Weekly Cyber Security
News Events &Information
From sources found online in the past seven days
Hello all,
This week was blissfully quiet in comparison to last week’s flood of items that screamed for attention. Note the in comparison… there are still plenty of vulnerabilities, reveals, patches, and interesting news items, and if your enterprise is affected, judicious action is warranted. So, onward.
The volume of news and other can appear overwhelming, the best strategy is to read the Notable Callouts below and then skim the full list of linked news item titles that follow for things that pertain to you or your environment or simply interest you, and then selecting them for more information. So, let’s get to it. And don’t forget, our site, https://red-n-security.com also has searchable archives of past newsletters.
Notable Callouts:
- Apple loses top phone maker spot to Samsung. While global smartphone shipments went up 7.8% in the first quarter of 2024, Apple’s piece of that pie dropped by 10%. Samsung was propelled to the number 1 spot and now has a 20.8% market share, with Apple following at 17.3%. I was just discussing with a colleague how Apple appears to have lost its innovative edge. Time will tell if they can regain their mojo.
- Cisco has a cyber security arm named Talos that puts out some excellent intelligence. They just alerted the world to a massive brute-force campaign targeting VPN services. They’ve observed attacks against VPNs from Cisco Secure Firewall, CheckPoint, Fortinet, SonicWall, Ubiquiti, and more. I cannot state this stongly enough, get MFA on your VPNs! It effectively mitigates this type of attack, provided there are no software vulnerabilities that allow bypass. Check your logs, if you’re being targeted and don’t have MFA, it may already be too late. But, if not, I’d recommend shutting off VPN access until you get MFA enabled or other mitigations, such putting IP restrictions into place.
- Cisco released patches for a high-severity vulnerability in their Integrated Management Controller (IMC). An authenticated attacker is able to escalate to root level access unless the patch is applied. Proof of Concept code already exists, so patch soon if you have affected hardware.
- CrushFTP, a cross-platform FTP server, revealed a critical vulnerability that allows for access to the filesystem for all versions below 10.7.1 and 11.1.0. If directly on the internet, there is no mitigation, you need to update to fix the issue.
- Frontier Communications was successfully attacked recently and had to shut down a portion of their systems due to unauthorized access. In their SEC filing they wrote, “Based on the Company’s investigation, it has determined that the third party was likely a cybercrime group, which gained access to, among other information, personally identifiable information”. Obviously, there will be more to this once the investigation yields more results.
- Ivanti is in the news again. They just released patches for 27 vulnerabilities in Ivanti Avalanche, a mobile device management system. While I do find the quantity of items disturbing, it should be noted that this is expected, since On April 3, 2024, Ivanti’s CEO publicly committed to a major code review for vulnerabilities and problems. It would follow that this is the outflow from that effort. According to Ivanti, none of the flaws are known to be exploited – yet. Patch quickly.
- Juniper Networks has released dozens of new patches. Check if your products need updates and get it done quickly. Threat Actors are standing by to assist with a post-paid Pen Test if you don’t.
- MITRE, the 65+ year old security company experienced a breach via, I hate to say it, Ivanti’s ConnectSecure product’s zero-day vulnerabilities. MITRE has published a very well worded synopsis of the event. One statement particularly caught my attention and causes my heart to beat a bit faster – skipping a few beats too, “No organization is immune from this type of cyber attack, not even one that strives to maintain the highest cybersecurity possible,” said Jason Providakes, president and CEO, MITRE.” His statement underscores why it is vital to have layers of defense, and to have a tested/proven way to recover.
- Palo Alto Networks spoiled some admins’ weekends last week when they announced a zero-day vulnerability that they didn’t have a patch for yet, but for which they offered mitigation guidance. It turns out that the mitigation didn’t work. Thankfully, patches now exist for affected products. So, if yours is on the list. Patch yesterday!
- Security Bite from 9to5Mac revealed the staggering rise of the cost of cyber-crime. They quote a Statista Markets Insights survey that predicts that the “annual cost of cyberattacks will reach $9.2 trillion this year.” I’ll just let that number sink in. The article is a good read.
In Ransomware, Malware, and Vulnerabilities News:
- Hive Rat creators arrested in Australia and in the US. And an additional person was arrested for crypto mining crimes. Score three for the good guys!
- Home Depot had a massive leak on aisle 13. One of their SaaS vendors accidentally made public a list of employees, exposing 10,000 of them to anyone that was able to get their mitts on it before it was noticed. The report has an amazing statistic in it, “According to the Global Third-Party Cybersecurity Breach Report by the IT risk management firm SecurityScorecard, 98% of organizations are affiliated with a breached vendor.”
In Other News Events of Note and Interest:
- Bots now account for half of global internet traffic. While that number is immense, it isn’t quite as dire as it sounds, unless you consider the bandwidth implications. Only one third of traffic is attributable to malicious bots that are out to steal, kill, and destroy. Well, maybe not the kill part, yet.
- China Legacy Chip production is up 40% in the first quarter of 2024 due to the cyber sanctions imposed by the US. Since legacy chips are not being sanctioned, the Middle Kingdom’s 28nm chip production facilities are running at full tilt turning out chips and may soon be an overwhelming presence in that marketspace.
In Cyber Insurance News:
- CYE warns of wide cyber insurance coverage gap. This past Friday on Integris’ Buffalo Plaid Breakfast web broadcast my co-host and I discussed Cyber Insurance, and this topic was touched on. However, at broadcast time I didn’t fully know the depth of how woefully underinsured the majority of companies are for a cyber event, with some as high as 3000%. The time to reevaluate your coverage is now, not when something arises that necessitates a call to your adjustor.
In the 1980’s when dinosaurs roamed the earth, I visited relatives in Switzerland for an extended vacation. While there the Swiss enacted mandatory seatbelt laws. As a foreign national, I didn’t want to run afoul of their laws, so I complied and wore my seatbelt every time I was in a car. When I returned to the USA, months later, wearing a seatbelt had become a habit. So, several years later when my home state passed legislation mandating their use, I was already compliant, and it was no big deal. Cyber security best practices are presently akin to my Swiss seatbelt experience. They are not mandatory, yet. Be proactive and put them into practice now so that when regulations come our way you will be compliant, and it will be no big deal.
Keep the shields up. They really are out to get you.
Viscount Zebulon Wamboldt Pike
Headline NEWS
- Apple loses top phonemaker spot to Samsung as iPhone shipments drop
- Cisco warns of large-scale brute-force attacks against VPN services
- Cisco discloses root escalation flaw with public exploit code
- CrushFTP critical vulnerability, all versions below 10.7.1 / 11.1.0 are vulnerable!
- Telecom giant Frontier shuts down some systems after cyberattack
- Ivanti Releases Fixes for More Than 2 Dozen Vulnerabilities
- Juniper Networks Publishes Dozens of New Security Advisories
- MITRE says state hackers breached its network via Ivanti zero-days
- Palo Alto Networks Releases Fixes for Firewall Zero-Day as First Attribution Attempts Emerge
- CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect
- Exploit code for Palo Alto Networks zero-day now public
- Security Bite: Annual cost of cybercrime to hit $9.2 trillion in 2024
Ransomware, Malware, and Vulnerabilities News
- Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown
- Moldovan charged for operating botnet used to push ransomware
- Zambia Busts 77 People in China-Backed Cybercrime Op
- World-first ‘Cybercrime Index’ ranks countries by cybercrime threat level
- NSA Publishes Guidance for Strengthening AI System Security
- FBI warns of massive wave of road toll SMS phishing attacks
- FBI: Akira ransomware raked in $42 million from 250+ victims
- Emergency services a likely target for cyberattacks, warns DHS
- AI making ransomware easier, more prevalent, committee hears
- Middle East Cyber Ops Intensify, With Israel the Main Target
- Evil XDR: Researcher Turns Palo Alto Software Into Perfect Malware
- Chrome 124, Firefox 125 Patch High-Severity Vulnerabilities
- Scammers exploit Google platform to promote phishing site
- Oracle Critical Patch Updates for April 2024
- Cloudflare’s DDoS threat report for 2024 Q1
- Chinese manufacturer exposes data from surveillance devices
- Widely-Used PuTTY SSH Client Found Vulnerable to Key Recovery Attack
- Multiple botnets exploiting one-year-old TP-Link flaw to hack routers
- How Attackers Can Own a Business Without Touching the Endpoint
- Cisco Duo’s Multifactor Authentication Service Breached
- ‘MagicDot’ Windows Weakness Allows Unprivileged Rootkit Activity
- LastPass users targeted in phishing attacks good enough to trick even the savvy
- Cheap ransomware for sale on dark web marketplaces is changing the way hackers operate
- “Mobile NotPetya”: Spyware Zero-Click Exploit Development Increases Threat of Wormable Mobile Malware
- SAP users are at high risk as hackers exploit application vulnerabilities
- Critical Atlassian Flaw Exploited to Deploy Linux Variant of Cerber Ransomware
- Researchers stop ‘credible takeover attempt’ similar to XZ Utils backdoor incident
- Open source groups say more software projects may have been targeted for sabotage
- Roku makes 2FA mandatory for all after nearly 600K accounts pwned
- A critical vulnerability in Delinea Secret Server allows auth bypass, admin access
- Delinea Scrambles to Patch Critical Flaw After Failed Responsible Disclosure Attempt
- ICS Network Controllers Open to Remote Exploit, No Patches Available
- FBI says Chinese hackers preparing to attack US infrastructure
- Destructive ICS Malware ‘Fuxnet’ Used by Ukraine Against Russian Infrastructure
- Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm
- Biden admin, ports prep for cyberattacks as U.S. infrastructure targeted
- New SteganoAmor attacks use steganography to target 320 orgs globally
- LockBit 3.0 Variant Generates Custom, Self-Propagating Malware
- ByteDance still has access to US users’ TikTok data despite Project Texas
- Why home cybersecurity is important
- 6 bad cybersecurity habits that put SMBs at risk
- Crickets from Chirp Systems in Smart Lock Key Leak
- Hackers break into Israeli military’s computers, access trove of documents
- Ransomware feared as IT ‘issues’ force Octapharma Plasma to close 150+ centers
- Hacker claims Giant Tiger data breach, leaks 2.8M records online
- A Home Depot Third-Party Data Breach Leaks the Personal Information of 10,000 Employees
- Daixin ransomware gang claims attack on Omni Hotels
- Omni Hotels says customers’ personal data stolen in ransomware attack
- Chipmaker Nexperia confirms breach after ransomware gang leaks data
- HelloKitty ransomware rebrands, releases CD Projekt and Cisco data
- Atlantic fisheries body confirms cyber incident after 8Base ransomware gang claims breach
- UNDP, City of Copenhagen Targeted in Data-Extortion Cyberattack
- Lubbock software company explains Russian South Pains cyberattack
- Cyberattack hits New York state government’s bill drafting office
- Jackson County restores network after ransomware attack
- Hernando County government getting back online after ransomware attack
- Identity in the Shadows: Shedding Light on Cybersecurity’s Unseen Threats
- Microsoft blocks BlackLotus Secure Boot mitigations on TPM 2.0 Windows Server 2012
- Microsoft fixed Windows CVE-2024-26248, CVE-2024-29056 Kerberos PAC validation flaw
- Security expert warns tourists why they should never charge their phone at an airport
Other News Events of Note and Interest
- Cool Tool: foobar2000 2.1.4
- Cool Tool: Floorp 11.12.0
- Understanding CISA’s proposed cyber incident reporting rules
- US supreme court ruling suggests change in cybersecurity disclosure process
- The latest macOS Ventura update has left owners of old Macs stranded in a sea of problems
- Bots now account for half of global internet traffic and ‘bad bots’ nearly one third
- Broadcom says “many” VMware perpetual licenses got support extensions
- I made my own performance Chromebook by installing ChromeOS Flex on a cheap laptop
- The 65-year-old computer system at the heart of American business
- Use the ‘GTD’ Method to Actually Get Through Your To-do List
- HPE sues China’s Inspur Group over server patents
- Google Drive goes to the dark side
- Google’s Titan security key has a glaring usability flaw
- Play Store ‘Biometric verification’ to drop Google Account password
- Los Alamos Pushes The Memory Wall With “Venado” Supercomputer
- Mozilla Firefox 125 Is Now Available for Download, This Is What’s New
- Now Available: Citrix Virtual Apps and Desktops 2402 Long Term Service Release
- Logitech mouse and keyboard users are getting a free AI upgrade
- Intel is again trying to fix blue screen crashes on Windows 11 & 10 caused by its drivers
- How to Set Up a Custom Email with Cloudflare and Mailgun
- Elon Musk plans to charge new X users to enable posting
- Japan turns up heat on Apple, Google with threat of hefty fines
- WD Unveils Portable Server With 368TB of Flash Storage
- Samsung gets $6.4 billion for semiconductor plants in Texas
- US sanctions transform China into legacy chip production juggernaut — production up 40% in Q1 2024
- Huawei builds major tool R&D center in Shanghai to develop lithography and fab equipment
- Microsoft: Windows Copilot app we quietly installed is harmless and doesn’t steal your data
- Haven’t activated Windows 10 or 11? Microsoft Edge settings may soon be blocked off entirely
- Microsoft’s ‘AI Watchdog’ defends against new LLM jailbreak method
- Microsoft’s new AI tool is a deepfake nightmare machine
- Microsoft drops $1.5 billion on G42, an Abu Dhabi-based AI company
- Microsoft will limit Exchange Online bulk emails to fight spam