Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Delivery services’ ...

 Business

Data can leak from companies of every stripe. Some hold more of it, others less. Not every leaked database, it might seem, contains critical information. But can any leak ever be considered absolutely safe? Lets consider the example of food delivery services. What data gets leaked? Lets state straight away that   show more ...  

delivery services are unlikely to leak bank card details — for the simple reason that they dont handle them. Some of them use a payment gateway thats controlled by the acquiring bank: the card number is entered on the banks website and the merchant doesnt even see, let alone store it. Even if the card is linked, this happens on the side of the bank, and the merchant only receives a binding ID. Nevertheless, leaks from food delivery services are generally more dangerous than from marketplaces. An order placed on a marketplace can be picked up at a collection point or post office, while a food order is always delivered to the customer at, say, their home or office. Were talking about very personal data here that can link a person to a phone number and physical address, as well as give some insight into their wealth and behavior patterns. How such leaks threaten customers Clearly, there are no positives to be had from such bundles of personal information being available in the public domain, and here are the possible negatives: Potential attackers have information about where the victim lives, how much they spend on food delivery, when they order it, and which days they tend to skip it; thats a perfect recipe for a burglary; Unexpected domestic problems may arise. For instance, last summer there was a story on social media about a girl who got hold of such a database and learned that her boyfriend regularly ordered pizza to the home address of a female friend of hers. It didnt end well, whichever way you slice it; Such leaks represent ready-made market-research databases for painting consumer portraits and sending targeted spam to known postal addresses; Such databases contain not only home addresses, but business ones too. And this allows an attacker to use social engineering to penetrate a companys internal network through a delivery-service customer — for example, by calling and informing them that theyve won and been sent a customer loyalty prize that turns out to be a flash drive with malware. Since the victim is a genuine customer of the delivery service, theyll have little reason to smell a rat — especially if its a courier in uniform who delivers the flash drive. How such leaks threaten business For a business, such leaks are a force majeure that carries numerous risks: Reputational. Leaks cannot be hushed up because databases inevitably pop up on the dark web; so, as a rule, companies themselves try to report them first. But such openness doesnt help much — security incidents always shake both customers and partners trust; Regulatory. Regulators are always ready to fine businesses for violations of personal data protection laws. The size of the fine depends on the jurisdiction, and not only the region where the company is registered can play a role, but also the whereabouts of its customers. For example, any company offering goods or services to customers in almost any European country falls under the GDPR; Material. Customers are increasingly teaming up to file class-action lawsuits when their data is leaked, and courts are starting to side with them. Again, the sums involved are small, yet theyre growing due to the increasing number of folks ready to sue. What to do? Unfortunately, customers not prepared to completely abandon delivery services have few options. Leaks should be seen as an inevitable risk that, like any other, must be assessed and its consequences mitigated. For example, order deliveries to pickup points — not your home address; and pay attention to checkboxes on the order form — you might be able to stop your home address and phone number from being stored. Businesses have more options. These are well known but, sadly, still not always fully employed: Limit employee access to internal databases containing personal data; Carry out periodic audits of security systems; Do not store unnecessary personal data. This means allowing customers to choose what they are willing to entrust to your business, and what must be removed immediately upon completion of an order; Carefully monitor what is happening in your infrastructure using MDR class services.

image for When Low-Tech Hacks ...

 A Little Sunshine

Web hosting giant GoDaddy made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. Media coverage understandably focused on GoDaddy’s admission that it suffered   show more ...  

three different cyberattacks over as many years at the hands of the same hacking group.  But it’s worth revisiting how this group typically got in to targeted companies: By calling employees and tricking them into navigating to a phishing website. In a filing with the U.S. Securities and Exchange Commission (SEC), GoDaddy said it determined that the same “sophisticated threat actor group” was responsible for three separate intrusions, including: -March 2020: A spear-phishing attack on a GoDaddy employee compromised the hosting login credentials of approximately 28,000 GoDaddy customers, as well as login credentials for a small number employees; -November 2021: A compromised GoDaddy password let attackers steal source code and information tied to 1.2 million customers, including website administrator passwords, sFTP credentials, and private SSL keys; -December 2022: Hackers gained access to and installed malware on GoDaddy’s cPanel hosting servers that “intermittently redirected random customer websites to malicious sites.” “Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the company stated in its SEC filing. What else do we know about the cause of these incidents? We don’t know much about the source of the November 2021 incident, other than GoDaddy’s statement that it involved a compromised password, and that it took about two months for the company to detect the intrusion. GoDaddy has not disclosed the source of the breach in December 2022 that led to malware on some customer websites. But we do know the March 2020 attack was precipitated by a spear-phishing attack against a GoDaddy employee. GoDaddy described the incident at the time in general terms as a social engineering attack, but one of its customers affected by that March 2020 breach actually spoke to one of the hackers involved. The hackers were able to change the Domain Name System (DNS) records for the transaction brokering site escrow.com so that it pointed to an address in Malaysia that was host to just a few other domains, including the then brand-new phishing domain servicenow-godaddy[.]com. The general manager of Escrow.com found himself on the phone with one of the GoDaddy hackers, after someone who claimed they worked at GoDaddy called and said they needed him to authorize some changes to the account. In reality, the caller had just tricked a GoDaddy employee into giving away their credentials, and he could see from the employee’s account that Escrow.com required a specific security procedure to complete a domain transfer. The general manager of Escrow.com said he suspected the call was a scam, but decided to play along for about an hour — all the while recording the call and coaxing information out of the scammer. “This guy had access to the notes, and knew the number to call,” to make changes to the account, the CEO of Escrow.com told KrebsOnSecurity. “He was literally reading off the tickets to the notes of the admin panel inside GoDaddy.” About halfway through this conversation — after being called out by the general manager as an imposter — the hacker admitted that he was not a GoDaddy employee, and that he was in fact part of a group that enjoyed repeated success with social engineering employees at targeted companies over the phone. Absent from GoDaddy’s SEC statement is another spate of attacks in November 2020, in which unknown intruders redirected email and web traffic for multiple cryptocurrency services that used GoDaddy in some capacity. It is possible this incident was not mentioned because it was the work of yet another group of intruders. But in response to questions from KrebsOnSecurity at the time, GoDaddy said that incident also stemmed from a “limited” number of GoDaddy employees falling for a sophisticated social engineering scam. “As threat actors become increasingly sophisticated and aggressive in their attacks, we are constantly educating employees about new tactics that might be used against them and adopting new security measures to prevent future attacks,” GoDaddy said in a written statement back in 2020. Voice phishing or “vishing” attacks typically target employees who work remotely. The phishers will usually claim that they’re calling from the employer’s IT department, supposedly to help troubleshoot some issue. The goal is to convince the target to enter their credentials at a website set up by the attackers that mimics the organization’s corporate email or VPN portal. Experts interviewed for an August 2020 story on a steep rise in successful voice phishing attacks said there are generally at least two people involved in each vishing scam: One who is social engineering the target over the phone, and another co-conspirator who takes any credentials entered at the phishing page — including multi-factor authentication codes shared by the victim — and quickly uses them to log in to the company’s website. The attackers are usually careful to do nothing with the phishing domain until they are ready to initiate a vishing call to a potential victim. And when the attack or call is complete, they disable the website tied to the domain. This is key because many domain registrars will only respond to external requests to take down a phishing website if the site is live at the time of the abuse complaint. This tactic also can stymie efforts by companies that focus on identifying newly-registered phishing domains before they can be used for fraud. A U2F device made by Yubikey. GoDaddy’s latest SEC filing indicates the company had nearly 7,000 employees as of December 2022. In addition, GoDaddy contracts with another 3,000 people who work full-time for the company via business process outsourcing companies based primarily in India, the Philippines and Colombia. Many companies now require employees to supply a one-time password — such as one sent via SMS or produced by a mobile authenticator app — in addition to their username and password when logging in to company assets online. But both SMS and app-based codes can be undermined by phishing attacks that simply request this information in addition to the user’s password. One multifactor option — physical security keys — appears to be immune to these advanced scams. The most commonly used security keys are inexpensive USB-based devices. A security key implements a form of multi-factor authentication known as Universal 2nd Factor (U2F), which allows the user to complete the login process simply by inserting the USB device and pressing a button on the device. The key works without the need for any special software drivers. The allure of U2F devices for multi-factor authentication is that even if an employee who has enrolled a security key for authentication tries to log in at an impostor site, the company’s systems simply refuse to request the security key if the user isn’t on their employer’s legitimate website, and the login attempt fails. Thus, the second factor cannot be phished, either over the phone or Internet. In July 2018, Google disclosed that it had not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical security keys in place of one-time codes.

image for All CVEs Are Not Cre ...

 Feed

Vulnerabilities impact each industry differently, so each sector needs to think about its defenses and vulnerability management differently.

 Malware and Vulnerabilities

BitSight uncovered an advanced botnet that has been able to compromise thousands of systems in the U.S., India, Indonesia, and Iran. Dubbed MyloBot, its infrastructure has connections to BHProxies, a residential proxy service. The highly sophisticated malware was first spotted in the wild in 2017 and is known for its anti-analysis techniques.

 Malware and Vulnerabilities

SEKOIA has shared IOCs, along with YARA and Suricata rules, to detect a potential information-stealer named Stealc. Researchers have already identified more than 40 C2 domains and several dozens of malware samples, hinting that Stealc is already gaining popularity within the cybercrime community. To combat attacks   show more ...  

from such info-stealers, organizations are recommended to implement strong security controls with multi-layered visibility and security solutions.

 Malware and Vulnerabilities

Security researchers at Menlo Labs laid bare an attack campaign featuring the PureCrypter downloader to target government entities. The evasive threat campaign is disseminated via Discord by an unidentified threat actor. The attack campaign leverages the domain of a compromised non-profit organization as a C2 channel to deliver its secondary payload.

 Trends, Reports, Analysis

The war in Ukraine has seen the emergence of new forms of cyberattacks, and hacktivists became savvier and more emboldened to deface sites, leak information, and execute DDoS attacks, according to Trellix.

 Malware and Vulnerabilities

Hackers were found distributing sophisticated DarkCloud Stealer info-stealer through various spam campaigns. The malware operates through a multi-stage process and is capable of collecting sensitive information from a victim’s computer or mobile device. The malware operators claim to target applications such as   show more ...  

Chromium-based web browsers, FileZilla, CoreFTP, FlashFXP, NordVPN, Pidgin, Internet Explorer, and Microsoft Edge vaults.

 Trends, Reports, Analysis

The threat landscape and organizations’ attack surfaces are constantly transforming, and cybercriminals’ ability to design and adapt their techniques to suit this evolving environment continues to pose significant risks to all businesses.

 Identity Theft, Fraud, Scams

Get careful around the use of OpenAI's ChatGPT chatbot now as cybercriminals have started taking advantage of the hype around it. Security researcher Dominic Alvieri reported hackers attempting to infect visitors with the Redline info-stealing malware by posing as a download for a ChatGPT Windows desktop client. He also witnessed fake ChatGPT apps coercing users into installing bogus software.

 Identity Theft, Fraud, Scams

Over the last few days, scammers have been sending out phishing emails that disguise bogus URLs with something called Slinks—shortened Linkedin URLs. Now, they're being used in a scam based on Amazon's popular Prime membership.

 Security Tips and Advice

In particular, the software giant said this week that sysadmins should now include the Temporary ASP.NET files, Inetsrv folders, and the PowerShell and w3wp processes on the list of files and folders to be run through antivirus systems.

 Threat Actors

TA569 leverages many types of injections, traffic distribution systems (TDS), and payloads including, but not limited to, SocGholish. In addition to serving as an initial access broker, these injects imply it may be running a pay-per-install service.

 Malware and Vulnerabilities

An unidentified group of ransomware hackers, dubbed Nevada Group, has targeted the computer networks of almost 5,000 victims across the U.S. and Europe. Hackers ask for two Bitcoins (which is around $50,000) and their ransom notes are publicly visible. The CISA has released a simple workaround to nullify the attack, allowing some of the victims to regain their data.

 Malware and Vulnerabilities

Bitdefender disclosed an active malware campaign targeting Facebook and YouTube users with S1deload Stealer, using adult themes as bait. The new information stealer compromises user credentials and exploits system resources to mine BEAM cryptocurrency. The malware has the ability to propagate its malicious links to a   show more ...  

compromised user’s followers. Between July and December 2022, about 600 individuals fell victim to it.

 Feed

ASUS ASMB8 iKVM firmware versions 1.14.51 and below suffers from a flaw where SNMPv2 can be used with write access to introduce arbitrary extensions to achieve remote code execution as root. The researchers also discovered a hardcoded administrative account.

 Feed

kbase_csf_kcpu_queue_enqueue() locks the kctx->csf.kcpu_queues, looks up a pointer from inside that structure, then drops the lock before continuing to use the kbase_kcpu_command_queue that was looked up. This is a classic use-after-free pattern, where the lookup of a pointer is protected but the protective lock is then released without first acquiring any other lock or reference to keep the referenced object alive.

 Feed

Ubuntu Security Notice 5890-1 - Qian Chen discovered that Open vSwitch incorrectly handled certain Organization Specific TLVs. A remote attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5892-1 - It was discovered that NSS incorrectly handled client authentication without a user certificate in the database. A remote attacker could possibly use this issue to cause a NSS client to crash, resulting in a denial of service. This issue only affected Ubuntu 22.10. Christian Holler   show more ...  

discovered that NSS incorrectly handled certain PKCS 12 certificated bundles. A remote attacker could use this issue to cause NSS to crash, leading to a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5893-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

 Feed

Ubuntu Security Notice 5891-1 - Harry Sintonen discovered that curl incorrectly handled HSTS support when multiple URLs are requested serially. A remote attacker could possibly use this issue to cause curl to use unencrypted connections. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. Harry Sintonen   show more ...  

discovered that curl incorrectly handled HSTS support when multiple URLs are requested in parallel. A remote attacker could possibly use this issue to cause curl to use unencrypted connections. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10.

 Feed

Ubuntu Security Notice 5889-1 - It was discovered that ZoneMinder was not properly sanitizing URL parameters for certain views. An attacker could possibly use this issue to perform a cross-site scripting attack. This issue was only fixed in Ubuntu 16.04 ESM. It was discovered that ZoneMinder was not properly   show more ...  

sanitizing stored user input later printed to the user in certain views. An attacker could possibly use this issue to perform a cross-site scripting attack. This issue was only fixed in Ubuntu 16.04 ESM.

 Feed

Ubuntu Security Notice 5887-1 - Simon Scannell discovered that ClamAV incorrectly handled parsing HFS+ files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or execute arbitrary code. Simon Scannell discovered that ClamAV incorrectly handled parsing DMG files. A remote attacker could possibly use this issue to expose sensitive information.

 Feed

Ubuntu Security Notice 5886-1 - Erik C. Bjorge discovered that some Intel Atom and Intel Xeon Scalable Processors did not properly implement access controls for out-of-band management. This may allow a privileged network-adjacent user to potentially escalate privileges. Cfir Cohen, Erdem Aktas, Felix Wilhelm, James   show more ...  

Forshaw, Josh Eads, Nagaraju Kodalapura Nagabhushana Rao, Przemyslaw Duda, Liron Shacham and Ron Anderson discovered that some Intel Xeon Processors used incorrect default permissions in some memory controller configurations when using Intel Software Guard Extensions. This may allow a privileged local user to potentially escalate privileges.

 Feed

Ubuntu Security Notice 5885-1 - Ronald Crane discovered integer overflow vulnerabilities in the Apache Portable Runtime that could potentially result in memory corruption. A remote attacker could possibly use these issues to cause a denial of service or execute arbitrary code.

 Feed

Debian Linux Security Advisory 5364-1 - Ronald Crane discovered that missing input saniting in the apr_base64 functions of apr-util, the Apache Portable Runtime utility library, may result in denial of service or potentially the execution of arbitrary code.

 Feed

Debian Linux Security Advisory 5363-1 - Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service or incorrect validation of BCrypt hashes.

 Feed

The RIG exploit kit (EK) touched an all-time high successful exploitation rate of nearly 30% in 2022, new findings reveal. "RIG EK is a financially-motivated program that has been active since 2014," Swiss cybersecurity company PRODAFT said in an exhaustive report shared with The Hacker News. "Although it has yet to substantially change its exploits in its more recent activity, the type and

 Feed

Spoiler Alert: Organizations with 10,000 SaaS users that use M365 and Google Workspace average over 4,371 additional connected apps. SaaS-to-SaaS (third-party) app installations are growing nonstop at organizations around the world. When an employee needs an additional app to increase their efficiency or productivity, they rarely think twice before installing. Most employees don’t even realize

 Feed

A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk (VHD) files, marking a deviation from the ISO optical disc image format. "These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games," AhnLab Security Emergency response Center (ASEC) said in a report last week. ChromeLoader (aka

 Feed

Government entities in Asia-Pacific and North America are being targeted by an unknown threat actor with an off-the-shelf malware downloader known as PureCrypter to deliver an array of information stealers and ransomware. "The PureCrypter campaign uses the domain of a compromised non-profit organization as a command-and-control (C2) to deliver a secondary payload," Menlo Security researcher

 Feed

The PlugX remote access trojan has been observed masquerading as an open source Windows debugger tool called x64dbg in an attempt to circumvent security protections and gain control of a target system. "This file is a legitimate open-source debugger tool for Windows that is generally used to examine kernel-mode and user-mode code, crash dumps, or CPU registers," Trend Micro researchers Buddy

 Feed

The Dutch police announced the arrest of three individuals in connection with a "large-scale" criminal operation involving data theft, extortion, and money laundering. The suspects include two 21-year-old men from Zandvoort and Rotterdam and an 18-year-old man without a permanent residence. The arrests were made on January 23, 2023. It's estimated that the hackers stole personal data belonging

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Sysdig. Thanks to the great team there for their support! The unmanageable number of vulnerabilities in the cloud is the worst-kept secret. The Sysdig 2023 Cloud-Native Security and Usage report found that 87% of container images have high or critical   show more ...  

vulnerabilities! Surely not … Continue reading "The cloud’s worst kept secret? Vulnerabilities"

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Sysdig. Thanks to the great team there for their support! The unmanageable number of vulnerabilities in the cloud is the worst-kept secret. The Sysdig 2023 Cloud-Native Security and Usage report found that 87% of container images have high or critical   show more ...  

vulnerabilities! Surely not … Continue reading "The cloud’s worst kept secret? Vulnerabilities"

2023-02
Aggregator history
Monday, February 27
WED
THU
FRI
SAT
SUN
MON
TUE
FebruaryMarchApril