January 27, 2024 - Red N Security

Hello all,

This week Microsoft made our headline news an inordinate number of times, read on for details.

The volume of news and other can appear overwhelming, the best strategy is to read the Notable Callouts below and then skim the full list of linked news item titles that follow for things that pertain to you or your environment or simply interest you, and then selecting them for more information. So, let’s get to it. And don’t forget, our site, https://red-n-security.com also has searchable archives of past newsletters.

Notable Callouts:

Apple rolled out software version updates for most current products, patching a critical zero-day in iPhones and Macs dealing with a type confusion in Webkit and fixing over a dozen security items in other areas. The iFruit company also backported a pair of patches for some older products that were fixed last month for current products.
Cisco patched vulnerabilities in Unified Communications and Contact Center Solutions products that if exploited could result in Remote Code Execution up to root level access. There is no work-around, patch, and patch now if you have this in your enterprise.
HPE revelated in a Form 8-K SEC filing that they were informed that their Office 365 email accounts had been breached by the “Nobelium, aka Cozy Bear, aka Midnight Blizzard aka APT29” dirt-bag group. It would be nice if this was an isolated incident, but it is not. Read on.
Jenkins automation server has released patches for several vulnerabilities. There is a critical RCE among them and risk of data deletion, so patch quickly!
Microsoft revealed that due to a misconfiguration, a forgotten test account was left active with administrator permissions, without 2FA on it, and was successfully hacked via a password spray attack. The same dirt-bags as above with HPE were identified to be behind this attack that went undetected for several months. But it gets worse. Microsoft first said that no evidence showed that other companies were breached. But there’s the HPE event above, which so far has not been confirmed to be related. And yet Microsoft admitted late this week that yes others were affected and that they have been contacting companies that were breached. But wait, there’s more! In response to the attacks, Microsoft has published new guidance on rogue OAuth applications, which is apparently how Cozy Midnight dirt-bag managed to stay embedded in Microsoft’s network undetected for so long. This is getting scary.
Microsoft in what I hope is an unrelated news item, had much of their Microsoft Teams infrastructure decide to take the day off this past Friday. Workers worldwide were treated to a somewhat quite meetingless and chatless day. Redmond did manage to restore access late in the day on Friday.
Splunk patched several vulnerabilities in their Enterprise product, including one rated as high. The recommended fix is to upgrade Splunk Enterprise installations to version 9.0.8, 9.1.3 or greater.

In Ransomware, Malware, and Vulnerabilities News:

Deepfakes are in the news again with Microsoft’s Satya Nadela expressing outrage on NBC Nightly news over deepfake of a certain celebrity engaged in sexual acts, and the need for global “guardrails” around the technology that makes it possible. In a related article, many New Hampshire primary voters received robocalls from “President Biden” urging them to not vote in the primary. I hate to say it, but the technological deep-fake cat is out-of-the-bag, and I don’t see it going back in anytime soon. Criminals will continue criminal behavior despite rules or “guardrails”.
SEC confirmed that their X account (former Twitter) was hijacked via a SIM swap and due to the lack of 2FA on their account. No comment.

In Other News Events of Note and Interest:

Lauderdale, FL in a bit of good news, managed to recover $1.2 million dollars that were stolen from them via BEC scam last year. Score one for the good guys!
Microsoft had their market valuation top $3 trillion dollars last week, making only the second company after Apple to reach that level.

In Cyber Insurance News:

K-12 Cybersecurity Spending is increasing along with their insurance costs. Based on the incredible number of successful attacks against schools in the past year, this headline is somewhat of a no-brainer. Their security must improve, and insurers must cover their losses.

More than a few of the headlines this week were breaches or takeovers that resulted due to poor security practices. What’s sad is many were preventable. Most would have been stopped by just having 2FA (two factor authentication) enabled on accounts, even if it is just an SMS message (the least secure form of 2FA) it would have been better than nothing. Why is SMS considered least secure? Go back and reread the SEC’s tale of hijack woe. Their SIM was swapped to the threat actor’s phone. So, any SMS 2FA would have gone to the bad guy. But in Microsoft’s case, 2FA would have blocked the password spray attack since even if the dirt-bag got the right password, they would have no way to correctly answer the 2FA challenge. Nearly every account out there has some form of 2FA available to be enabled. Don’t be a victim. As Nike says, “Just do it”.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Cyber Insurance News