December 21, 2024 - Red Dot Security

RedDotSecurity.news header image, Santa hat version

Hello all,

Despite the upcoming winter break, the news does not sleep. There was a lot of activity in the prior week that was interesting, disturbing, and some was even delighting. So, let’s get to the cyber news.

As usual, my commentary is followed by a plethora of links to other items that are worth skimming to see if they interest you or pertain to your particular environment or of those you support.

Headline NEWS:

Amazon made news this week when they decided to pause a $1 billion rollout of Microsoft products to their employees due to significant concerns about Microsoft’s security. Some in the industry feel it is a political marketing move to highlight AWS, others are hopeful that this push, by one of the few companies with enough clout to pull it off, can finally get Microsoft to make needed systemic changes.
Apache Tomcat vulnerabilities have been found that enable RCE. Users are urged to upgrade to the latest versions to patch these two defects.
Beyond Trust made public that threat actors breached some of their Remote Support SaaS instances. The actual details are a bit scant, but it appears that the intrusion was caught before anything like mass deployment of ransomware was achieved. The vendor’s investigation found a critical defect in Privileged Remote Access (PRA) and Remote Support (RS) and has issued patches. Cloud instances received these automatically, self-hosted instances are urged to update immediately.
CAPTCHA is a security mechanism used to validate users’ online resources. Threat actors are now cleverly spoofing them and using the public’s trust of these ubiquitous tools to infect themselves with spyware and remote access tools. Please, never blindly copy and paste something from a website into your Windows “Run” line without understanding what you’re pasting in there.
Google Chrome received an update this past week for several high-severity flaws, including the V8 JavaScript engine. Microsoft Edge also received an update for similar, since it is based on Chromium. Update your browsers to keep surfing securely.
Sophos came in late in the week with updates for their firewall, patching a critical flaw that could allow “remote unauthenticated threat actors to perform SQL injection, remote code execution, and gain privileged SSH access to devices”. Their firewalls should update automatically, but it would be wise to check yours to ensure that it is no longer vulnerable.

In Ransomware, Malware, and Vulnerabilities News:

Threat Actors continue to exploit gullible employees with fake tech support calls, and remote access support requests. Microsoft Teams is the latest in the news that’s being used by these dirt bags. The basics of the scam are, flood the victim with spam, call them and claim to be from “support” and that you can stop the spam, and then convince them to let you onto their system via remote access software. Once on the threat actor then loads persistent remote access software that they control, thus owning the user’s computer for further nefarious purposes. Never, accept a remote access session like that unless you’ve initiated the call to what you know is the correct phone number.

In Other News Events of Note and Interest:

Microsoft really wants to kill passwords. Due to the ever-changing game of cat-and-mouse with threat actors, ordinary passwords have not been enough for quite some time, with Microsoft blocking 7,000 attacks on passwords per second. Multifactor authentication was supposed to be the holy grail of security, but it is now being bypassed via session token theft attacks, which increased by 146% this year. The next iteration of security is called “phishing resistant” and passkeys are the latest implementation of this FIDO2 standard. Clearly, Microsoft agrees that this solution is effective since they are actively engaged in moving over 1 billion accounts to passkey authentication via various prompts and pop-ups whenever certain logon events occur, and password changes happen. So, if you see a passkey option, it may be time to take the plunge for a more secure future.

Musings:

Christmas is only days away and cyber warriors are dreaming of extended time off away from their fickle, demanding, and needy digital charges so that they can enjoy their well-earned holiday with their families. Unfortunately, cyber evil doers are also dreaming of cyber warriors being away so they can spend time with those fickle digital charges unnoticed. Don’t let them spoil your winter break.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: