CyberSecure Specialist

02 Dec

The CHRISTMA EXEC network worm – 35 years and counting!

Information, Malware

by Paul Ducklin Forget Sergeant Pepper and his Lonely Hearts Club Band, who taught the band to play a mere 20 years ago today. December 2022 sees the 35th anniversary of the first major self-spreading computer virus – the infamous CHRISTMA EXEC worm that temporarily crushed the major mainframe networks of the day… … not by any deliberately coded side-effects such as file scrambling or data deletion, but simply by leeching too much network bandwidth…

Read More
02 Dec

LastPass admits to customer data breach caused by previous breach

Information

by Paul Ducklin Back in August 2022, popular password manager company LastPass admitted to a data breach. The company, which is owned by sofware-as-a-service business GoTo, which used to be LogMeIn, published a very brief but nevertheless useful report about that incident about a month later: Briefly put, LastPass concluded that the attackers managed to implant malware on a developer’s computer. With a beachhead on that computer, it seems that the attackers were then able…

Read More
01 Dec

The top 10 hacks and cyber security threats of 2022

Attacks, Data Breaches

Cyber crime is an ever-evolving problem, with an estimated cost of US$10trn by 2025. In 2021, there were over 4,100 publicly disclosed data breaches, which represents approximately 22 billion records exposed. The figures for 2022 are expected to at least match this, or potentially exceed it by as much as five percent.  Cyber Security Hub is dedicated to delivering breaking news from the cyber security sector. With this in mind, here are the news stories…

Read More
01 Dec

ConnectWise Quietly Patches Flaw That Helps Phishers

Information, Insights

ConnectWise, which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs), is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The warning comes just weeks after the company quietly patched a vulnerability that makes it easier for phishers to launch these attacks. A phishing attack targeting MSP customers using ConnectWise. ConnectWise Control is…

Read More
01 Dec

Researchers Disclose Critical RCE Vulnerability Affecting Quarkus Java Framework

Attacks, Malware

It is highly recommended for all users of the Quarkus Java framework to update to versions 2.14.2.Final and 2.13.5.Final (LTS) to fix the exploit as soon as possible. This fix forces the Dev UI to check the origin header of the request and only accept requests where the value is localhost. Since this header is set by the browser and is not modifiable by JavaScript run within the browser, exploitation of this vulnerability cannot be…

Read More
01 Dec

LastPass Says Hackers Accessed Customer Data in Most Recent Breach

Attacks, Malware

LastPass reminded customers their master password should be extremely strong and unique, and should never be reused. Additionally, users should set up multi-factor authentication (MFA). MFA combines biometric and contextual factors to establish identity – something you know (a password), something you have (a mobile device), and something you are (a biometric). LastPass provided the following instructions to ensure customer accounts are set up properly and secured. https://blog.lastpass.com/2022/01/how-to-set-up-your-new-lastpass-account/ https://www.bleepingcomputer.com/news/security/lastpass-says-hackers-accessed-customer-data-in-new-breach/

Read More
01 Dec

Southampton County Confirms Lockbit 3.0 Ransomware Attack

Attacks, Malware

Free credit and identity monitoring has been offered to those impacted by the event; it is highly recommended that affected users should take advantage of these services. Throughout the investigation process, no evidence of misuse or redistribution of the information was found by Southampton County. However, this assertion of low impact was proven to be false after snippets of data were posted, demonstrating the uncertainty and risks that emerge in the aftermath of ransomware attacks.…

Read More
01 Dec

Wipers Are Widening: Here’s Why That Matters

Information, Malware, News

In the first half of this year, researchers saw a rising trend of wiper malware being deployed in parallel with the Russia-Ukraine war. However, those wipers haven’t stayed in one place – they’re emerging globally, which underscores the fact that cybercrime knows no borders.  It’s not just the numbers that are growing; we’re also seeing a rise in variety and sophistication. These wiper varieties are also increasingly targeting critical infrastructure. Awash with wipers  The war…

Read More
01 Dec

#StopRansomware: Cuba Ransomware 

Attacks, Insights, Malware

Original release date: December 1, 2022 Today, the Federal Bureau of Investigation (FBI) and CISA released a joint Cybersecurity Advisory (CSA) #StopRansomware: Cuba Ransomware to provide network defenders tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with Cuba ransomware. FBI investigations identified these TTPs and IOCs as recently as August 2022. This CSA updates the December 2021 FBI Flash: Indicators of Compromise Associated with Cuba Ransomware. Key updates include: FBI has identified a…

Read More
01 Dec

Researchers found security pitfalls in IBM’s cloud infrastructure

Data Breaches, Malware, Social Engineering

Security researchers recently probed IBM Cloud’s database-as-a-service infrastructure and found several security issues that granted them access to the internal server used to build database images for customer deployments. The demonstrated attack highlights some common security oversights that can lead to supply chain compromises in cloud infrastructure. Developed by researchers from security firm Wiz, the attack combined a privilege escalation vulnerability in the IBM Cloud Databases for PostgreSQL service with plaintext credentials scattered around the…

Read More