NEWS:
54% of all employees reuse passwords across multiple work accounts
Yubico released the results of a study into current attitudes and adaptability to at-home corporate cybersecurity, employee training, and support in the current global hybrid working era. The report surveyed 3,006 employees, business owners, and C-suite executives at large organisations (250+ employees), who have worked from home and use work issued devices in the UK, France and Germany. Data shows that since the start of the pandemic employees have been engaging in poor cybersecurity practices on work- issued devices, with business owners and C-level executives proving to be the worst culprits. At the same time, enterprises are falling short on cybersecurity best practices that need to be implemented for out-of-office environments.
Using Breached Password Detection Services to Prevent Cyberattack
Bolstering password policies in your organization is an important part of a robust cybersecurity strategy. Cybercriminals are using compromised accounts as one of their favourite tactics to infiltrate business-critical environments; as we’ve seen in recent news, these attacks can be dangerous and financially impactful. Unfortunately, account compromise is a very successful attack method and requires much less effort than other attack vectors. One of the essential types of password protection recommended by noted cybersecurity standards is breached password detection. Hackers often use known breached password lists in credential stuffing or password spraying attacks.
https://thehackernews.com/2021/06/using-breached-password-detection.html
https://specopssoft.com/blog/breached-password-detection-services/
5 Tips and Tricks for Cloud Native Security
Cloud-native applications that are based on new types of infrastructure such as containers and serverless platforms are being rapidly adopted by organizations worldwide. While cloud-native applications deliver compelling benefits such as elastic scalability, unmatched resilience and rapid development velocity, they also raise challenges. Cloud-native applications have a huge number of moving parts and are based on short-lived infrastructure elements that are here one minute and gone the next. This raises operational and maintenance challenges, but above all, it creates security concerns. Cloud-native security requires new approaches, strategies and tools. In this article, I’ll cover a few tips that can help you improve security for your organization’s cloud-native portfolio.
FBI paid renegade developer $180k for backdoored AN0M chat app that brought down drug underworld
The FBI has revealed how it managed to hoodwink the criminal underworld with its secretly backdoored AN0M encrypted chat app, leading to hundreds of arrests, the seizure of 32 tons of drugs, 250 firearms, 55 luxury cars, more than $148M, and even cocaine-filled pineapples. About 12,000 smartphones with AN0M installed were sold into organized crime rings: the devices were touted as pure encrypted messaging tools — no GPS, email or web browsing, and certainly no voice calls, cameras, and microphones. They were “designed by criminals, for criminals exclusively,” one defendant told investigators, Randy Grossman, Acting US Attorney for the Southern District of California, told a press conference on Tuesday.
https://www.theregister.com/2021/06/08/fbi_trojan_shield/
INCIDENTS:
Hackers Steal Wealth of Data from Game Giant EA
Hackers have broken into gaming giant Electronic Arts, the publisher of Battlefield, FIFA, and The Sims, and stole a wealth of game source code and related internal tools, Motherboard has learned. “You have full capability of exploiting on all EA services,” the hackers claimed in various posts on underground hacking forums viewed by Motherboard. A source with access to the forums, some of which are locked from public view, provided Motherboard with screenshots of the messages.
In those forum posts the hackers said they have taken the source code for FIFA 21, as well as code for its matchmaking server. The hackers also said they have obtained source code and tools for the Frostbite engine, which powers a number of EA games including Battlefield.
https://www.vice.com/en/article/wx5xpx/hackers-steal-data-electronic-arts-ea-fifa-source-code
Spain’s Ministry of Labor and Social Economy hit by cyberattack
The Spanish Ministry of Labor and Social Economy (MITES) is working on restoring services after being hit by a cyberattack on Wednesday. MITES is a ministerial department with an annual budget of almost €39 million, charged with coordinating and supervising Spain’s employment, social economy, and corporate social responsibility policies. “The Ministry of Labor and Social Economy has been affected by a computer attack,” MITES’ media office said earlier today.
MALWARE:
Steam Gaming Platform Hosting Malware
Look out for SteamHide, an emerging loader malware that disguises itself inside profile images on the gaming platform Steam, which researchers think is being developed for a wide-scale campaign. Steam’s most recent data said the platform has more than 20 million users playing games, including popular titles like Counter-Strike: Global Offensive, Dota 2 and Apex Legends. “While hiding malware in an image file’s metadata is not a new phenomenon, using a gaming platform such as Steam is previously unheard of,” G Data analyst Karsteen Hahn said about SteamHide in a new disclosure report, which builds on the original find by @miltinhoc on Twitter:…
Emerging Ransomware Targets Dozens of Businesses Worldwide
An emerging ransomware strain in the threat landscape claims to have breached 30 organizations in just four months since it went operational by riding on the coattails of a notorious ransomware syndicate. First observed in February 2021, “Prometheus” is an offshoot of another well-known ransomware variant called Thanos, which was previously deployed against state-run organizations in the Middle East and North Africa last year. The affected entities are believed to be government, financial services, manufacturing, logistics, consulting, agriculture, healthcare services, insurance agencies, energy and law firms in the U.S., U.K., and a dozen more countries in Asia, Europe, the Middle East, and South America, according to new research published by Palo Alto Networks’ Unit 42 threat intelligence team.
https://thehackernews.com/2021/06/emerging-ransomware-targets-dozens-of.html
Nameless Malware Discovered by NordLocker is Now in Have I Been Pwned
I’ve had a couple of cases to date where email addresses compromised by malware then discovered in the course of investigations have been provided to Have I Been Pwned (HIBP). Firstly by the Estonian Central Criminal Police a few years ago, then by the FBI and global counterparts this April and now, in the third such case, by NordLocker. (Full disclosure: I’m a strategic advisor for NordVPN who shares the same parent company.) NordLocker has written about the nameless malware that stole 1.2 TB of private data and the first sentence sets the scene: “Between 2018 and 2020, a custom Trojan-type malware infiltrated over 3 million Windows-based computers and stole 1.2 terabytes (TB) of personal information”.
https://www.troyhunt.com/nameless-malware-discovered-by-nordlocker-is-now-in-have-i-been-pwned/
VULNERABILITIES:
New TLS Attack Lets Attackers Launch Cross-Protocol Attacks Against Secure Sites
Researchers have disclosed a new type of attack that exploits misconfigurations in transport layer security (TLS) servers to redirect HTTPS traffic from a victim’s web browser to a different TLS service endpoint located on another IP address to steal sensitive information. The attacks have been dubbed ALPACA, short for “Application Layer Protocol Confusion – Analyzing and mitigating Cracks in tls Authentication,” by a group of academics from Ruhr University Bochum, Münster University of Applied Sciences, and Paderborn University.
https://thehackernews.com/2021/06/new-tls-attack-lets-attackers-launch.html
Hackers can exploit bugs in Samsung pre-installed apps to spy on users
Samsung is working on patching multiple vulnerabilities affecting its mobile devices that could be used for spying or to take full control of the system. The bugs are part of a larger set discovered and reported responsibly by one security researcher through the company’s bug bounty program. Since the beginning of the year, Sergey Toshin – the founder of Oversecured company specialized in mobile app security, found more than a dozen vulnerabilities affecting Samsung devices. For three of them, the details are light at the moment because of the high risk they pose to users. Without getting into particularities, Toshin told BleepingComputer that the least severe of these issues could help attackers steal SMS messages if they trick the victim.https://www.bleepingcomputer.com/news/security/hackers-can-exploit-bugs-in-samsung-pre-installed-apps-to-spy-on-users/
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
