Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Microsoft Confirms C ...

 Cybersecurity News

Microsoft has confirmed CrowdStrike’s analysis of the root cause of the July 19 global Windows outage – and outlined plans to work with anti-malware vendors to help prevent similar events in the future. In a July 27 blog post by David Weston, Microsoft’s VP for Enterprise and OS Security, the software giant   show more ...  

outlined four initiatives for helping anti-malware vendors roll out updates more safely: Offering rollout guidance, best practices, and technologies “to make it safer to perform updates to security products.” Reducing the need for kernel drivers to access security data. Providing improved isolation and anti-tampering capabilities with technologies like Virtualization-based security (VBS) enclaves. Enabling zero trust approaches like high integrity attestation, which can determine the security state of a machine based on the health of Windows native security features. The Microsoft CrowdStrike response also emphasizes support for the Rust memory-safe programming language as a way “for security tools to detect and respond to emerging threats safely and securely.” Weston’s blog post is the latest post-mortem on the faulty CrowdStrike update that brought down 8.5 million Windows machines around the world in what was possibly the largest cyber incident of all time. Microsoft Confirms CrowdStrike Root Cause Weston’s blog post confirms CrowdStrike’s version of the causes of the global “blue screen of death” outage before getting into Microsoft’s plans for making updates safer. “Our observations confirm CrowdStrike’s analysis that this was a read-out-of-bounds memory safety error in the CrowdStrike developed CSagent.sys driver,” Weston wrote. Such errors “can lead to widespread availability issues when not combined with safe deployment practices.” He said csagent.sys is a file system filter driver used by anti-malware agents to receive notifications about file operations such as the creation or modification of a file, useful for scanning downloads and other new files. File system filters can also be used as a signal for monitoring system behavior. “CrowdStrike noted in their blog that part of their content update was changing the sensor’s logic relating to data around named pipe creation,” he wrote. “The File System filter driver API allows the driver to receive a call when named pipe activity (e.g., named pipe creation) occurs on the system that could enable the detection of malicious behavior.” Kernel Usage Important But Not Always Necessary Microsoft generally defended the practice of using kernel drivers for their ability to provide system-wide visibility, to load early to detect threats like boot kits and rootkits, which can load before user-mode applications, and to monitor for events like file creation, deletion, or modification. Weston said Kernel activity can also trigger call backs for drivers to decide when to block activities like file or process creations, and many vendors use drivers to collect network information in the kernel using the NDIS driver class. Microsoft noted tamper resistance and performance benefits too, but added, “There are many scenarios where data collection and analysis can be optimized for operation outside of kernel mode and Microsoft continues to partner with the ecosystem to improve performance and provide best practices to achieve parity outside of kernel mode.” “It is possible today for security tools to balance security and reliability,” Weston wrote. Security vendors can use "minimal sensors" that run in kernel mode for data collection and enforcement, limiting exposure to availability issues. Other key product functionality - managing updates, parsing content, and other operations - "can occur isolated within user mode where recoverability is possible. This demonstrates the best practice of minimizing kernel usage while still maintaining a robust security posture and strong visibility.” He included this image on where those functions might run: [caption id="attachment_84407" align="aligncenter" width="624"] Windows security: Kernel-mode and user-mode functionality[/caption] Best Practices for Windows Security and Stability Weston also mentioned a number of best practices that can improve Windows security and availability, with App Control for Business and VBS memory integrity two of the more noteworthy ones. App Control for Business (formerly Windows Defender Application Control) can be used to allow only trusted and business-critical apps. “Your policy can be crafted to deterministically and durably prevent nearly all malware and ‘living off the land’ style attacks. It can also specify which kernel drivers are allowed by your organization to durably guarantee that only those drivers will load on your managed endpoints.” VBS offers memory integrity with a specific allow list policy to further protect the Windows kernel. “Combined with App Control for Business, memory integrity can reduce the attack surface for kernel malware or boot kits,” Weston wrote. “This can also be used to limit any drivers that might impact reliability on systems.” Running as Standard User and using Device Health Attestation (DHA) are other important controls. Microsoft CrowdStrike Response Could Involve MVI Microsoft engages with third-party security vendors through the Microsoft Virus Initiative (MVI) “to define reliable extension points and platform improvements, as well as share information about how to best protect our customers.” Presumably MVI will be involved in efforts to improve Windows reliability and availability in the wake of the CrowdStrike outage.

image for Weekly Vulnerability ...

 Cybersecurity News

Cyble Research & Intelligence Labs (CRIL) researchers have analyzed more than 100 security vulnerabilities in the last two weeks, with flaws in IT products from SolarWinds, Cisco, Ivanti, Microsoft, Exim and GitLab warranting particularly close attention by security teams. To help security staff focus their   show more ...  

patching and mitigation efforts on the most important threats, The Cyber Express partners with Cyble’s highly skilled dark web and threat intelligence researchers to highlight the vulnerabilities that are at higher risk of exploit and attack and should be prioritized. In this week's vulnerability report, we’ll focus on 14 high-risk vulnerabilities, based on Cyble’s work since our last vulnerability update. Vulnerability Report: The Week’s Top Security Risks These are the 14 high-severity and critical vulnerabilities that Cyble researchers have highlighted recently. CVE-2024-29824: Ivanti Endpoint Manager Impact Analysis: A critical SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 allows an unauthenticated attacker within the same network to execute arbitrary code. With the availability of recently released public POC and exploit scripts, there are possibilities of exploitation of the vulnerability by threat actors (TAs) on a large scale. Internet Exposure? No Patch Available? Yes CVE-2024-23469, CVE-2024-23466, CVE-2024-23467, CVE-2024-28074, CVE-2024-23471, and CVE-2024-23470: SolarWinds ARM Impact Analysis: These critical vulnerabilities impact SolarWinds Access Rights Manager (ARM) software, a critical tool in enterprise environments that helps admins manage and audit access rights across their organization's IT infrastructure to minimize threat impact. The flaws allow attackers without privileges to perform actions on unpatched systems by executing code or commands, with or without SYSTEM privileges, depending on the exploited flaw. Internet Exposure? No Patch Available? Yes CVE-2024-23475 and CVE-2024-23472: SolarWinds ARM Impact Analysis: In the same update, SolarWinds also addressed two critical directory traversal and information disclosure vulnerabilities in Access Rights Manager (ARM), which allow unauthenticated users to perform arbitrary file deletion and obtain sensitive information after accessing files or folders outside of restricted directories. Internet Exposure? No Patch Available? Yes CVE-2024-20401: Cisco Secure Email Gateway Impact Analysis: This critical vulnerability in Cisco Secure Email Gateway's content scanning and message filtering features could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Internet Exposure? No Patch Available? Yes CVE-2024-20419: Cisco Smart Software Manager On-Prem Impact Analysis: This 10.0 critical vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) license management solution could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user. Internet Exposure? Yes Patch Available? Yes CVE-2024-38112: Microsoft MSHTML Impact Analysis: A high severity MSHTML platform spoofing vulnerability has been discovered impacting Microsoft’s Windows operating system. An attacker would have to send the victim a malicious file that the victim would need to execute to leverage the flaw. Researchers also disclosed that the zero-day vulnerability has been actively exploited in attacks for eighteen months to launch malicious scripts while bypassing built-in security features. Internet Exposure: No Patch Available? Yes CVE-2024-39929: Exim Impact Analysis: A medium severity vulnerability impacts Exim, a mail transfer agent (MTA). It occurs due to the incorrect parsing of multiline RFC2231 header filenames, which can let remote attackers deliver malicious executable attachments into end users' mailboxes by circumventing the $mime_filename extension-blocking protection mechanism. With a large number of internet exposed instances and availability of proof of concept (POC), there are possibilities of exploitation of vulnerability by TAs in the future. Internet Exposure: Yes Patch? Follow progress at bugs.exim.org CVE-2024-6385: GitLab CE/EE Impact Analysis: A critical vulnerability is discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. Since the impacted product is utilized in multiple organizations worldwide, there are possibilities that the TAs could try to exploit vulnerability for illicit purposes. Internet Exposure? Yes Patch Available? Yes Dark Web Exploits, ICS Vulnerabilities & More The full Cyble report for subscribers also looks at 25 vulnerability exploits discussed on the dark web, 68 industrial control system (ICS) vulnerabilities, and the vulnerabilities with the highest number of web asset exposures, some numbering in the hundreds of thousands.

image for Unveiling the Starga ...

 Firewall Daily

In a startling revelation, cybersecurity experts have uncovered a sophisticated malware distribution network known as the Stargazers Ghost Network.  Operated by the threat actor dubbed "Stargazer Goblin," this elaborate scheme involves over 3,000 fake GitHub accounts used to disseminate a variety of   show more ...  

information-stealing malware.  This operation, which has reportedly netted around $100,000 in illicit profits over the past year, employs a Distribution-as-a-Service (DaaS) model to perpetuate its activities. The Structure and Functioning of Stargazers Ghost Network The Stargazers Ghost Network is a massive operation built on the cloud-based code hosting platform GitHub. The network spans thousands of repositories where malicious links and malware are distributed.  This setup is designed to evade detection and maintain a facade of legitimacy. Check Point Research, which has identified and analyzed this network, notes that these fake accounts are involved in various activities including starring, forking, watching, and subscribing to repositories to make them appear genuine. Among the malware families propagated by this network are Atlantida Stealer, Rhadamanthys, RisePro, Lumma Stealer, and RedLine. The Stargazer Goblin group meticulously creates and maintains these fake accounts to support their malicious activities, often updating them to circumvent bans and detection. Initially, threat actors used GitHub to distribute malware directly. However, their tactics have evolved significantly. Today, they operate a network of so-called “Ghost” accounts that distribute malware through seemingly innocuous links and encrypted archives. As security researcher Antonis Terefos explains, "This network not only distributes malware but also engages in activities that make these 'Ghost' accounts appear as normal users, lending a false sense of legitimacy to their actions. The network’s strategy involves multiple accounts with different roles. One account might handle the phishing repository template, another provides images used in phishing schemes, and a third serves as the malware distributor. This division of labor ensures that the operation can quickly adapt to disruptions and continue its activities with minimal loss. Impact and Reach of the Stargazers Ghost Network The Stargazers Ghost Network has had a substantial impact. For instance, during a campaign in January 2024, the network distributed Atlantida Stealer, a new malware variant designed to steal user credentials and cryptocurrency wallets. Within just four days, over 1,300 victims were compromised. The network's influence extends beyond GitHub, with similar ghost accounts operating across various platforms like Discord, Facebook, Instagram, X (formerly Twitter), and YouTube, creating an extensive DaaS ecosystem. Check Point’s findings reveal that the network not only spreads malware but also manipulates GitHub's features to enhance the credibility of its repositories. By using multiple accounts to "star" and interact with malicious repositories, they create an illusion of legitimacy, making it more likely that victims will download and execute malicious software. The revelations about the Stargazers Ghost Network come amid other cybersecurity concerns. For instance, recent reports indicate that unknown actors are targeting GitHub repositories for extortion. These attacks involve phishing emails and fraudulent OAuth applications that wipe repository contents and demand ransom payments for restoration. Additionally, vulnerabilities related to Cross Fork Object Reference (CFOR) have been highlighted, showing that sensitive data can sometimes be accessed even from deleted or private repositories. Joe Leon of Truffle Security notes, “A CFOR vulnerability occurs when one repository fork can access sensitive data from another fork, including data from private and deleted forks. This underscores the importance of understanding the boundaries of data visibility on platforms like GitHub.”

image for South Korea Confront ...

 Firewall Daily

South Korea has recently disclosed a data breach involving its Korea Defense Intelligence Command (KDIC), a critical arm of the nation’s military intelligence apparatus. The South Korea data breach reveals that a substantial amount of sensitive information, including personal data about KDIC agents stationed abroad,   show more ...  

has been leaked, with reports indicating that this data may have ended up in North Korea. This data breach has sparked widespread concern regarding the security of the nation's intelligence operations and the safety of its personnel. According to a report by the New York Times, South Korean officials are investigating the military breach, but they have yet to confirm the specifics reported by local media. The KDIC is renowned for its covert operations, focusing on gathering intelligence on North Korea—a country known for its military aggression and nuclear threats.  The Massive South Korea Data Breach Exposes Military Documents The leaked information reportedly includes details about undercover agents who operate under disguises, such as diplomats, across China and other regions in Asia. These agents play a crucial role in monitoring North Korean activities and recruiting contacts, thus contributing significantly to the intelligence gathered by South Korea and its allies. The South Korean military has stated that it plans to address the breach with severe consequences for those responsible. However, it has not yet disclosed any further details, citing the ongoing investigation. This data breach is particularly alarming given the KDIC’s role in national security. The information at risk includes personal details about agents, which, if compromised, could severely damage South Korea’s ability to conduct effective intelligence operations against North Korea. Historically, South Korea has been reticent about publicizing such breaches. The KDIC, alongside the National Intelligence Service, is one of South Korea’s top two intelligence agencies. The last major incident of a security breach involving the KDIC occurred in 2018. At that time, an active-duty officer was found guilty of selling classified information to foreign agents in China and Japan. This included sensitive data about the KDIC’s operations and North Korean weaponry. The Conflict Between South Korea and North Korea The timing of this latest  South Korea data breach is particularly critical given the current geopolitical climate. North and South Korea engage in extensive intelligence and counterintelligence activities, often resulting in espionage and security concerns.  In recent years, North Korea has also intensified its cyber operations, utilizing a vast network of hackers to target and infiltrate computer systems worldwide. These cyberattacks aim to steal information and cryptocurrency, contributing to the growing threat posed by North Korean cyber operations. On Thursday, a joint advisory issued by the United States, Britain, and South Korea highlighted the ongoing cyber espionage campaign orchestrated by North Korean hackers. This advisory warned that these hackers are actively seeking to steal classified military secrets to support North Korea’s nuclear weapons program.  The U.S. Justice Department has also announced the indictment of Rim Jong Hyok, a North Korean military intelligence operative accused of hacking into U.S. healthcare providers, NASA, and military bases. Rim is alleged to have stolen sensitive information and installed ransomware to fund further attacks. The U.S. has offered a reward of up to $10 million for information leading to his arrest.

image for India’s Average Da ...

 Cybersecurity News

According to the Reserve Bank of India (RBI), the average cost of a data breach in India reached $2.18 million last year. The RBI cybersecurity report, released by the central bank today, shared statistics on cybercrime in India, along with details on the most vulnerable industries. The report also highlighted   show more ...  

measures taken by the bank to make the country more digitally secure for its citizens. The RBI’s “Report on Currency and Finance” notes that data breaches in India have gotten 28% more expensive since 2020. While that's faster than the overall global growth rate of 15%, the report notes that 13 countries and regions have a higher average data breach cost. “Globally, cybercrime costs are expected to reach US$13.82 trillion by 2028, up from US$8.15 trillion in 2023. The average cost of a data breach has also risen to US$4.45 million in 2023, a 15 per cent increase over three years,” said the report. “Recognizing the significant costs involved, most central banks have increased their cyber security investment budgets by five per cent since 2020,” the report said. [caption id="attachment_84393" align="alignnone" width="790"] Source: RBI Report[/caption] RBI Cybersecurity Report in Detail In its report, the RBI pointed out that phishing was the most predominant form of cyberattack in India through 2023, accounting for about 22 percent of incidents, followed by incidents involving stolen or compromised credentials. “The most common attacks in India are phishing (22 per cent), followed by stolen or compromised credentials (16 per cent),” the report said. The number of security incidents managed by the Indian Computer Emergency Response Team (CERT-In) surged from 53,117 in 2017 to 1.32 million between January and October 2023, the report noted. “Unauthorised network scanning, probing, vulnerable services account for more than 80 per cent of all security incidents in India,” the report found. In an analysis of cyberattacks across various industries in India, the report concluded that the automotive sector was the most vulnerable. “Industry-wise distribution of cyberattacks in India shows that the automotive industry is the most vulnerable, with smart mobility application programming interfaces (APIs) and electric vehicle (EV) charging infrastructure emerging as major attack vectors,” the RBI report said. Financial Services Better Protected The Banking, Financial Services, and Insurance (BFSI) sector, governed by stringent regulations, enjoys comparatively better protection against such attacks, it added. [caption id="attachment_84394" align="alignnone" width="1022"] Source: RBI Report[/caption] “With the increasing adoption of digital payments, the share of complaints related to mobile/electronic banking, ATM/debit cards and credit cards received in the offices of the RBI ombudsman accounted for 47 per cent of total complaints in 2022-23,” the report added. The apex bank also highlighted that digitalization is leading to the emergence of ‘invisible risks’ or ‘dark patterns’, where consumers are manipulated into making choices that are harmful to their interests. “While digital technologies offer various opportunities for India, such as faster growth, financial inclusion and seamless fiscal transfers and cross-border payments, they also present challenges related to cybersecurity, data privacy and concentration risks. Balancing financial stability, customer protection and fair competition in this dynamic landscape, the Reserve Bank is actively involved in developing a safe, efficient and robust digital ecosystem,” the report said. “The measures implemented in India to promote security of digital transactions include two-factor authentication for digital payments, increased customer control over card usage, faster turnaround time for transaction failures, augmented supervisory oversight with simulated phishing exercises," the report said. The Reserve Bank also issued comprehensive guidelines and frameworks for IT and Cyber Risk management, encompassing regulations on Digital Payment Security Controls and IT Services Outsourcing.

image for Quad Talks Forge New ...

 Firewall Daily

In a key step to improve maritime safety in the Asia-Pacific region, top diplomats from Japan, the United States, Australia, and India met in Tokyo earlier this week. This meeting, part of the ongoing Quad talks, focused on boosting maritime security and strengthening cybersecurity across the region. The gathering   show more ...  

brought together Japanese Foreign Minister Yoko Kamikawa, U.S. Secretary of State Antony Blinken, Australian Foreign Minister Penny Wong, and Indian External Affairs Minister Subrahmanyam Jaishankar.  Their discussions focused on formulating a comprehensive set of measures designed to address the escalating tensions in regional waters and to strengthen defenses against growing cyber threats. Major Key Takeaways from International Quad Talks Following their meeting, the diplomats expressed serious concerns about the rising instability in the Asia-Pacific maritime domain. They voiced strong opposition to any unilateral attempts to alter the status quo through coercion.    This statement comes amidst ongoing disputes over territorial claims, particularly in the South China Sea, which is vital due to its strategic maritime trade routes and potential energy resources. The diplomats avoided directly naming China in their joint communiqué but highlighted concerns over the militarization of disputed areas and intimidating maneuvers within these waters. At the heart of the Quad talks were agreements on several key initiatives aimed at enhancing maritime safety and cybersecurity. The four countries committed to expanding their support for regional nations, particularly those in Southeast Asia and the Pacific Islands, to improve their capabilities in these crucial areas. This collaborative effort highlights a broader aim of reinforcing a secure and open maritime order in line with international standards. Establishing Maritime Legal Dialogue A notable outcome of the discussions was the establishment of a new maritime legal dialogue, focusing on the international law of the sea. The Quad nations highlighted their determination to uphold and advance a free and open maritime order as enshrined in the U.N. Convention on the Law of the Sea. This initiative is expected to foster greater cooperation and coordination among the participating countries and other regional partners. In their joint statement, the diplomats outlined specific actions, including the support for implementing a secure telecommunications network in Palau and enhancing cybersecurity infrastructure in the Philippines and India. These steps are part of a broader strategy to improve regional connectivity through the development of resilient infrastructure, such as undersea cables, which are critical for ensuring the uninterrupted flow of information and commerce. [caption id="attachment_84349" align="alignnone" width="1242"] Source: Firstpost[/caption] U.S. Secretary of State Antony Blinken emphasized the Quad's collective commitment to maintaining freedom of navigation, overflight, and the lawful flow of maritime commerce. We are committed to leveraging our collective resources and strengths to benefit the entire region," Blinken stated during a joint news conference. He reiterated the importance of these principles for the ongoing prosperity and security of the Asia-Pacific region. Japanese Foreign Minister Yoko Kamikawa echoed these sentiments, highlighting the increasing instability in maritime security and the urgent need for unity among the Quad countries. She pointed out that rising tensions and cyber threats from unspecified sources could have broader implications for regional stability. "To ensure regional prosperity, we must safeguard the foundational stability of maritime, cyber, and space domains," Kamikawa remarked. She affirmed the Quad's mission to protect the foundations of prosperity in the Indo-Pacific region and to promote an international community centered on coexistence and mutual benefit.

image for Malaysian Digital Mi ...

 Cybersecurity News

The Malaysian Digital Ministry is increasing efforts to secure the country's digital landscape as it attracts major investments from foreign investors. Digital Minister Gobind Singh Deo has announced plans to establish a separate data committee, which could evolve into a data commission by March 2025. The   show more ...  

Ministry's initiative aims to prioritize data safety in response to the recent influx of foreign investments from tech giants, such as Google and Microsoft, and its critical role in shaping the industry. Malaysian Digital Ministry Data Safety Initiatives In official statements, the Malaysian Digital Ministry reaffirmed its commitment to creating a safe cyber ecosystem through appropriate legislation. Gobind stressed the importance of industry input for these legislative steps, stating, "The ministry will make sure that views are taken from all, including the industry." This collaborative approach with the tech industry is a critical step in the government's dedication to developing and modernizing its cybersecurity measures. In a significant move, Digital Nasional Bhd (DNB) and Cybersecurity Malaysia (CSM) signed a collaboration agreement to enhance the security of Malaysia's 5G network. This partnership will lead to the establishment of a National 5G Cybersecurity Testing Centre, providing a platform for industry players to identify vulnerabilities within the network and ensure compliance with security conventions. Malaysia's Push For 5G Advancements and Pricing Malaysia's 5G adoption rate has reached 43.6%, with over 14.8 million service subscriptions. Gobind noted the positive impact of 5G on the country's mobile internet experience. However, he also addressed concerns about pricing as the second network rolls out, assuring that the Malaysian Communications and Multimedia Commission (MCMC) will work to maintain current rates. The minister stressed the critical nature of 5G network infrastructure, noting its impact on national defense, the economy, and societal progress. "Digital space has become an integral part of daily lives, driving innovation, economic growth, and societal progress. However, with these advancements come significant challenges, particularly in the realm of cybersecurity," Gobind stated. The exchange of threat intelligence information between the Digital Nasional Bhd (DNB) and Cybersecurity Malaysia (CSM), as outlined in the legislation, will also contribute to strengthen the nation's cyberthreat combat capabilities. A 'Digital Hub' in Southeast Asia As Malaysia positions itself as a digital hub in Southeast Asia, these initiatives demonstrate the government's proactive approach to balancing technological advancement with robust security measures. The collaboration between government agencies and industry players is set to play a crucial role in shaping the country's digital future.

image for 4.3 Million Individu ...

 Data Breach News

Draper, Utah-based HealthEquity, a prominent financial technology and business services company, has confirmed a significant data breach affecting millions of individuals. The breach, discovered in March and confirmed in June 2024, involved unauthorized access to sensitive personal information (PII) of 4.3 million   show more ...  

people, including 13,480 Maine residents. How the HealthEquity Data Breach Occurred According to an SEC filing, HealthEquity detected anomalous activity on a personal device belonging to a business partner. Subsequent investigation revealed that the partner's user account had been compromised, allowing unauthorized access to information, including personally identifiable information (PII) and protected health information (PHI) for some members. "The investigation did not find placement of malicious code on any Company systems. There has been no interruption to the Company’s systems, services, or business operations," HealthEquity said at the time in its 8-K filing with the U.S. Securities and Exchange Commission. The investigation concluded that data was exfiltrated from the partner's systems. What Information Was Exposed? The compromised data primarily consisted of account signup information and details related to benefits administered by HealthEquity. While the specific information varied for each individual, it could include: Name Employee ID Employer Address Telephone number Social Security number Dependent contact information It's crucial to note that payment card numbers and HealthEquity debit card information were not affected by the breach. HealthEquity Breach Impact on Individuals The exposure of personal information can have severe consequences for affected individuals. This includes an increased risk of identity theft, financial fraud, and other forms of cybercrime. HealthEquity has acknowledged the gravity of the situation and has offered two years of complimentary credit identity monitoring, insurance, and restoration services to all impacted individuals. Protecting Yourself After a Data Breach While HealthEquity is providing support, it's essential for affected individuals to take proactive steps to protect themselves. These measures include: Closely monitoring credit reports: Check for any unauthorized activity and dispute errors promptly. Being cautious of suspicious emails and calls: Avoid clicking on links or providing personal information in response to unsolicited communications. Consider a credit freeze: This prevents new credit accounts from being opened without your explicit authorization. Potential Causes of the Breach While HealthEquity has confirmed that the breach involved a vendor's user accounts with access to a SharePoint data storage location, the exact cause of the compromise remains under investigation. Possible factors contributing to the breach could include: Weak password security: Inadequate password practices by vendor employees could have facilitated unauthorized access. Phishing attacks: Malicious emails designed to trick users into revealing login credentials may have been successful. Insider threats: A disgruntled or compromised employee with access to sensitive information could be responsible. Third-party vulnerabilities: Weaknesses in the vendor's security infrastructure or software could have been exploited. HealthEquity's Response and Next Steps HealthEquity has taken steps to strengthen its security environment and has assured investors that the incident is not expected to have a material adverse effect on its business. The company is in the process of notifying affected individuals and partners, and is evaluating potential remediation expenses and liabilities.

image for France Under Siege: ...

 Cybersecurity News

A coordinated attack on fiber optic cables disrupted multiple telecommunication services in France overnight. Major providers, including SFR, Free, and Alphalink, reported network outages and degraded performance, impacting both fixed-line and mobile users. The fiber optic cable sabotage incident, described as   show more ...  

"vandalism" by authorities, occurred in several regions across the country. While the capital, Paris, was spared, the timing of the attack during the Olympic Games has raised concerns about potential security threats. Fiber Optic Cable Sabotage Causes 'Extensive Damage' SFR, France's second-largest telecom operator, confirmed extensive damage to its long-distance cables. "Our long-distance fiber optic network was the victim of acts of vandalism last night in several departments. Disruptions may remain in the most impacted areas. All our teams are mobilized to allow you to connect again with those and what are essential to you," the telecom operator said. Data from NetBlocks, an internet traffic monitoring service, showed disruptions to multiple internet providers in France, including Adista, Alphalink and Free. [caption id="attachment_84414" align="aligncenter" width="1024"] Source: NetBlocks.org[/caption] Local media reported similar attacks on Bouygues Telecom infrastructure. The perpetrators, believed to be highly organized, targeted remote locations with precision. "This is an unprecedented attack on our digital backbone," declared a spokesperson for the French Ministry of the Interior. "The scale and precision of the operation indicate a high level of sophistication." French National Security Concerns Grow While the motive behind the sabotage remains shrouded in mystery, the attack has raised concerns about national security. "Disrupting communications can have a cascading effect on other critical systems," said a spokesperson for the French intelligence agency. "We are working closely with our partners to investigate this matter." French police told AFP news agency that the incident occurred in six areas of France. Paris, the current host of the Olympic Games, wasn’t affected. "The cables were located in places that are little known to the general public and that required precise information. They were likely damaged by highly equipped and organized individuals," the reports said. France's Minister of State for Digital Transition, Marina Ferrari, strongly condemned the act, emphasizing that telecom operators were working diligently to restore services. "I condemn in the strongest terms these cowardly and irresponsible acts," Ferrari said. The sabotage incident comes on the heels of coordinated attacks on France's high-speed railway, SNCF, last week. Authorities suspect far-left extremist groups may be responsible for both incidents, given their deliberate and targeted nature. France on High Alert France has been on high alert due to the Olympic Games, with increased security measures in place. The sabotage of critical infrastructure highlights the vulnerability of essential services to physical attacks. Meanwhile, a similar incident occurred in Finland, where a cell phone tower was toppled, disrupting mobile services for Elisa customers. While authorities investigate the cause, vandalism is a suspected motive. The interconnectedness of these attacks raises questions about potential links between the incidents. As investigations unfold, the world watches closely for updates on this developing situation.

image for Cyble Named Leader i ...

 Cybersecurity News

Atlanta, GA – July 26, 2024 – Cyble, a leading cyber threat intelligence 2024 provider, has been named the Leader in The Frost Radar™ Cyber Threat Intelligence 2024 by Frost & Sullivan, marking a significant milestone in the global cybersecurity landscape. This recognition highlights Cyble’s exceptional   show more ...  

capabilities and strategic impact within the cyber threat intelligence (CTI) industry, supporting clients with diverse CTI requirements. The Frost Radar™ is a renowned benchmarking system designed to drive action among companies by evaluating their performance across various criteria. Cyble’s inclusion in this esteemed quadrant highlights its innovative products, growth, and substantial contributions to advancing cyber threat intelligence. Cyble’s Distinguished Capabilities Cyble’s success is anchored in its scalable and efficient threat intelligence capabilities, which support businesses across various sectors globally. Key attributes contributing to Cyble’s recognition include: Premier SaaS Security Vendor: Cyble is positioned as a top-tier SaaS security vendor, providing comprehensive threat intelligence solutions that cater to the unique needs of its clients. Commitment to High-Quality Data: Cyble ensures high-quality data, enabling effective threat intelligence operationalization on its proprietary platform, thereby helping organizations stay ahead of potential threats. User-Friendly Platform: Cyble offers a user-friendly intelligence platform that is easily navigable by potential clients, ensuring seamless integration and utilization of its services. Investment in R&D: Continuous investment in research and development (R&D) initiatives secures Cyble a competitive edge in the ever-evolving cybersecurity landscape. “We’re absolutely thrilled to be recognized as a leader in the Frost Radar™ for Cyber Threat Intelligence, 2024,” said Beenu Arora, CEO of Cyble. “This accolade underscores our relentless drive for innovation and our commitment to pushing the boundaries of what’s possible. As cyber threats evolve, so do we—constantly enhancing our threat intelligence solutions to stay one step ahead and deliver unparalleled protection for our clients.” Strategic Growth and Innovation Frost & Sullivan’s analysis acknowledges Cyble as a top innovator in the cyber threat intelligence market, emphasizing its significant growth potential and strategic initiatives. Key highlights from the report include: Cyble Partner Network (CPN): This initiative has expanded Cyble’s reach and impact, fostering collaborative efforts to enhance cybersecurity measures across industries. Innovative Products: Products like Cyble Hawk and Odin by Cyble have been instrumental in establishing Cyble’s leadership in the CTI market. These products offer advanced threat detection and actionable insights, empowering organizations to proactively manage cybersecurity risks. Future Outlook The Frost & Sullivan report emphasizes Cyble’s impressive growth trajectory and future opportunities, positioning the company as a major player poised for further development and investment. This recognition not only validates Cyble’s past achievements but also highlights its potential for continued innovation and success in the cyber threat intelligence arena. For more information, please click here  About Cyble Cyble is a leading provider of cyber threat intelligence solutions, dedicated to delivering actionable insights and advanced threat detection for organizations globally. With a focus on innovation and excellence, Cyble empowers businesses to proactively manage and mitigate cybersecurity risks. Media Contact Cyble Inc Email: enquiries@cyble.com Phone: +1 888 673 2067

image for CISO’s Guide to Te ...

 Firewall Daily

The telecommunications industry stands at the crossroads of innovation and vulnerability. As one of the backbone industries of digital economies, telcos handle vast amounts of sensitive data, making them prime targets for cybercriminals. According to SecurityScorecard’s research, 85 per cent of the top telecom   show more ...  

companies in the US, UK, France and Germany experienced a third-party data breach in 2023. In this dynamic landscape, Chief Information Security Officers (CISOs) play a pivotal role in safeguarding networks and ensuring business continuity. Central to their arsenal is threat intelligence. Role of CISOs in Telecommunications Telecommunication companies operate in a hyper-connected environment, managing intricate networks, customer data, and critical infrastructure. Threat intelligence is the cornerstone of a robust cybersecurity strategy for telcos. It provides CISOs with actionable insights into the evolving threat landscape, enabling them to proactively defend their networks. Some of the key threats include: Advanced Persistent Threats (APTs): These are prolonged and targeted cyber-attacks where an intruder gains access to a network and remains undetected for an extended period. APTs can cause significant damage by exfiltrating sensitive data or disrupting services. In fact, Researchers from Symantec have discovered that various threat actors groups associated with Chinese state-linked espionage have been conducting a sustained hacking campaign targeting telecommunications operators in an unnamed Asian country since at least 2021. Ransomware: Ransomware attacks have surged, with cybercriminals encrypting critical data and demanding ransom payments for decryption keys. The downtime caused by such attacks can cripple telecommunication services. Infact, ransomware affected 72.7% of organizations globally in 2023, reported Statista, further highlighting the pervasive threat across diverse sectors. Supply Chain Attacks: Attackers exploit vulnerabilities in the supply chain, targeting third-party vendors to gain access to telecommunication networks. These attacks can be challenging to detect and mitigate. Insider Threats: Malicious insiders or employees inadvertently compromising security pose a significant risk. Insider threats can result in data breaches, unauthorized access, and service disruptions. Partnering with trusted vendors and enforcing stringent security protocols can effectively mitigate risks associated with supply chain vulnerabilities, thereby fortifying the telecom infrastructure against external threats. Leveraging Threat Intelligence for CISOs in Telecommunications Threat Intelligence for CISOs in Telecommunication is a game-changer in enhancing network resilience. It involves gathering, analyzing, and disseminating information about potential threats to inform decision-making and proactive defense measures. Here's how threat intelligence can be leveraged effectively: Proactive Threat Hunting: Threat intelligence enables CISOs to proactively hunt for Indicators of Compromise (IoCs) within their network. By identifying and neutralizing threats before they cause damage, CISOs can stay ahead of adversaries. Situational Awareness: Real-time threat intelligence provides CISOs with situational awareness of the threat landscape. This allows them to understand emerging threats, attack patterns, and TTPs used by cyber adversaries. Enhanced Incident Response: Threat intelligence feeds into incident response processes, providing valuable context and insights. CISOs can leverage this information to triage incidents, prioritize responses, and implement effective remediation measures. Threat Intelligence Sharing: Collaboration with industry peers, government agencies, and threat intelligence communities is essential. Sharing threat intelligence fosters a collective defense approach, enabling CISOs to benefit from the experiences and insights of others. Strategic Decision-Making: Threat intelligence informs strategic decisions regarding security investments, resource allocation, and policy development. CISOs can make data-driven decisions to strengthen their cybersecurity posture. Implementing Cyber Refresh in Telecommunication As cyber threats continue to evolve, CISOs in telecommunication must continuously refresh their cybersecurity strategies. A study by Deloitte outlines four key ways to propel a cyber refresh in the tech, media, and telecom sectors: Adopt Zero Trust Architecture: Zero Trust is a security model that assumes no user or device, inside or outside the network, can be trusted by default. Implementing Zero Trust principles involves verifying every access request and segmenting the network to limit the lateral movement of threats. Embrace Automation and AI: Automation and artificial intelligence (AI) can enhance threat detection and response capabilities. AI-driven analytics can identify anomalies and potential threats more quickly and accurately than traditional methods. Enhance Third-Party Risk Management: Given the prevalence of supply chain attacks, CISOs must rigorously assess and manage third-party risks. This includes conducting thorough due diligence, continuous monitoring, and enforcing security requirements for vendors. Foster a Cybersecurity Culture: Building a cybersecurity culture involves engaging all employees in security practices. Regular training, awareness programs, and incentivizing secure behaviors are critical components. Threat Intelligence for CISOs in telecommunication is a vital component of a resilient cybersecurity strategy. By leveraging threat intelligence, CISOs can proactively defend against evolving threats, enhance incident response, and make informed strategic decisions. For robust protection against dark web threats and to safeguard your telecom infrastructure, Cyble offers specialized cybersecurity solutions designed to protect your network from the evolving threats. Its AI-powered platform provides continuous threat monitoring and in-depth analysis to safeguard your sensitive data and customer information. By partnering with Cyble, you can proactively identify and mitigate risks, ensuring the resilience of your telecommunications operations. Download the latest report or schedule a demo today to see how Cyble can integrate seamlessly with your existing security framework and help you stay ahead of online threats. Discover more by scheduling a demo today!

image for Casper Network Pause ...

 Firewall Daily

Casper Network has halted all operations due to a cyberattack on its blockchain platform. The Casper Network security breach was detected by the IT team, who swiftly collaborated with network validators to freeze the system and prevent any further exploitation. This measure aims to safeguard user assets and maintain   show more ...  

the integrity of the network. The suspension took effect at block 3,329,418, era 14544, and effectively froze all transactions, including transfers, minting, and staking. This decisive action is part of an effort to shield users and their assets while the underlying security issues are thoroughly investigated and resolved. Decoding Casper Network Security Breach Incident In an official statement posted on their X (previously known as Twitter) account, the blockchain company has addressed the Casper Network security breach: Stating "Dear Community, We discovered a significant security breach on the Casper Network. To minimize the effects of this security breach, we have worked with the validators to halt the network until this security breach has been patched. We will have further updates as we investigate the situation." [caption id="attachment_84311" align="alignnone" width="730"] Source: Casper Network[/caption] The Casper Association, in collaboration with Casper Labs and the network’s validators, is actively working to resolve the breach. According to an official statement from the Casper Association, "Casper Association, Casper Labs, and the Validators/community are actively working to resolve the issue. The network has been halted and the security breach is contained. The issue has been identified, and a solution is being worked on. Further updates will be provided." As part of its commitment to transparency, Casper Network plans to release a detailed post-mortem report outlining the breach and the measures taken to address it. Additionally, any code updates resulting from the breach will be made available on Casper’s GitHub repository. While the Casper Network team has not specified when operations will resume, users and stakeholders are encouraged to stay updated through official Casper Network communication channels. Immediate Response to the Casper Network Security Breach Preliminary reports suggest that the Casper Network cyberattack primarily impacted several large accounts. While the exact details and extent of the damage are still being assessed, Casper Network has assured users that all possible measures have been taken to protect their accounts and prevent additional breaches. Despite the blockchain activities being paused, trading of $CSPR, the platform's native cryptocurrency, continues on exchanges. This decision aims to maintain liquidity and allow token holders to use their tokens while the security issues are addressed. [caption id="attachment_84313" align="alignnone" width="727"] Source: Casper Network[/caption] The response from the Casper Network community, including validators and developers, has been swift and collaborative. This coordinated effort highlights the community's commitment to securing the network and addressing the breach. Casper Network officials have assured the community that they are working diligently to resolve the issue and will implement necessary changes to prevent future incidents. The cyberattack on Casper Network highlights ongoing security concerns within the cryptocurrency industry. Similar breaches have affected other platforms recently, such as Scroll Network’s Rho Markets, which was shut down due to vulnerabilities linked to Oracle controls, resulting in approximately $7.6 million in losses. Another notable incident involved the Indian exchange WazirX, where around $230 million was stolen, prompting the exchange to propose a detailed recovery plan.

image for Comparing From and R ...

 Business

Weve recently improved the accuracy of detecting spear phishing and business email compromise (BEC) attacks by adding a tiny but important check to our email security products. Now, if our mail-protection engine flags an email as suspicious for whatever reason, we match the domain in the From header against that in   show more ...  

the Reply To header. And its surprisingly effective; this simple check succeeds in weeding out a large portion of rather sophisticated attacks. Heres how it works. How to detect sophisticated email attacks? Spear phishers who carry out targeted email attacks traditionally go to great lengths to make their emails seen legitimate. These arent the kind of bad guys who email out attachments with Trojans inside; instead, they tend to hide phishing links under multiple layers of subterfuge. And this is why security solutions capable of detecting targeted emails rarely deliver a verdict based on a single criterion, but rather on a combination of suspicious signs. Matching the From and Reply To fields is one of these criteria. How does matching the headers help? Most attackers, even when compromising business correspondence, dont bother hacking legitimate domains. Instead, they exploit the often-limited expertise of mail-server administrators. In fact, on a huge number of domains, mail authentication methods — like Sender Policy Framework (SPF), and especially Domain-based Message Authentication, Reporting, and Conformance (DMARC) — dont work very effectively (if at all). In the best-case scenario, these mechanisms are technically enabled, but configured so loosely to avoid false positives that they become practically useless. This laxity allows threat actors (sometimes including those behind full-blown APT attacks) to simply take the domain of the targeted organization and put it in the From, or even the SMTP From header. However, since they dont want to just deliver an email, but also get a direct reply to it, they have to put their own address in the Reply To field. This tends to be a disposable email address or an address hosted on a free email service. And thats what gives them away. From and Reply To headers in the suspicious letter Why not match the headers all the time? From and Reply To dont always have to match. There are many legitimate cases when an email may be sent from one mail server, but the reply is expected to another. The simplest example of this is newsletters and marketing emails: a specialized mailing-service provider sends them, but its client is the one whos interested in the responses. Therefore, if the From and Reply To check were always enabled, itd generate false positives. Wheres the technology deployed? The check is integrated into all our corporate email security products: Kaspersky Security for Microsoft Exchange Server, Kaspersky Security for Office 365, Kaspersky Security for Linux Mail Server, and Kaspersky Secure Mail Gateway.

image for NVD Backlog Continue ...

 Feed

Despite getting help, NIST is not keeping up with new vulnerability reports for the National Vulnerabilities Database, according to an analysis from Fortress Information Security.

 Incident Response, Learnings

The operation started in France on July 18, 2024, and is anticipated to extend to other countries like Malta, Portugal, Croatia, Slovakia, and Austria. Victims in France will be individually notified by the ANSSI about the clean-up process.

 Trends, Reports, Analysis

Most CISOs are feeling unprepared for new compliance regulations, such as the SEC’s cybersecurity disclosure rules in the USA and the Digital Operational Resilience Act (DORA) in the EU, presenting a significant challenge.

 Trends, Reports, Analysis

The National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST), currently has a backlog of over 16,000 vulnerabilities, with an average daily influx of more than 100 new security flaws.

 Feed

An authenticated command injection vulnerability exists in MyPRO versions 8.28.0 and below from mySCADA. The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITYSYSTEM.

 Feed

Ubuntu Security Notice 6926-1 - 黄思聪 discovered that the NFC Controller Interface implementation in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service. It was   show more ...  

discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service.

 Feed

Debian Linux Security Advisory 5734-2 - The security update announced as DSA 5734-1 caused a regression on configurations using the Samba DLZ module. Updated packages are now available to correct this issue.

 Feed

Ubuntu Security Notice 6921-1 - Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor   show more ...  

could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

Ubuntu Security Notice 6923-1 - Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor   show more ...  

could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

Ubuntu Security Notice 6922-1 - It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. Chenyuan Yang discovered that the Unsorted Block Images flash   show more ...  

device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service.

 Feed

Ubuntu Security Notice 6920-1 - It was discovered that EDK II was not properly performing bounds checks in Tianocompress, which could lead to a buffer overflow. An authenticated user could use this issue to potentially escalate their privileges via local access. It was discovered that EDK II had an insufficient memory   show more ...  

write check in the SMM service, which could lead to a page fault occurring. An authenticated user could use this issue to potentially escalate their privileges, disclose information and/or create a denial of service via local access.

 Feed

Ubuntu Security Notice 6916-1 - It was discovered that Lua did not properly generate code when "_ENV" is constant. An attacker could possibly use this issue to cause a denial of service or execute arbitrary unstrusted lua code. It was discovered that Lua did not properly handle C stack overflows during error handling. An attacker could possibly use this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 6918-1 - It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

Ubuntu Security Notice 6919-1 - Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. It was discovered that the ATA over   show more ...  

Ethernet driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 6917-1 - Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. Gui-Dong Han discovered that the software   show more ...  

RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service.

 Feed

Red Hat Security Advisory 2024-4902-03 - An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Issues addressed include double free and null pointer vulnerabilities.

 Feed

The remote access trojan known as Gh0st RAT has been observed being delivered by an "evasive dropper" called Gh0stGambit as part of a drive-by download scheme targeting Chinese-speaking Windows users. These infections stem from a fake website ("chrome-web[.]com") serving malicious installer packages masquerading as Google's Chrome browser, indicating that users searching for the software on the

 Feed

A threat actor known as Stargazer Goblin has set up a network of inauthentic GitHub accounts to fuel a Distribution-as-a-Service (DaaS) that propagates a variety of information-stealing malware and netting them $100,000 in illicit profits over the past year. The network, which comprises over 3,000 accounts on the cloud-based code hosting platform, spans thousands of repositories that are used to

 Feed

An unknown threat actor has been linked to a massive scam campaign that exploited an email routing misconfiguration in email security vendor Proofpoint's defenses to send millions of messages spoofing various legitimate companies. "These emails echoed from official Proofpoint email relays with authenticated SPF and DKIM signatures, thus bypassing major security protections — all to deceive

 Feed

Searchable Encryption has long been a mystery. An oxymoron. An unattainable dream of cybersecurity professionals everywhere. Organizations know they must encrypt their most valuable, sensitive data to prevent data theft and breaches. They also understand that organizational data exists to be used. To be searched, viewed, and modified to keep businesses running. Unfortunately, our Network and

 Feed

Cybersecurity company Acronis is warning that a now-patched critical security flaw impacting its Cyber Infrastructure (ACI) product has been exploited in the wild. The vulnerability, tracked as CVE-2023-45249 (CVSS score: 9.8), concerns a case of remote code execution that stems from the use of default passwords. The flaw impacts the following versions of Acronis Cyber Infrastructure (ACI) - &

 Data loss

Hackers have released internal documents stolen from one of America's largest IT services providers, which counts various US government agencies, including the Department of Defense, amongst its customers. Read more in my article on the Hot for Security blog.

2024-07
Aggregator history
Monday, July 29
MON
TUE
WED
THU
FRI
SAT
SUN
JulyAugustSeptember