Deloitte Cyber Security Bulletin

Blockchain technology: 9 benefits & 7 challenges

Security Intelligence

13.58 million Nigerian Internet users suffer cyberattacks

 About 14 per cent or 13.58 million of the 97 million Internet users suffer cyberattacks annually, the Director-General, National Information Technology Development Agency, Dr. Isa Ibrahim said this at the inaugural meeting of the Inter-ministerial Technical Committee on the Implementation of the National Cyber Security Strategy. The idea was to strengthen cyber security in Nigeria and to raise awareness among the citizens on the need to guide against cyber threats, the use of encryption and human and institutional capacity building. Source: punchng.com

 

Google launches its own root certificate authority

 On the 26th of January 2017 google announced the launch of a root certificate authority (CA) that will allow it to meet its certificate needs independently. The company has been making efforts to make the Internet safer by issuing root certificates for products on its own after identifying several CAs that had issued unauthorised certificates for its domains. The new entity responsible for operating the CAs on behalf of Google and Alphabet is Google Trust Services. Source: securityweek.com

 

Weak passwords are still the root cause of data breaches

 The results of a new study conducted by a security firm “Keeper Security” that analysed 10 million hacked accounts from breached data dumps showed that the root causes were weak passwords. Users’ bad habits are still one of the biggest problems for the IT industry, weak passwords and their reuse on multiple websites every day potentially expose a billion users to cyber-attacks. Source: securityaffairs.co

 

Cisco: Spam is making a big-time comeback

 A research undertaken by Cisco reveals that spam emails are making a huge and shocking resurgence as a threat to corporate security. Cisco noted that spam emails account for over 60% of all corporate email among customers who opted in for the survey. Source: cio.com

 

Corporations at risk of malware attack via Cisco’s WebEx Chrome extension

 Companies that installed the popular Cisco WebEx extension on Chrome may have exposed themselves to malicious attacks. The critical remote code execution vulnerability in the Cisco WebEx extension can be exploited by tricking users to access a specially-crafted website which could trigger malicious code on a user’s Windows PC. Source: businessinsights.bitdefender.com

 

Many Android VPN apps breaking privacy promises

 An alarming number of Android VPN apps are notably providing a false sense of security to users. A recent study of 238 mobile VPN apps identified a number of shortcomings common to several instances of VPN apps that exposed users to serious privacy and security vulnerabilities, such as use of insecure VPN tunneling protocols, as well as IPv6 and DNS traffic leakage Source: threatpost.com

 

Facebook rolls out 2FA hardware keys for log-ins

 Facebook has made new moves to improve log-in security for account users by implementing the new two-factor authentication (2FA) hardware keys. The keys which have to be purchased by users, conform to the Universal 2nd Factor (U2F) standard from FIDO Alliance. Facebook already offers 2FA to users, but only via text message or the Facebook app. The main security benefit of the hardware key is to prevent hackers who can sometimes intercept SMS-based 2FA through various Man in the Middle attacks. The keys only work with Chrome and Opera for now, and aren’t supported on the Facebook app.

Source: infosecurity-magazine.com

Fake Super Mario run for Android is serving the Marcher banking trojan

 While Nintendo released the Super Mario Run mobile game for iOS device, it didn’t make it available for Android, and cybercriminals are taking advantage of this to spread their malware to eager Android gamers. It was discovered that instead of installing a legitimate version of the Super Mario game, the application installs Marcher, a banking malware capable of stealing victim’s banking and credit card information. Once the user’s mobile device has been infected, the malware waits for victims to open one of its targeted apps and then presents the fake overlay page asking for banking details. Source: securityaffairs.co

 

Number of MongoDB ransom attacks peaked 27,000 in a day

 The Australian Communication and Media Authority Antipodes reported that the number of hacked MongoDB databases more than doubled to 27,000 in just a day. According to security experts, the hackers implement an extortion mechanism of copying and deleting data from vulnerable databases. The attackers further request payment of a ransom in order to return data and help the company to fix the flaw they exploited. Source: securityaffairs.co

 

Attacks and Data Breaches

FBI website hacked and data leaked online

 A notorious hacker that goes by the name CyberZeist reportedly broke into the FBI’s website FBI.gov and leaked data on Pastebin. The hacker leaked the FBI.GOV accounts that he found in several backup files (acc_102016.bck, acc_112016.bck, old_acc16.bck, etc). Leaked records contain accounts data, including names, SHA1 Encrypted Passwords, SHA1 salts, and emails. Source: securityaffairs.co

 

Telemarketing firm leaks 400,000 recorded calls

 More than 400,000 audio files associated with a Florida company’s telemarketing efforts were stored online and was discovered by researchers at MacKeeper. More than 17,600 of those audio recordings were customer transactions that included names, addresses, credit card and CVV information of those called. Source: threatpost.com

 

Ransomware infects an LG Smart TV again

 The rise in IoT Ransomware is a scary reality. Routers, smart TV, and CCTVs are all potential victims of such malware. The latest incident involved an LG smart TV, which was reported to have been infected with ransomware. The TV got infected with the ransomware when the owner downloaded an app to the TV promising free movies. The app was however a ransomware demanding USD 500 to unlock the device. Source: securityaffairs.co

 

11GB archive of top secret US SOCOM data accidentally leaked

 A subcontractor of the Pentagon has exposed top-secret information of the US Military Special Operations Command (SOCOM) medics. Exposed records include names, locations, Social Security Numbers, and salaries of the Military SOCOM personnel.

The database was discovered by the popular researcher Chris Vickery. Source: securityaffairs.co

 

Lloyds Banking Group Reportedly Hit by DDoS Attack

 Earlier in January, Lloyds Banking Group was under a distributed denial-of-service (DDoS) attack that hindered access to its online banking services for about two days. Someone claiming to be the attacker had tried unsuccessfully to extort Lloyd’s, offering to stop the attacks in exchange for about $93,600 worth of the virtual currency bitcoin Source: bankinfosecurity.com

 

Israeli mobile phone data extraction company Cellebrite was hacked

 The Israeli mobile phone data extraction company, Cellebrite, was hacked. Contact information for users that were registered to receive notifications from the firm was exposed along with hashed passwords and technical data regarding Cellebrite’s products.

Cellebrite issued a statement to inform its customers of the data breach that affected an “external web server” containing the company’s license management system. Source: securityaffairs.co

 

National Aids Research Institute NARI hacked

 The Shad0w Security crew broke into the server of the National Aids Research Institute (NARI) in India. The group accessed more than 1 GB archive containing the results for dozens of HIV test results.

The hacker released a small portion of the compromised archive as proof of the data breach. They explained that they want to avoid problems with the patients and the hack aims to demonstrate that the security staff at the Institute is not able to protect sensitive information. Source: securityaffairs.co

 

 

Vulnerabilities & Threats

Sage 2.0 Ransomware is spreading and demands a $2,000 Ransom

 A new ransomware campaign called Sage 2.0 has been discovered by security experts. Sage 2.0 is known to be distributed via spam mails. The malicious messages have a ZIP attachment that contains a Word document with malicious macros that once executed download and install the Sage ransomware. The ransomware demands a ransom of $2,000 to retrieve data. Source: securityaffairs.co

 

Unpatched Windows zero day allows DoS attacks

 Microsoft Windows users beware of an unpatched memory corruption bug which could be exploited to cause denial of service (DoS) attacks as well as other exploits. The vulnerability is in the SMB (Server Message Block) and is caused by the platform’s inability to properly handle specially-crafted server response that contains too many bytes. Source: scmagazine.com

 

Crooks target UK schools with ‘Department of Education’ ransomware

 The British Action Fraud has warned citizens of fraudsters that are posing as government officials from the Department of Education in order to trick people into installing ransomware on their computers. Cyber criminals are said to be targeting schools in the UK, asking victims to pay up to £8,000 to unlock encrypted documents. Source: securityaffairs.co

 

A new variant of the Dridex Trojan is leveraging a new tactic to bypass User Account Control (UAC).

 A group of researchers from security firm, Flashpoint discovered a new campaign on a new variant of the Dridex Trojan that uses a new technique that leverages Windows recovery disc application to bypass User Account Control (UAC). The malware leverages the Windows recovery disc executable (recdisc.exe) to load library file (SPP.dll) with administrative privileges and circumvent the UAC protection on Windows 7. Source: securityaffairs.co

 

Cisco warns of critical flaw in teleconferencing gear

 Cisco Systems is warning customers of a critical vulnerability affecting three of its Tele presence platforms. The flaw could give attackers the ability to remotely execute code on impacted systems or create conditions favourable to a denial-of-service (DoS) attack.

According to an advisory issued this recently, the vulnerability (CVE-2017-3792) is tied to a proprietary device driver in the kernel of the Cisco TelePresence Multipoint Control Unit (MCU) Software used in platform models 4500, MSE 8510 and 5300 Series. Source: threatpost.com

 

Hundreds of thousands of Netgear routers vulnerable to password bypass

 A security researcher recently discovered a flaw with Netgear routers which are susceptible to a pair of vulnerability that can lead to password disclosure. The vulnerabilities can be remotely exploited if the router’s remote management option is enabled. Source: threatpost.com

 

Security Updates & Patches

ISC issues updates for 4 high severity DoS flaws in BIND

The Internet Systems Consortium (ISC) has issued updates to solve four high severity flaws in the DNS software BIND. The flaw could be exploited by a remote attacker to cause a DoS condition. An attacker can exploit the vulnerabilities to cause the BIND name server process to encounter a failure and stop executing.

The list of flaws are as follow: CVE-2016-9778, CVE-2016-9131, CVE-2016-9147, and CVE-2016-9444

Source: threatpost.com

 

VMware Releases Security Updates

 VMware has released security updates to address vulnerabilities in Airwatch Agent, Airwatch Console, and AirWatch Inbox software. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system.

Users and administrators are encouraged to review VMware Security Advisory VMSA-2017-0001 and apply the necessary updates. Source: us-cert.gov

 

WordPress Releases Security Update

 WordPress 4.7.1 and prior versions are affected by multiple vulnerabilities. A remote attacker could exploit some of these vulnerabilities to take control of an affected website.

On February 1, WordPress disclosed an additional vulnerability that is fixed in version 4.7.2.

Users and administrators are advised to review the WordPress Security Release and upgrade to WordPress 4.7.2. Source: us-cert.gov

 

Cisco Releases Security Updates

Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit one of these vulnerabilities to take control of an affected system.

Users and administrators are advised to review the following Cisco Security Advisories and apply the necessary updates:

Cisco TelePresence Multipoint Control Unit Remote Code Execution Vulnerability cisco-sa-20170125-telepresence

Cisco Expressway Series and TelePresence VCS Denial-of-Service Vulnerability cisco-sa-20170125-expressway

Cisco Adaptive Security Appliance CX Context-Aware Security Denial-of-Service Vulnerability cisco-sa-20170125-cas Source: us-cert.gov

 

Apple Releases Security Updates

 Apple has released security updates to address multiple vulnerabilities in several products. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.

Users and administrators are encouraged to review the Apple security pages for the following products and apply the necessary updates:

iTunes, Safari, iCloud for Windows, macOS Sierra, iOS, tvOS, watchOS, GarageBand, and Logic Pro X. Source: us-cert.gov

Leave a Reply