions for organizations, and they are often the initial vector for ransomware attacks. As Andrew Cunningham writes for Ars Technica, under the new regime when files that use macros are downloaded from the Internet, those macros will now be disabled entirely by default. The change will also be enabled for all currently supported standalone versions of Office, including versions 2021, 2019, 2016, and 2013. “Current versions of the software offer an alert banner on these kinds of files that can be clicked through, but the new version of the banner offers no way to enable the macros,” Cunningham wrote. “The change will be previewed starting in April before being rolled out to all users of the continuously updated Microsoft 365 version of Office starting in June.” January’s patch release was a tad heavier and rockier than most, with Microsoft forced to re-issue several patches to address unexpected issues caused by the updates. Breen said while February’s comparatively light burden should give system administrators some breathing room, it shouldn’t be viewed as an excuse to skip updates. “But it does reinforce how important it is to test patches in a staging environment or use a staggered rollout, and why monitoring for any adverse impacts should always be a key step in your patching policy,” Breen said. For a complete rundown of all patches released by Microsoft today and indexed by severity and other metrics, check out the always-useful Patch Tuesday roundup from the SANS Internet Storm Center. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: AskWoody.com usually has the lowdown on any patches that may be causing problems for Windows users. As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these patches, please drop a note about it here in the comments.

 Expert Blogs and Opinion

Java applications are deployed everywhere using this logging tool. Hundreds of vendors are known to be vulnerable. This vulnerability received the maximum CVSS score which is a very rare occurrence.

 Malware and Vulnerabilities

Cybercriminals have found a way to abuse text-based CSV files in a phishing campaign that pretends to be Payment Remittance Advice to install BazarBackdoor malware on users' systems. In the past two days, researchers have spotted 102 actual non-sandbox corporations, along with government victims. Organizations are warned to stay aware of this threat and its techniques and prepare a defense mechanism.

 Threat Actors

Microsoft shared new information on Gamaredon, also known as ACTINIUM, which has been responsible for a plethora of spear-phishing attacks against Ukrainian organizations since October 2021. One of the techniques used by Gamaredon was sending spear-phishing emails containing malicious macro as attachments that use remote templates. 

 Malware and Vulnerabilities

Researchers have detected new activity of Roaming Mantis; attackers have modified the Android trojan Wroba to target Android and iPhone users in Germany and France to steal credentials. Germany and French officials have alerted users about smishing messages with package notifications and compromised websites being used as landing pages.

 Threat Actors

The xPack backdoor allowed the threat actors to remotely run WMI commands, interact with SMB shares to transfer files, and browse the web by using the backdoor as a proxy to hide their IP addresses.

 Breaches and Incidents

Researchers found 1,300 malicious npm packages that could help hackers trigger supply chain attacks and steal credentials and cryptocurrency, as well as run botnets. The report states that 57% of attacks happened during three days of the week - Friday, Saturday, and Sunday. It is recommended to practice utmost caution regarding attacks that seek to abuse dependency confusion in npm.

 Malware and Vulnerabilities

The FBI released an alert containing technical details and IOCs associated with LockBit ransomware to restrict its action whenever spotted in a victim’s network. It also asked admins and cyber teams to share attack-related data, going forward. Follow the flash alert that offers defense tips to stay protected.

 Feed

This Metasploit module uses QEMU's Monitor Human Monitor Interface (HMP) TCP server to execute system commands using the migrate command. This module has been tested successfully on QEMU version 6.2.0 on Ubuntu 20.04.

 Feed

Ubuntu Security Notice 5276-1 - It was discovered that the NVIDIA graphics drivers incorrectly handled permissions in the kernel mode layer. A local attacker could use this issue to write to protected memory and cause a denial of service.

 Feed

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals   show more ...  

to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

 Feed

Ubuntu Security Notice 4754-5 - USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a subsequent update removed the fix for CVE-2021-3177. This update reinstates the security fix for CVE-2021-3177 in Ubuntu 14.04 ESM. It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service.

 Feed

Ubuntu Security Notice 5275-1 - Ziming Zhang discovered that BlueZ incorrectly handled memory write operations in its gatt server. A remote attacker could possibly use this to cause BlueZ to crash leading to a denial of service, or potentially remotely execute code.

 Feed

The wide-ranging adoption of cloud facilities and the subsequent mushrooming of organizations' networks, combined with the recent migration to remote work, had the direct consequence of a massive expansion of organizations' attack surface and led to a growing number of blind spots in connected architectures. The unforeseen results of this expanded and attack surface with fragmented monitoring

 Feed

Microsoft on Monday said it's taking steps to disable Visual Basic for Applications (VBA) macros by default across its products, including Word, Excel, PowerPoint, Access, and Visio, for documents downloaded from the web in an attempt to eliminate an entire class of attack vector. "Bad actors send macros in Office files to end users who unknowingly enable them, malicious payloads are delivered,

 Feed

Microsoft last week announced that it's temporarily disabling the MSIX ms-appinstaller protocol handler in Windows following evidence that a security vulnerability in the installer component was exploited by threat actors to deliver malware such as Emotet, TrickBot, and Bazaloader. MSIX, based on a combination of .msi, .appx, App-V and ClickOnce installation technologies, is a universal Windows

 Feed

Two different Android banking Trojans, FluBot and Medusa, are relying on the same delivery vehicle as part of a simultaneous attack campaign, according to new research published by ThreatFabric. The ongoing side-by-side infections, facilitated through the same smishing (SMS phishing) infrastructure, involved the overlapping usage of "app names, package names, and similar icons," the Dutch mobile

 Feed

An advanced persistent threat (APT) hacking group operating with motives that likely align with Palestine has embarked on a new campaign that leverages a previously undocumented implant called NimbleMamba. The intrusions leveraged a sophisticated attack chain targeting Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline, enterprise security firm Proofpoint said

 Feed

A detailed examination of a Pay-per-install (PPI) malware service called PrivateLoader has revealed its crucial role in the delivery of a variety of malware such as SmokeLoader, RedLine Stealer, Vidar, Raccoon, and GCleaner since at least May 2021. Loaders are malicious programs used for loading additional executables onto the infected machine. With PPI malware services such as PrivateLoader,

 Feed

A financially motivated campaign that targets Android devices and spreads mobile malware via SMS phishing techniques since at least 2018 has spread its tentacles to strike victims located in France and Germany for the first time. Dubbed Roaming Mantis, the latest spate of activities observed in 2021 involve sending fake shipping-related texts containing a URL to a landing page from where Android

2022-02
Aggregator history
Tuesday, February 08
TUE
WED
THU
FRI
SAT
SUN
MON
FebruaryMarchApril