13.58 million Nigerian Internet users suffer cyberattacks
About 14 per cent or 13.58 million of the 97 million Internet users suffer cyberattacks annually, the Director-General, National Information Technology Development Agency, Dr. Isa Ibrahim said this at the inaugural meeting of the Inter-ministerial Technical Committee on the Implementation of the National Cyber Security Strategy. The idea was to strengthen cyber security in Nigeria and to raise awareness among the citizens on the need to guide against cyber threats, the use of encryption and human and institutional capacity building. Source: punchng.com
Google launches its own root certificate authority
On the 26th of January 2017 google announced the launch of a root certificate authority (CA) that will allow it to meet its certificate needs independently. The company has been making efforts to make the Internet safer by issuing root certificates for products on its own after identifying several CAs that had issued unauthorised certificates for its domains. The new entity responsible for operating the CAs on behalf of Google and Alphabet is Google Trust Services. Source: securityweek.com
Weak passwords are still the root cause of data breaches
The results of a new study conducted by a security firm “Keeper Security” that analysed 10 million hacked accounts from breached data dumps showed that the root causes were weak passwords. Users’ bad habits are still one of the biggest problems for the IT industry, weak passwords and their reuse on multiple websites every day potentially expose a billion users to cyber-attacks. Source: securityaffairs.co
Cisco: Spam is making a big-time comeback
A research undertaken by Cisco reveals that spam emails are making a huge and shocking resurgence as a threat to corporate security. Cisco noted that spam emails account for over 60% of all corporate email among customers who opted in for the survey. Source: cio.com
Corporations at risk of malware attack via Cisco’s WebEx Chrome extension
Companies that installed the popular Cisco WebEx extension on Chrome may have exposed themselves to malicious attacks. The critical remote code execution vulnerability in the Cisco WebEx extension can be exploited by tricking users to access a specially-crafted website which could trigger malicious code on a user’s Windows PC. Source: businessinsights.bitdefender.com
Many Android VPN apps breaking privacy promises
An alarming number of Android VPN apps are notably providing a false sense of security to users. A recent study of 238 mobile VPN apps identified a number of shortcomings common to several instances of VPN apps that exposed users to serious privacy and security vulnerabilities, such as use of insecure VPN tunneling protocols, as well as IPv6 and DNS traffic leakage Source: threatpost.com
Facebook rolls out 2FA hardware keys for log-ins
Facebook has made new moves to improve log-in security for account users by implementing the new two-factor authentication (2FA) hardware keys. The keys which have to be purchased by users, conform to the Universal 2nd Factor (U2F) standard from FIDO Alliance. Facebook already offers 2FA to users, but only via text message or the Facebook app. The main security benefit of the hardware key is to prevent hackers who can sometimes intercept SMS-based 2FA through various Man in the Middle attacks. The keys only work with Chrome and Opera for now, and aren’t supported on the Facebook app.
Fake Super Mario run for Android is serving the Marcher banking trojan
While Nintendo released the Super Mario Run mobile game for iOS device, it didn’t make it available for Android, and cybercriminals are taking advantage of this to spread their malware to eager Android gamers. It was discovered that instead of installing a legitimate version of the Super Mario game, the application installs Marcher, a banking malware capable of stealing victim’s banking and credit card information. Once the user’s mobile device has been infected, the malware waits for victims to open one of its targeted apps and then presents the fake overlay page asking for banking details. Source: securityaffairs.co
Number of MongoDB ransom attacks peaked 27,000 in a day
The Australian Communication and Media Authority Antipodes reported that the number of hacked MongoDB databases more than doubled to 27,000 in just a day. According to security experts, the hackers implement an extortion mechanism of copying and deleting data from vulnerable databases. The attackers further request payment of a ransom in order to return data and help the company to fix the flaw they exploited. Source: securityaffairs.co
Attacks and Data Breaches
FBI website hacked and data leaked online
A notorious hacker that goes by the name CyberZeist reportedly broke into the FBI’s website FBI.gov and leaked data on Pastebin. The hacker leaked the FBI.GOV accounts that he found in several backup files (acc_102016.bck, acc_112016.bck, old_acc16.bck, etc). Leaked records contain accounts data, including names, SHA1 Encrypted Passwords, SHA1 salts, and emails. Source: securityaffairs.co
Telemarketing firm leaks 400,000 recorded calls
More than 400,000 audio files associated with a Florida company’s telemarketing efforts were stored online and was discovered by researchers at MacKeeper. More than 17,600 of those audio recordings were customer transactions that included names, addresses, credit card and CVV information of those called. Source: threatpost.com
Ransomware infects an LG Smart TV again
The rise in IoT Ransomware is a scary reality. Routers, smart TV, and CCTVs are all potential victims of such malware. The latest incident involved an LG smart TV, which was reported to have been infected with ransomware. The TV got infected with the ransomware when the owner downloaded an app to the TV promising free movies. The app was however a ransomware demanding USD 500 to unlock the device. Source: securityaffairs.co
11GB archive of top secret US SOCOM data accidentally leaked
A subcontractor of the Pentagon has exposed top-secret information of the US Military Special Operations Command (SOCOM) medics. Exposed records include names, locations, Social Security Numbers, and salaries of the Military SOCOM personnel.
The database was discovered by the popular researcher Chris Vickery. Source: securityaffairs.co
Lloyds Banking Group Reportedly Hit by DDoS Attack
Earlier in January, Lloyds Banking Group was under a distributed denial-of-service (DDoS) attack that hindered access to its online banking services for about two days. Someone claiming to be the attacker had tried unsuccessfully to extort Lloyd’s, offering to stop the attacks in exchange for about $93,600 worth of the virtual currency bitcoin Source: bankinfosecurity.com
Israeli mobile phone data extraction company Cellebrite was hacked
The Israeli mobile phone data extraction company, Cellebrite, was hacked. Contact information for users that were registered to receive notifications from the firm was exposed along with hashed passwords and technical data regarding Cellebrite’s products.
Cellebrite issued a statement to inform its customers of the data breach that affected an “external web server” containing the company’s license management system. Source: securityaffairs.co
National Aids Research Institute NARI hacked
The Shad0w Security crew broke into the server of the National Aids Research Institute (NARI) in India. The group accessed more than 1 GB archive containing the results for dozens of HIV test results.
The hacker released a small portion of the compromised archive as proof of the data breach. They explained that they want to avoid problems with the patients and the hack aims to demonstrate that the security staff at the Institute is not able to protect sensitive information. Source: securityaffairs.co
Vulnerabilities & Threats
Sage 2.0 Ransomware is spreading and demands a $2,000 Ransom
A new ransomware campaign called Sage 2.0 has been discovered by security experts. Sage 2.0 is known to be distributed via spam mails. The malicious messages have a ZIP attachment that contains a Word document with malicious macros that once executed download and install the Sage ransomware. The ransomware demands a ransom of $2,000 to retrieve data. Source: securityaffairs.co
Unpatched Windows zero day allows DoS attacks
Microsoft Windows users beware of an unpatched memory corruption bug which could be exploited to cause denial of service (DoS) attacks as well as other exploits. The vulnerability is in the SMB (Server Message Block) and is caused by the platform’s inability to properly handle specially-crafted server response that contains too many bytes. Source: scmagazine.com
Crooks target UK schools with ‘Department of Education’ ransomware
The British Action Fraud has warned citizens of fraudsters that are posing as government officials from the Department of Education in order to trick people into installing ransomware on their computers. Cyber criminals are said to be targeting schools in the UK, asking victims to pay up to £8,000 to unlock encrypted documents. Source: securityaffairs.co
A new variant of the Dridex Trojan is leveraging a new tactic to bypass User Account Control (UAC).
A group of researchers from security firm, Flashpoint discovered a new campaign on a new variant of the Dridex Trojan that uses a new technique that leverages Windows recovery disc application to bypass User Account Control (UAC). The malware leverages the Windows recovery disc executable (recdisc.exe) to load library file (SPP.dll) with administrative privileges and circumvent the UAC protection on Windows 7. Source: securityaffairs.co
Cisco warns of critical flaw in teleconferencing gear
Cisco Systems is warning customers of a critical vulnerability affecting three of its Tele presence platforms. The flaw could give attackers the ability to remotely execute code on impacted systems or create conditions favourable to a denial-of-service (DoS) attack.
According to an advisory issued this recently, the vulnerability (CVE-2017-3792) is tied to a proprietary device driver in the kernel of the Cisco TelePresence Multipoint Control Unit (MCU) Software used in platform models 4500, MSE 8510 and 5300 Series. Source: threatpost.com
Hundreds of thousands of Netgear routers vulnerable to password bypass
A security researcher recently discovered a flaw with Netgear routers which are susceptible to a pair of vulnerability that can lead to password disclosure. The vulnerabilities can be remotely exploited if the router’s remote management option is enabled. Source: threatpost.com
Security Updates & Patches
ISC issues updates for 4 high severity DoS flaws in BIND
The Internet Systems Consortium (ISC) has issued updates to solve four high severity flaws in the DNS software BIND. The flaw could be exploited by a remote attacker to cause a DoS condition. An attacker can exploit the vulnerabilities to cause the BIND name server process to encounter a failure and stop executing.
The list of flaws are as follow: CVE-2016-9778, CVE-2016-9131, CVE-2016-9147, and CVE-2016-9444
VMware Releases Security Updates
VMware has released security updates to address vulnerabilities in Airwatch Agent, Airwatch Console, and AirWatch Inbox software. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system.
Users and administrators are encouraged to review VMware Security Advisory VMSA-2017-0001 and apply the necessary updates. Source: us-cert.gov
WordPress Releases Security Update
WordPress 4.7.1 and prior versions are affected by multiple vulnerabilities. A remote attacker could exploit some of these vulnerabilities to take control of an affected website.
On February 1, WordPress disclosed an additional vulnerability that is fixed in version 4.7.2.
Users and administrators are advised to review the WordPress Security Release and upgrade to WordPress 4.7.2. Source: us-cert.gov
Cisco Releases Security Updates
Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit one of these vulnerabilities to take control of an affected system.
Users and administrators are advised to review the following Cisco Security Advisories and apply the necessary updates:
Cisco TelePresence Multipoint Control Unit Remote Code Execution Vulnerability cisco-sa-20170125-telepresence
Cisco Expressway Series and TelePresence VCS Denial-of-Service Vulnerability cisco-sa-20170125-expressway
Cisco Adaptive Security Appliance CX Context-Aware Security Denial-of-Service Vulnerability cisco-sa-20170125-cas Source: us-cert.gov
Apple Releases Security Updates
Apple has released security updates to address multiple vulnerabilities in several products. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.
Users and administrators are encouraged to review the Apple security pages for the following products and apply the necessary updates:
iTunes, Safari, iCloud for Windows, macOS Sierra, iOS, tvOS, watchOS, GarageBand, and Logic Pro X. Source: us-cert.gov