Inside the Deloitte Cybersecurity Bulletin

Security Intelligence
Google may distrust a third of the web’s SSL certificates
Source: cio.com

Google may distrust a third of the web’s SSL certificates by revoking trust in certificates that have a validity period of over 33 months. This is to put enormous pressure on Symantec, as the company will have to contact all customers, validate their identity and the ownership of their domains all over again, and replace their existing certificates with new ones, most likely at no cost. Symantec according to a Netcraft survey is responsible for about one in every three SSL certificates used on the web, making it the largest commercial certificate issuer in the world.

US, UK and Netherlands top attacked countries in the global DDoS threat landscape of Q4 2016
Source: securityaffairs.co

Distributed denial of service (DDoS) attacks continue to represent a serious threat to organizations worldwide. The attacks are growing in size and level of sophistication according to the new report ‘Global DDoS Threat Landscape Q4 2016 published by Imperva. The US was the Top targeted country (56.7%), followed by the United Kingdom (9.6%), and the Netherlands (8.6%).

Apple pushing two-factor authentication for iOS 10.3 users
Source: nakedsecurity.sophos.com

Beta users of Apple iOS 10.3 are receiving push notifications from Apple to enable two-factor authentication (2FA) for their Apple IDs, which is used on Apple devices to synchronize and share iCloud user data.

Apple’s 2FA provides an extra layer of security for iCloud data as well as for devices registered to an Apple ID, and it seems with iOS 10.3 that Apple is taking stronger measures to encourage its users to enable this feature.

Backdoor needed into WhatsApp
Source: scmagazine.com

Following the terror attack on Parliament last week, home secretary Amber Rudd has suggested law enforcement must be able to listen in to WhatsApp conversations, as British-born Khalid Masood, who carried out the attack, is said to have used WhatsApp moments before murdering pedestrians with his car, and stabbing an unarmed police officer to death.

MySQL databases held to ransom
Source: nakedsecurity.sophos.com

The recent attacks that have seen MongoDB and Hadoop databases held to ransom seem to have evolved to include a new target: MySQL. MySQL database operators are reminded to make sure that their databases are properly hardened, protected by strong passwords and, as the MySQL reference manual itself states: “you may also wish to restrict MySQL so that it is available only locally on the MySQL server host, or to a limited set of other hosts”.

Crafty phishing technique targeted at Gmail users
Source: technewsworld.com

Gmail users have been targeted recently by a more sophisticated series of phishing attacks that make use of emails from a known contact whose account has been compromised. The sophisticated attack clearly shows “accountname.gmail.com” in the browser’s location bar and leads users to what appears to be a legitimate Google sign-in page where they are asked to supply their credentials, which subsequently becomes compromised.

Users Can Now Time Their Windows 10 Updates
Source: darkreading.com

Microsoft has given Windows 10 users the option to choose their timing preference for Updates. This is a part of the Microsoft plan taken to pacify the patience of users since these updates requires a system reboot that could be disruptive especially when it occurs during a wrong time. However, cybersecurity experts are concerned about the advantage this upgrade could provide hackers with.

France drops e-voting amid attack fears
Source: nakedsecurity.sophos.com

As several European countries gear up for general elections, France has dropped plans to allow its 1.3m citizens abroad vote electronically in its presidential election amid concerns about the risk of cyber-attack, said the French foreign ministry on Monday. There has been a rising tide of concern about the impact of Russian meddling in elections which has led to France’s National Cybersecurity Agency deciding to drop the facility for French citizens overseas, to vote electronically.

ICANN goes ahead with .africa Top Level Domain (TLD)
Source: nakedsecurity.sophos.com

We are familiar with cities (.london), countries (.uk), regional identities (.cat) and of course types of organisations (.com, .gov) having their own top-level domains, but no continent has had its own TLD – until now. ICANN, the body that oversees the internet’s namespace, is to go ahead with its .africa TLD after a court tussle between ICANN and DotConnectAfrica. Registrations will be handled by ZA Central Registry, a South African company.

China mulls national cryptocurrency in race to digital money
Source: nakedsecurity.sophos.com

China – which contains one in every five internet users – is mulling the idea of a national cryptocurrency. Governments worldwide have had a problematic relationship with Bitcoin. The US has held federal hearings on it, while at a state level New York has heavily regulated the cryptocurrency with its Bitlicense. Ecuador, Bolivia and Russia have all moved to ban Bitcoin outright, while other countries have taken their time working out what to do with the cryptocurrency.

TOP

Attacks and Data Breaches
WikiLeaks drops huge cache of confidential CIA documents
Source: technewsworld.com

WikiLeaks launched a new series of leaks on the US Central Intelligence Agency it called “Vault 7”. It claimed that this leak represented the largest dump of confidential documents on the agency in history. The first full part of the series dropped was called “Year Zero”. This release yielded 8,761 documents and files from an isolated, high-security network inside CIA headquarters in Langley, Virginia.

Dutch parliament hit with ransomware attack
Source: technewsworld.com

The lower house of the Dutch parliament, the Tweede Kamer, was hit with a ransomware attack that managed to encrypt some files before being stopped.

The NLTimes reported that a parliament spokesperson would not comment on the attack, but parliamentarian Kees Verhoeven tweeted that ransomware had hit the government computer system.

McDonald’s McDelivery app leaks details of over 2.2 million customers
Source: securityaffairs.co

McDelivery, a web application used by McDonald’s customers in India, was found to be have leaked the personal information of more than 2.2 million users. The data leak in the app is the result of an unprotected publicly accessible API endpoint that was designed to deliver user details, which is coupled with innumerable integers as customer IDs.

Single command line error causes Amazon mega-outage for 3 hours
Source: nakedsecurity.sophos.com

Amazon Web Services (AWS) S3 outage which took out up to 150,000 websites including Netflix, Spotify, Pinterest and Buzzfeed was caused by an engineer mistyping a single command. It seems the engineer was trying to temporarily take down servers used by the S3 billing sub-system when the command line mishap caused a cascading problem that downed two really critical servers.

Boeing notified 36,000 employees following an accidental data leak
Source: securityaffairs.co

The aerospace giant Boeing notified 36,000 employees following an accidental data leak. A company employee inadvertently leaked the personal information of his co-workers by sending, by email, a company spreadsheet to his spouse who didn’t work at the company. The file shared contained sensitive, personally identifiable information of 36,000 Boeing employees, including names, places of birth, employee ID numbers, and accounting department codes.

Roberts Hawaii Tour Company hacked, credit card and personal info exposed
Source: securityaffairs.co

The tour company Roberts Hawaii warns its customers about a security breach that may affect people who purchased tours and other services on its website. The tour company discovered the security breach after customers reported fraudulent charges on their credit cards. Compromised records include name, address, email address, phone number, payment card number, expiration date and card security code.

Group demands apple pay ransom for iCloud credentials
Source: technewsworld.com

Apple recently received a ransom threat from a hacking group who claims to be in possession of data of up to 800 million iCloud accounts. The hacking group reportedly based in London called the “Turkish Crime Family,” threatened to reset passwords and remotely wipe the iPhones the iCloud users if Apple fails to give into their demand of over a total of US$700,000.

Over 20 million Gmail and 5 million Yahoo accounts available for sale on the dark web
Source: securityaffairs.co

A vendor with the online moniker “SunTzu583” is reportedly selling millions of login credentials for Gmail and Yahoo accounts on a black market in the dark web. Over 20 million Gmail accounts and 5 million Yahoo accounts are available for sale, the huge trove of data is the result of previous massive data breaches.

TOP

Vulnerabilities & Threats
Apache Struts vulnerability being exploited by attackers
Source: scmagazine.com

A new vulnerability (CVE-2017-5638) that affects the Apache Struts Jakarta Multipart parser was recently reported. The vulnerability allows an unauthenticated attacker to execute code in the affected system by creating a specially-crafted Content-Type HTTP header. Experts have advised that upgrading to the Struts 2.3.32 and Struts 2.5.10.1 versions resolves the vulnerability. A high number of attackers have been seen trying to exploit this vulnerability.

Destructive Stonedrill Wiper malware on the Loose
Source: threatpost.com

A group of Researchers at Kaspersky Lab have released information about a wiper malware found in the wild called StoneDrill. This piece of malware is similar to the Shamoon malware which was responsible for the destruction of more than 35,000 workstations at Saudi Aramco in 2012 and the Dark Seoul attacks on Sony Pictures Entertainment.

Cerber learns to dodge machine learning
Source: scmagazine.com

Researchers at Trend Micro said the Cerber ransomware is using a new loader that appears to dodge machine learning solutions using features that check if it is running in a virtual machine (VM), a sandbox, or if certain analysis tools such as are running on the machine. It was noted that the malware was repackaged into a self-extracting file and can cause problems for threat detection methods that analyze a file without any execution or emulation.

Fortinet researchers spotted a malware that infects both Microsoft and Apple OSs
Source: securityaffairs.co

Security researchers at Fortinet have spotted a weaponized Word document that has been designed to spread malware on either Microsoft Windows or Mac OS X. The documents trick victims into enabling macros, then a malicious VBA code is executed.

Once the VBA code is executed, the AutoOpen() function is automatically invoked and starts the attack.

Kirk ransomware – A Star trek themed ransomware that requests Monero payments
Source: securityaffairs.co

Ransomware continues to be one of the most profitable cyber threats and for this reason, a new strain of malware is seen in the wild almost every week. Security researchers have discovered a new piece of ransomware featuring a Star Trek theme, dubbed Kirk ransomware that is able to encrypt 625 different file types.
The ransomware appends a .Kirk extension to the encrypted file’s name.
The name of the Kirk ransomware is clearly inspired by the name of the popular character in the fiction series Start Trek.

Internet Information Services (IIS) 6.0 Vulnerability
Source: Us-cert.gov

Active exploitation of a vulnerability in Windows Server 2003 Operating System Internet Information Services (IIS) 6.0 has been noticed. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. On June 15, 2015, Microsoft ended support for Windows Server 2003 Operating System, which includes its Internet Information Services (IIS) 6.0 web server.

Remote code execution vulnerability affecting Cisco switches
Source: hotforsecurity.bitdefender.com

Following the WikiLeaks massive Vault 7 data leak, a new critical remote code vulnerability which affects Cisco Systems switches has been revealed. While the data leak allegedly comes from the CIA, the vulnerability is real and Cisco has already issued an advisory for it. An attacker could remotely dial into these switches and either cause a reload of the device or execute code running with elevated privileges.

PHP FormMail Generator generates code vulnerable to multiple issues
Source: kb.cert.org

PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting and unrestricted upload of dangerous file types. The code generated by the website prior to 17 December 2016 is vulnerable to: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). An unauthenticated remote attacker may be able to conduct stored XSS attacks against the form administrator, or possibly execute PHP code on the server if the attacker can guess the uploaded filename.

Spam mails circulate file-shredding malware
Source: nakedsecurity.sophos.com

If an email hits your inbox asking for payment in return for a TV license, be careful: a new social engineering attack is circulating that uses spam messages to trick victims into downloading file-deleting malware. The attack begins when the bad guys send emails to people within the targeted organizations. With this particular tactic, the click simply results in the download of a malicious document.

Those who click are infected with the .JSE worm, which then goes to work deleting and replacing files on your network shares.

TOP

Security Updates & Patches
Update your D-Link switches
Source: nakedsecurity.sophos.com

D-Link have released a support announcement explaining that the firmware used in its DGS-1510 Websmart Switch Series has been found to have security vulnerabilities and the company is urging users to install the latest firmware update.

All firmware prior to version 1.31.B003 are affected. The vulnerabilities have been given the CVE number CVE-2017-6206.

Cisco releases security updates
Source: us-cert.gov

Cisco has released security updates to address vulnerabilities in its IOS, IOS XE, and IOx Software. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system or cause a denial-of-service condition. Users and administrators are encouraged to review the Cisco Security Advisories and apply the necessary updates:

Microsoft releases 18 Security Bulletins, 8 critical
Source: scmagazine.com

Having delayed patches in February, Microsoft released 18 security bulletins, eight of them critical, patching vulnerabilities in server and desktop software. Experts have identified the highest priority has Windows GDI bulletin MS17-013 which could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document and CVE-2017-0005 as it is a zero day issue which is currently being exploited actively in the wild.

LastPass bug could allow hackers to steal passwords and execute code
Source: scmagazine.com

A flaw was discovered in LastPass, a popular password manager which stores encrypted passwords in private accounts. LastPass has had to patch a flaw in one of its browser extensions that could have enabled hackers to steal passwords from users after visiting a malicious website.

TOP

Leave a Reply