08.04.2022
NEWS:
Legacy systems still in use: making a cybersecurity case for modernisation
What does the term “Legacy Systems” mean to you? What image does it conjure up? Well, the word “legacy” can mean “something transmitted by or received from an ancestor or predecessor or from the past.” For example, the “legacy of the ancient philosophers”, or perhaps “legacy of ancient IT professionals.” A legacy is something that is passed from one generation to the next. That next generation may not have asked for this gift, but they must accept it nonetheless. Legacy Systems: According to Technopedia, and in the context of computing, the definition of a legacy system is “outdated computer systems, programming languages or application software that are used instead of available upgraded versions.
US Justice Department shuts down Russian darkweb marketplace Hydra
The US Department of Justice (DOJ) has shut down Hydra Market, one of the world’s largest darknet marketplaces. On Tuesday, the DOJ and German federal police seized Hydra’s servers and cryptocurrency wallets containing $25 million worth of bitcoin. Hydra was an online criminal marketplace where primarily Russian users bought and sold illicit goods and services, including illegal drugs, stolen financial information, fraudulent identification documents, and money laundering and mixing services. Transactions on Hydra were conducted in cryptocurrency with the operators earning revenue by charging a commission for every transaction conducted on the market.
https://www.zdnet.com/article/us-justice-department-shuts-down-russian-dark-web-marketplace-hydra/
https://www.bleepingcomputer.com/news/legal/germany-takes-down-hydra-worlds-largest-darknet-market/
Microsoft announces new Windows 11 security, encryption features
Microsoft says that Windows 11 will get more security improvements in upcoming releases, which will add more protection against cybersecurity threats, offer better encryption, and block malicious apps and drivers.
“In a future release of Windows 11 you’re going to see significant security updates that add even more protection from the chip to the cloud by combining modern hardware and software,” said David Weston, VP for Enterprise & OS Security. One of the new security features Microsoft is adding in Windows 11 is enhanced phishing protection against targeted phishing attacks with the help of Microsoft Defender SmartScreen, a cloud-based anti-phishing and anti-malware service.
INCIDENTS:
A cyber attack forced the wind turbine manufacturer Nordex Group to shut down some of IT systems
The attack was uncovered on March 31 and the company immediately started its incident response procedure to contain the attack. Nordex Group shut down “IT systems across multiple locations and business units” as a precautionary measure to prevent the threat from spreading across its networks. “On 31 March 2022 Nordex Group IT security detected that the company is subject to a cyber security incident. The intrusion was noted in an early stage and response measures initiated immediately in line with crisis management protocols. As a precautionary measure, the company decided to shut down IT systems across multiple locations and business units.” reads the announcement published by the company. “The incident response team of internal and external security experts has been set up immediately in order to contain the issue and prevent further propagation and to assess the extent of potential exposure.
Employee Info Among 13 Million Records Leaked by Fox News
A configuration error exposed millions of internal records traced back to Fox News, including personally identifiable information on employees, researchers have claimed. A team at Website Planet led by Jeremiah Fowler claimed that anyone with an internet connection could theoretically have discovered the 58GB trove, which was left open with no password protection. It contained almost 13 million records of content management data, including an unspecified number of employee details.
https://www.infosecurity-magazine.com/news/employee-info-13-million-records/
Hackers breach MailChimp’s internal tools to target crypto customers
Email marketing firm MailChimp disclosed on Sunday that they had been hit by hackers who gained access to internal customer support and account management tools to steal audience data and conduct phishing attacks. Sunday morning, Twitter was abuzz with reports from owners of Trezor hardware cryptocurrency wallets who received phishing notifications claiming that the company suffered a data breach. These emails prompted Trezort customers to reset their hardware wallet PINs by downloading malicious software that allowed stealing the stored cryptocurrency.
MALWARE:
New FFDroider malware steals Facebook, Instagram, Twitter accounts
A new information stealer named FFDroider has emerged, stealing credentials and cookies stored in browsers to hijack victims’ social media accounts. Social Media accounts, especially verified ones, are an attractive target for hackers as threat actors can use them for various malicious activities, including conducting cryptocurrency scams and distributing malware. These accounts are even more attractive when they have access to the social site’s ad platforms, allowing threat actors to use the stolen credentials to run malicious advertisements.
Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
Colibri Loader is a relatively new piece of malware that first appeared on underground forums in August 2021 and was advertised to “people who have large volumes of traffic and lack of time to work out the material“. As it names suggests, it is meant to deliver and manage payloads onto infected computers. Our Threat Intelligence Team recently uncovered a new Colibri Loader campaign delivering the Vidar Stealer as final payload. There is already published material about Colibri by CloudSek and independent researchers. Since most of the details about the bot have been covered, we decided to highlight a persistence technique we haven’t seen before.
Chinese hackers abuse VLC Media Player to launch malware loader
Security researchers have uncovered a long-running malicious campaign from hackers associated with the Chinese government who are using VLC Media Player to launch a custom malware loader. The campaign appears to serve espionage purposes and has targeted various entities involved in government, legal, and religious activities, as well as non-governmental organizations (NGOs) on at least three continents. This activity has been attributed to a threat actor tracked as Cicada (a.k.a. menuPass, Stone Panda, Potassium, APT10, Red Apollo) that has been active for more than 15 years, since at least 2006.
VULNERABILITIES:
Palo Alto Networks devices affected by CVE-2022-0778 OpenSSL bug
An attacker can trigger the vulnerability by crafting a malformed certificate with invalid explicit curve parameters. According to Palo Alto Networks, the CVE-2022-0778 vulnerability can be exploited by remote attackers to trigger a denial of service condition and crash vulnerable devices. The security vendor is expected to release security patches for the above vulnerability this month. Even though the OpenSSL team released a patch two weeks ago when it publicly disclosed the bug, customers will have to wait until later this month (during the week of April 18) when Palo Alto Networks plans to release security updates.
https://securityaffairs.co/wordpress/129935/hacking/palo-alto-networks-devices-openssl-flaws.html
Apple Leaves Big Sur, Catalina Exposed to Critical Flaws: Intego
Apple is being called to task for neglecting to patch two “actively exploited” zero-day vulnerabilities on older versions of its flagship macOS platform. On March 31, Apple released emergency patches for the two memory corruption vulnerabilities — CVE-2022-22675 and CVE-2022-22674 — and said it was aware of a report that it was “actively exploited” in the wild. Those patches were only made available for iOS, iPadOS and macOS Monterey, meaning that Apple customers running Big Sur, Catalina or older versions of the operating system will remain exposed to hacker attacks targeting these security defects.
https://www.securityweek.com/intego-apple-leaves-big-sur-catalina-exposed-critical-flaws
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
