Using two laptops

Insider threats

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

This week we have seen multiple cases of one of the harder issues in security, the insider threat.
Two former employees of twitter have been charged with spying on Twitter users for Saudi Arabia, together with a third man with ties to the Saudi royal family. According to court documents they were working together, using twitters internal systems to unmask  critics of the Kingdom and other users of Twitter.
Trend Micro also suffered from an insider attack where an employee accessed and sold customer data to a malevolent third party. Trend started getting suspicious after customers started getting calls from scammers claiming to be from Trend Micro support. The employee was fired after a three month investigation by Trend micro, and is now investigated by law enforcement.  You can read more about both cases here.

The Cybersecurity Insiders 2020 Insider Threat Report came out, and found that more than half of the organizations that participated believes that insider threats are harder to follow up in cloud environments. Meaning that the trend of offloading to the cloud could increase risk on unexpected levels.

Insider threats are one of the more complex issues in security with different challenges depending on a lot of factors, and organizations need to focus on what the challenges are for their specific organization, and find preventive measures that works in their environment.

Top 5 Security News

BlueKeep Attacks Have Arrived, Are Initially Underwhelming
Cybersecurity Skills Shortage Tops Four Million
Bug Hunters Hack Samsung Galaxy S10, Xiaomi Mi9 at Pwn2Own
Wizard Spider Upgrades Ryuk Ransomware to Reach Deep into LANs
Facebook reveals another privacy breach, this time involving developers

Happy Birthday, CVE!

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

It was October 1999. Macs had just got embedded Wi-Fi, Napster had launched, and Yahoo had purchased Geocities for $3.6bn. Something else happened that escaped most computer users at the time: CVE posted its first bug. The Common Vulnerabilities and Exposures (CVE) system is 20 years old this week.

Created by the non-profit Mitre Corporation, which oversees several federal government programs, CVE provides common identifiers for cybersecurity bugs, making them easier to track and fix.

Read more

Top 5 Security News

New Chrome 0-day Bug Under Active Attacks – Update Your Browser Now!

DNS over HTTPS Will Give You Back Privacy that Big ISPs Fought to Take Away

32,000+ WiFi Routers Potentially Exposed to New Gafgyt Variant

Breaches at NetworkSolutions, Register.com, and Web.com

Fake Voicemail/Office 365 Attack Targets Enterprise Execs

Do you know about all equipment connected in you operation, really?

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

Pen Test Partners has a great blog-post about one of their recent adventures.

This is a little bit out of the normal scenario for many, but this is regarding a finding they did on a ship. This is a good reminder to all to cover critical control number 1, inventory and control of hardware assets. It is not so easy to track this down on the spot when you got unlabeled shielded cables and deck penetration to deal with, no known paperwork or invoices related to the thing they found. They have a nice write up of what they did, what considerations they had to make.

Spoiler: In the end they figure out it is an outdated Windows machine, complete with TeamViewer installed, originating from a contract that had been expired for several years. And this machine had direct connection to the main engine of the ship.

Top 5 Security News
Sudo vulnerability discovered in Linux (CVE-2019-14287)
Cozy Bear Russian Hackers Spotted After Staying Undetected for Years
Researchers at Adaptive Mobile security release report concerning SimJacker attacks
What Your Personal Information is Worth to Cybercriminals
Help! I bought a domain and ended up with a stranger’s PayPal! And I can’t give it back

 

Photo by Vidar Nordli-Mathisen on Unsplash

Never Trust a Platform to Put Privacy Ahead of Profit

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

“If you wanted to secure the phone numbers you’d just put them in a database table called ‘2FA numbers don’t sell to marketers,'” says Matthew Green, a cryptographer at Johns Hopkins University. “This stuff is like a bank leaving customers’ money lying around and then spending it on snacks. Obviously that could happen. We just try to prevent it from happening because, you know, ethics.”

Read more in the Wired article

Top 5 Security News

Almost 50% of Company Network Traffic Comes From Bots, Report Says

New Microsoft NTLM Flaws May Allow Full Domain Compromise

Breaches are now commonplace, but Reason Cybersecurity lets users guard their privacy

Father of Unix Ken Thompson checkmated as his old password has finally been cracked

Copy-and-paste sharing on Stack Overflow spreads insecure code

 

Unpatched Bug Under Active Attack Threatens WordPress Sites with XSS

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

 

An unpatched vulnerability in the Rich Reviews plugin for WordPress is putting an estimated 16,000 sites in danger of stored cross-site scripting (XSS) attacks.

Sites running the plugin are vulnerable to unauthenticated plugin option updates, which can be used to deliver malware payloads; and according to Wordfence, attacks are already happening in the wild.

Read more

 

Top 5 Security News

Microsoft rushes out fix for Internet Explorer zero-day

Magecart Group Continues Targeting E-Commerce Sites

iOS 13 Bug Lets 3rd-Party Keyboards Gain ‘Full Access’ — Even When You Deny

Why You Need to Think About API Security

HTTP/3: the past, the present, and the future

Millions of passenger data publicly accessible in cloud storage buckets

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

The breach, which reportedly exposed data on millions of passengers, is one of many that have resulted from organizations leaving data publicly accessible in cloud storage buckets.

Read more

 

Top 5 Security News

Robocalls now flooding US phones with 200m calls per day

Is Your Medical Data Safe? 16 Million Medical Scans Left Out in the Open

GitHub gobbles biz used by NASA, Google, etc to search code for bugs and security holes in Mars rovers, apps…

LastPass Fixes Bug That Leaks Credentials

Huawei suspended from the Forum of Incident Response and Security Teams

DNS-over-HTTPS, a curse or a blessing?

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

“Mozilla plans to enable support for the DNS-over-HTTPS (DoH) protocol by default inside the Firefox browser for a small number of US users starting later this month.

When DoH support is enabled in Firefox, the browser will ignore DNS settings set in the operating system, and use the browser-set DoH resolver.

By moving DNS server settings from the OS to the browser level, and by encrypting the DNS traffic, DoH effectively hides DNS traffic from internet service providers (ISPs), local parental control software, antivirus software, enterprise firewalls and traffic filters, and about any other third-party that tries to intercept and sniff a user’s traffic.” according to Catalin Cimpanu for Zero Day.

This is causing some controversy and might affect current mitigating measures in place at businesses.

Read more

Top 5 Security News

Initial Metasploit Exploit Module for BlueKeep (CVE-2019-0708)

18 months after indictment, Iranian phishers are still targeting universities

Instagram Confirms Security Issue Exposed User Accounts And Phone Numbers—Exclusive

Simjacker attack exploited in the wild to track users for at least two years

State-sponsored entities targeting Airline Industry (Part 1)

Crimeware

Crimeware in the Modern Era

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

“Crimeware is a cornerstone to financially motivated threat actors’ toolsets and sees consistent and continuous evolution in its operation. Crimeware developers have demonstrated resilience in the face of an evolving security landscape and law enforcement actions through constant shifts and updates to their tools, techniques, and procedures. This has resulted in a perennial back and forth between criminally-minded attackers and budget-constrained defenders.” according to Brandon Levene the Head of Applied Intelligence (Chronicle) at Google

Read more

Top 5 Security News

PowerShell Script with a builtin DLL

Google throws bug bounty bucks at mega-popular third-party apps

AI mimics CEO voice to scam UK energy firm out of £200k

Facebook loses control of key used to sign Android app

Exim – local or remote attacker can execute programs with root privileges (CVE-2019-15846)

 

 

Backdoor Found in Utility for Linux, Unix Servers

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

Backdoor was intentionally planted in 2018 and found during the DEF CON 2019 security conference when researchers stumbled upon malicious code.

In an unnerving twist, when a critical zero-day vulnerability was reported in a Unix administration tool, called Webmin, it was revealed the flaw was no accident. According to researchers, the vulnerability was a secret backdoor planted in the popular utility nearly a year before its discovery.

Read more

Top 5 Security News

A Telegram bug that disclose phone numbers of any users in public groups

GitHub supports Web Authentication (WebAuthn) for security keys

I Visited 47 Sites. Hundreds of Trackers Followed Me.

Forced Password Reset? Check Your Assumptions

Bumper Cisco patches fix four new ‘critical’ vulnerabilities

Don’t let encrypted messaging become a hollow promise

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

Why do we care about encryption? Why was it a big deal, at least in theory, when Mark Zuckerberg announced earlier this year that Facebook would move to end-to-end encryption on all three of its messaging platforms? We don’t just support encryption for its own sake. We fight for it because encryption is one of the most powerful tools individuals have for maintaining their digital privacy and security in an increasingly insecure world.

Read more

Top 5 Security News

Your Android Phone Can Get Hacked Just By Playing This Video

Apple bleee. Everyone knows What Happens on Your iPhone

EvilGnome – Linux malware aimed at your laptop, not your servers

Citrix Confirms Password-Spraying Heist of Reams of Internal IP

New IPS Architecture Uses Network Flow Data for Analysis