Deloitte Cybersecurity bulletin

culture-shift

SECURITY INTELLIGENCE

Staying safe on social networking sites

To stay safer online, US-CERT has published ST06-003 on staying safe on social networking sites. Using information that you provide about your location, hobbies, interests, and friends, a malicious person could impersonate a trusted friend or convince you that they have the authority to access other personal or financial data. Source: us-cert.gov

 

Facebook steps up security by allowing physical keys for log-in

 

Facebook has stepped up security for users with its announcement that in addition to its in-app support for two-factor authentication (2FA), it is now supporting 2FA with physical security keys.

This is great news for anyone who prefers not to use a smartphone app or rely on an SMS message for 2FA: all you need now is an internet connection and a compatible security token. Source: nakedsecurity.sophos.com

 

FBI releases article on romance scams

 The Federal Bureau of Investigation (FBI) has released an article addressing the rise of Internet romance scams. Victims—predominantly older widowed or divorced women targeted by criminal groups usually from Nigeria—are, for the most part, computer literate and educated. But they are also emotionally vulnerable. Con artists know exactly how to exploit that vulnerability since potential victims freely post details about their lives and personalities on dating and social media sites. Source: fbi.gov

 

Gmail now blocks all JavaScript email attachments

 JavaScript joins an ever-growing list of file types, including .exe and .bat files, which Gmail won’t allow. Anyone who tries to send a .js (JavaScript) file attachment via Gmail will be out of luck, as they’re now on Google’s list of restricted file types for attachments. That means that Gmail users can’t send or receive emails with .js file attachments. Anyone sending a .js file to a Gmail user will find their email bouncing back to them with an explanation of why it wasn’t delivered. Source: nakedsecurity.sophos.com

 

Google set to purge Play Store of apps lacking a privacy policy

Google warns developers that it plans to purge its Play Store of apps that do not have privacy policies. The move could affect millions of apps that do not spell out what they do with user data.

Developers worldwide have been receiving notices from Google, informing them that the company plans to “limit visibility” or to entirely remove such apps. Source: nakedsecurity.sophos.com

 

Attacks and Data Breaches

InterContinental Hotels Group properties suffered data breach

 

The InterContinental Hotels Group (IHG) informed its customers that payment cards used between August and December 2016, at restaurants and bars of the 12 US hotels were affected by the data breach.

The company, InterContinental Hotels Group (IHG), confirmed an ongoing investigation of alleged card breach at some of its properties.

The hospitality giant confirmed that the malicious code used by crooks did not affect payment cards used at the front desk.  Source: securityaffairs.co

 

MySQL databases held to ransom

 Similarly to the MongoDB attacks, MySQL databases were reportedly held to ransom and owners were instructed to pay a 0.2 Bitcoin ransom (approx. $200) to regain access to their content. The attack started with ‘root’ password brute-forcing. Once logged-in, the attacker fetched a list of the existing MySQL databases and their tables and created a new table called ‘WARNING’ that included a contact email address, a bitcoin address and a payment demand. Source: securityaffairs.co

 

Russian hacker, Rasputin breaches universities and government agencies

 According to the threat intelligence firm, Recorded Future, a Russian-speaking black hat hacker, known as ‘Rasputin‘ hacked systems of more than 60 universities and U.S. Government agencies.

Rasputin exploited SQL injection flaws to gain access to sensitive information that he sold on cybercrime marketplaces. Source: securityaffairs.co

 

RSA conference 2017 attendees hacked with rogue access points

 Attendees at the 2017 RSA conference, one of the world’s largest security events, may have been reportedly hacked.

Security researchers were scanning the conference floor when they discovered a rogue access point (AP) that was posing as a known and trusted network.

In an AP attack, a rogue access point tricks users into thinking they are connecting to a known access point Source: securityaffairs.co

 

Recent WordPress flaw exploited to deface more than 1.5 million web sites

A recently patched security vulnerability in the popular WordPress CMS has been exploited to deface roughly 1.5 million web pages.

The vulnerability was discovered by a security researcher at firm Sucuri who explained that the flaw could be exploited by an unauthenticated attacker to inject malicious content as well as escalate privilege.

The attacker could exploit the zero-day content injection flaw to modify posts, pages, as well any other content. Source: securityaffairs.co
PoliceOne hacked – Hacker is selling thousands police officials’ accounts 

A hacker has reportedly stolen over 700,000 user accounts from a popular law enforcement forum PoliceOne and is being offered for sale. The PoliceOne forum is used by verified police officers and investigators to exchange information on techniques of investigation, training or other law enforcement centric discussions. Source: securityaffairs.co

 

Hacker leaked tools stolen from mobile forensics company, Cellebrite

 The main product of Cellebrite is the Universal Forensic Extraction Device (UFED), an equipment that can rip data (i.e. SMS messages, emails, call logs) from a huge number of different models of mobile phones. The company confirmed that someone accessed its systems stealing roughly 900 GB of data, a huge quantity of data mainly composed of log data from its end-user licensing system and other sensitive data. The archive notably also contained 350 GB of offline world map backups, but attackers did not access “full passwords” or payment information. Source: securityaffairs.co

 

Anonymous hacker pulls plug on thousands of dark net sites

An incident occurred in the last week of February where an anonymous attacker took down twenty percent of the “Dark Net” sites. The mode of attack was by taking the server that hosted over 10,000 sites on the Tor network -Freedom Hosting II- offline. The attacker, who also stole a database containing 381,000 email addresses claimed in an interview with “motherboard” that he took down the hosting provider because 50 percent of its sites contained child pornography. The breach showed the danger of focusing resources in a single hosting provider. Source: technewsworld.com

 

 

Vulnerabilities & Threats

Critical SQL injection bug in WordPress plugin

An SQL injection vulnerability has been detected in a WordPress plugin that could provide attackers with access to a user’s website and enable them to siphon out data, according to a blog post from Sucuri. Source: scmagazine.com

 

Some Popular iOS apps are vulnerable to man-in-the-middle (MITM) attacks

The study was conducted by the developers at verify.ly, a service that analyzes iOS apps searching for security issues. The researcher published a blog stating that 76 popular iOS applications allowed a silent man-in-the-middle attack to be performed on connections which should be protected by TLS (HTTPS). This allowed interception and/or manipulation of data in motion. Source: securityaffairs.co

 

Microsoft SMB Vulnerability

 CERT Coordination Center (CERT/CC) has released information on a Server Message Block (SMB) vulnerability affecting Microsoft Windows. Exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition.

No patches are currently available, but mitigations include blocking outbound SMB connections (TCP ports 139 and 445 and UDP ports 137 and 138) from the local network to the wide-area network.

Source: us-cert.gov

 

Authentication Bypass vulnerability found in Cisco Prime Home product

 Experts at Cisco discovered a critical authentication bypass flaw in Cisco Prime Home remote management product during an internal security testing. The flaw, tracked as CVE-2017-3791, resides in the web-based user interface of the Cisco Prime Home, it can be remotely exploited by an unauthenticated attacker to bypass authentication and execute any action with administrator privileges.

Word documents laced with malicious macros used to hack Apple Mac systems

Source: securityaffairs.co

 

Word documents laced with malicious macros used to hack Apple Mac systems

Security experts observed a spike in the distribution of spam messages using attachments embedding malicious macros. One of the baits was titled “U.S. Allies and Rivals Digest Trump’s Victory – Carnegie Endowment for International Peace.docm”. When Mac recipients open the documents they are prompted to enable macros. If a Mac user enabled the macros, the file executes a Python function that downloads a malicious payload and executes it thereby infecting the machine. Source: securityaffairs.co

 

Dozens of iOS apps vulnerable to Wi-Fi snooping

Dozens of applications for Apple’s mobile devices are vulnerable to Wi-Fi snoopers, this has been revealed by a security researcher recently.

The Sudo Security Group has identified 76 popular iOS apps available at Apple’s App Store that were vulnerable to wireless eavesdroppers, even though the connections were supposed to be protected by encryption. There have been over 18 million downloads of the vulnerable apps.

Source: technewsworld.com

 

Google discloses unpatched IE vulnerability after Patch Tuesday delay

Google has disclosed a potential code execution vulnerability in Internet Explorer because Microsoft has not acted within Google’s 90-day disclosure deadline.

This is the second flaw in Microsoft products made public by Google.

Microsoft blamed the decision to push back scheduled security updates by a month on a “last minute issue” that could have had an impact on customers, but the company hasn’t clarified the nature of the problem.

 

New attack busts Android for work

Malicious apps can be used to steal information secured by Google’s Android for work.

Recently, a team was able to breach the separation between the work and private sections of Android devices using what is referred to as an “app-in-the-middle attack.” A nod to man-in-the-middle attacks, this tactic uses a malicious app installed in the personal sector of the phone that is able to intercept information from the secure sector and pass it on to the attacker. The malicious app requires no special permissions other than the ability to see notifications. Source: pcmag.com

 

Cloudflare cloudbleed flaw

Cloudbleed is a serious vulnerability in Cloudflare’s internet infrastructure that Google Project Zero researcher Tavis Ormandy discovered. Cloudfare quickly identified the problem and turned off three minor Cloudflare features (email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites) that were all using the same HTML parser chain that was causing the leakage. The bug could have exposed a broad range of customer data like passwords, chat transcripts, and other information stored by millions of websites. Cloudflare powers many popular websites, including Uber, Fitbit, and OkCupid.

Source: pcmag.com

 

Yahoo notifies users hackers are forging “cookies” to take over their accounts

Yahoo is notifying some of its users that hackers are now forging cookies and parameters used in authentication, instead of stealing passwords, to compromise yahoo accounts.

The attackers’ forged cookies that “could allow an intruder to access users’ accounts without a password,” said the email to users. The notification was signed by Bob Lord, Yahoo’s chief information security officer.  Source: Securityaffairs.co

 

Britain hit by 188 ‘high-level’ cyberattacks in three months

The UK is facing dozens of cyberattacks a day from state-sponsored hackers, the head of the National Cyber Security Centre has warned, and suffered 188 “high-level” attacks in the past three months.

Ciaran Martin’s warning came as the Queen officially opened the NCSC’s headquarters in London. The centre, whose parent organisation is GCHQ, has been set up “as a bridge between industry and government, providing a unified source of advice, guidance and support on cyber-security, including the management of cyber-security incidents”, according to its report introducing its work.  Source: nakedsecurity.sophos.com

 

 

Security Updates & Patches

Adobe patches 13 code execution vulnerabilities in flash

As part of Adobe’s consistent patch update cycle, 13 code execution vulnerabilities were exposed in the Flash Player. Although according to adobe, none of these vulnerabilities had been exploited publicly, users were advised to update to the latest version of the software. Adobe warned that the older versions could allow attackers to execute code on the host system running Flash. Source: threatpost.com

 

Slack quickly patches account hijacking flaw

 Developers of the Slack team collaboration application have patched a critical vulnerability that could have been exploited to steal a user’s private token and gain access to their account. The security hole was identified by Detectify researcher Frans Rosén, who discovered that an attacker can steal a user’s token by getting them to access a specially crafted webpage. Source: securityweek.com

 

Microsoft fails to patch a flaw in GDI library: Google publishes a Proof-of-Concept (PoC) exploit

The hackers at Google Project Zero have publicly disclosed a vulnerability affecting Microsoft’s Windows operating systems ranging from Windows Vista Service Pack 2 to the latest Windows 10, which had yet to be patched by the IT giant. The flaw affects the Windows’ Graphics Device Interface (GDI) library (gdi32.dll).The vulnerability, tracked as CVE-2017-0038, could be exploited by an attacker to read the content of the user’s memory using specifically crafted Enhanced MetaFile (EMF) files.

Source: infosecinstitute.com

 

OpenSSL Releases Security Update

OpenSSL version 1.1.0e has been released to address a vulnerability for users of version 1.1.0. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.

Users and administrators are encouraged to review the OpenSSL Security Advisory and apply the necessary update. Source: us-cert.gov

 

Cisco Releases Security Update

Cisco has released a security update to address a vulnerability in its UCS Director software. Exploitation of this vulnerability could allow an attacker to take control of an affected system. It is encouraged that users and administrators review the Cisco Security Advisory and apply the necessary update. Source: us-cert.gov

 

ISC Releases Security Updates for BIND

The Internet Systems Consortium (ISC) has released updates that address a vulnerability in BIND. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition. Available updates include: BIND 9 version 9.9.9-P6, BIND 9 version 9.10.4-P6, BIND 9 version 9.11.0-P3 and BIND 9 version 9.9.9-S8. Source: us-cert.gov

Leave a Reply