CyberSecurity Updates

27 Oct

5 tips to help children navigate the internet safely

Information

The online world provides children with previously unimagined opportunities to learn and socialize, but it also opens them up to a range of hazards. How can you steer kids toward safe internet habits? The way our digital lives have become entangled with our physical world has brought new, major challenges for parents, caregivers and teachers. Not only because it is essential to teach children how to read and understand information online and generally navigate the…

Read More
27 Oct

What to consider before disposing of personal data – Week in security with Tony Anscombe

Information

A major financial services company has learned the hard way about the importance of proper disposal of customers’ personal data The U.S. Securities and Exchange Commission (SEC) has announced that Morgan Stanley has agreed to pay a penalty of $35 million for exposing the personal information of 15 million customers. According to SEC, the financial services company failed to properly dispose of hard drives and servers that contained the personal data of its customers. The…

Read More
27 Oct

Parcel delivery scams are on the rise: Do you know what to watch out for?

Information

As package delivery scams that spoof DHL, USPS and other delivery companies soar, here’s how to stay safe not just this shopping season Where there are users to be scammed and money to be made, cybercriminals won’t be far behind. So it was during the pandemic, when internet users eager to get hold of the latest COVID news were susceptible to scams. At one point, Google claimed to be blocking 18 million daily phishing emails…

Read More
27 Oct

Online ticketing company “See” pwned for 2.5 years by attackers

Information

by Paul Ducklin See Tickets is a major global player in the online event ticketing business: they’ll sell you tickets to festivals, theatre shows, concerts, clubs, gigs and much more. The company has just admitted to a major data breach that shares at least one characteristic with the amplifiers favoured by notorious rock performers Spinal Tap: “the numbers all go to 11, right across the board.” According to the email template that See Tickets used…

Read More
26 Oct

How to update your Windows driver blocklist to keep malicious drivers away

Data Breaches, Malware, Social Engineering

For many years, attackers have used and abused various ways to get on our systems. From phishing to tricking us to click on websites, if an attacker can get their code on our systems they are no longer our systems. Attackers will even invest the time, energy, and expense to get their malicious drivers approved and co-designed through the Windows Hardware Compatibility Program in order to gain access to our machines. Ensuring that these malicious…

Read More
26 Oct

VMware Releases Patch for Remote Code Execution Bug In Cloud Foundation

Attacks, Malware

As always, it is highly recommended to patch any appliances using vulnerable versions of software and to implement a plan for regular updates.In the event that applying the official patch is not immediately feasible, VMware has also released a temporary workaround: https://kb.vmware.com/s/article/89809 https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-cloud-foundation-remote-code-execution-bug/

Read More
26 Oct

Cisco Warns Admins to Patch AnyConnect Flaw Exploited in Attacks

Attacks, Malware

The U.S. cybersecurity agency also strongly urged all organizations worldwide to prioritize patching these security bugs, even though BOD 22-01 only applies to U.S. FCEB agencies. Organizations are recommended to create a patch management policy to verify that all current systems are kept up to date. https://www.bleepingcomputer.com/news/security/cisco-warns-admins-to-patch-anyconnect-flaw-exploited-in-attacks/

Read More
26 Oct

Unknown Actor Deploying RomCom RAT to Target Ukrainian Military

Attacks, Malware

Researchers at BlackBerry noted, “this campaign is a good example of the blurred line between cybercrime-motivated threat actors and targeted attack threat actors” and it highlights the difficulty of attribution in many campaigns. In the past, the activities of the two groups of threat actors had been largely independent, with targeted attack threat actors relying on custom tooling while cybercrime-motivated threat actors would typically rely on traditional tooling. However, as time goes on and traditional…

Read More
26 Oct

Apple Releases Security Updates for Multiple Products 

Attacks, Insights, Malware

Original release date: October 26, 2022 Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device.    CISA encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible:  •    Safari 16.1  •    iOS 16.1 and iPadOS 16  •    macOS Big Sur 11.7.1  •    macOS Monterey 12.6.1…

Read More
26 Oct

VMware Patches Critical Vulnerability in End-of-Life Product

Information, News

VMware this week announced patches for a critical remote code execution vulnerability in VMware Cloud Foundation and NSX Data Center for vSphere (NSX-V). Tracked as CVE-2021-39144 (CVSS score of 9.8), the security defect exists in XStream, an open source library to serialize objects to XML and back. The bug impacts all XStream iterations until and including version 1.4.17. Only out-of-the-box versions are affected, but not those where XStream’s security framework was set up with a…

Read More