12.11.2021
NEWS:
EU Commission takes on challenge to improve the cybersecurity of wireless devices
The European Commission has taken action to improve the cybersecurity of wireless devices available on the European market. As mobile phones, smart watches, fitness trackers and wireless toys are more and more present in our everyday life, cyber threats pose a growing risk for every consumer. The delegated act to the Radio Equipment Directive adopted today aims to make sure that all wireless devices are safe before being sold on the EU market. This act lays down new legal requirements for cybersecurity safeguards, which manufacturers will have to take into account in the design and production of the concerned products. It will also protect citizens’ privacy and personal data, prevent the risks of monetary fraud as well as ensure better resilience of our communication networks.
Gmail accounts are used in 91% of all baiting email attacks
Bait attacks are on the rise, and it appears that actors who distribute this special kind of phishing emails prefer to use Gmail accounts to conduct their attacks. According to a report by Barracuda, who surveyed 10,500 organizations, 35% of them received at least one bait attack email in September 2021 alone. What is a baiting attack? A “bait attack” is a sub-class of phishing where threat actors attempt to gather basic information about a specific target and use it for more targeted and effective attacks in the future.
How cyberattacks are changing according to new Microsoft Digital Defense Report
Earlier this month, Microsoft published the 2021 Microsoft Digital Defense Report (MDDR). Drawing upon over 24 trillion daily security signals across the Microsoft cloud, endpoints, and the intelligent edge, the 2021 MDDR expands upon last year’s inaugural report and contains input from more than 8,500 security experts spanning 77 countries—including insights on the evolving state of ransomware, malicious email, malware, and more.
Hacker-for-Hire Group Spied on More Than 3,500 Targets in 18 Months
A Russian-speaking hacker-for-hire group has been quietly spying on thousands of individuals and organizations worldwide and selling highly private information about them to various customers, motivated by financial gain and by politically driven agendas. Researchers from Trend Micro who have been tracking the cyber-mercenary group’s activities have called it Void Balaur after a legendary multiheaded creature in Eastern European folklore. In a report at the Black Hat Europe 2021 conference this week, the researchers described the group as being active likely as early as September 2015.
U.S. charges Ukrainian and Russian in major ransomware spree, seizes $6 mln
Nov 8 (Reuters) – The U.S. Justice Department charged a Ukraine national and a Russian in one of the worst ransomware attacks against American targets, court filings showed on Monday. The latest U.S. actions follow a slew of measures taken to combat a surge in ransomware that has struck several big companies, including an attack on the largest fuel pipeline in the United States that crippled fuel delivery for several days. An indictment accused Ukrainian Yaroslav Vasinskyi, who was arrested in Poland last month, of breaking into Florida software provider Kaseya over the July 4 weekend.
https://www.europol.europa.eu/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged
https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya
https://www.justice.gov/opa/speech/attorney-general-merrick-b-garland-deputy-attorney-general-lisa-o-monaco-and-fbi-director
U.S. offers $10 million reward for leaders of REvil ransomware
The U.S. is offering up to $10 million for identifying or locating leaders in the REvil (Sodinokibi) ransomware operation, including $5 million leading to the arrest of affiliates. This bounty is being offered as part of the Department of State’s Transnational Organized Crime Rewards Program (TOCRP), which rewards informants for information that leads to the arrest or conviction of individuals in transnational organized crime groups. Like the reward offered for information on DarkSide ransomware members, the amount rewarded for information depends on the person’s role in the REvil/Sodinokibi operation.
INCIDENTS:
Hackers undetected on Queensland water supplier server for 9 months
Hackers stayed hidden for nine months on a server holding customer information for a Queensland water supplier, illustrating the need of better cyberdefenses for critical infrastructure. SunWater is Australian government-owned water supplier responsible for operating 19 major dams, 80 pumping stations, and 1,600 miles long pipelines. According to the annual financial audit report that was published by the Queensland Audit Office yesterday, SunWater was breached for nine months, with the actors remaining undetected the entire time.
Indian securities depository exposed 44 million investors’ personal info – twice
Indian infosec consultancy CyberX9 claims it twice found records of 43.9 million shareholders exposed by systems operated by Central Depository Services Limited (CDSL) – and that the depository company responded slowly to its alerts of significant vulnerabilities. CDSL bills itself as a crucial player in India’s financial markets. It serves exchanges, investors, and issuers with depository services – electronic records of investors and their shareholdings. The company claims to have almost a million customers.
https://www.theregister.com/2021/11/09/cdsl_data_leak/
Ransomware Attack on Lab in Florida
A ransomware attack on a laboratory based in Florida has exposed the personal health information (PHI) of more than 30,000 patients. Nationwide Laboratory Services, which is based in Boca Raton, identified suspicious activity on its network on May 19, 2021. An examination of the activity revealed that attackers had used ransomware to encrypt files across the healthcare provider’s network, making their contents inaccessible. The lab hired a third-party cybersecurity firm to investigate the attack and assist with remediation. Digital forensics revealed that cyber-attackers had broken into areas of Nationwide Laboratory Services’ network that contained patients’ PHI.
https://www.infosecurity-magazine.com/news/ransomware-attack-on-florida-lab/
MALWARE:
Understanding .htaccess Malware
The .htaccess file is notorious for being targeted by attackers. Whether it’s using the file to hide malware, redirect search engines to other sites with blackhat SEO tactics, hide backdoors, inject content, modify php.ini values; the possibilities are endless. Many site owners are unaware of this file, due to it starting with a “.” making it a hidden file. .htaccess malware can be hard to pinpoint and clean on a server since it allows you to make multiple changes to the web server and its behavior.
https://blog.sucuri.net/2021/11/understanding-htaccess-malware.html
VULNERABILITIES:
Microsoft November 2021 Patch Tuesday fixes 6 zero-days, 55 flaws
Microsoft’s November 2021 Patch Tuesday, and with it comes fixes for six zero-day vulnerabilities and a total of 55 flaws. The actively exploited vulnerabilities are for Microsoft Exchange and Excel, with the Exchange zero-day used as part of the Tianfu hacking contest. Microsoft has fixed 55 vulnerabilities with today’s update, with six classified as Critical and 49 as Important.
https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2021-patch-tuesday-fixes-6-zero-days-55-flaws/
https://krebsonsecurity.com/2021/11/microsoft-patch-tuesday-november-2021-edition/
https://msrc.microsoft.com/update-guide/releaseNote/2021-Nov
https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169
VMware discloses a severe flaw in vCenter Server that has yet to fix
VMware announced it’s working on security patches to address an important severity privilege escalation vulnerability, tracked as CVE-2021-22048, in its vCenter Server. vCenter Server is the centralized management utility for VMware and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location. The flaw resides in the IWA (Integrated Windows Authentication) authentication mechanism, it received a CVSS score of 7.1. The vulnerability was privately reported to the virtualization giant by Yaron Zinar and Sagi Sheinfeld from CrowdStrike.
https://securityaffairs.co/wordpress/124465/security/vmware-vcenter-server-flaw.html
Remote Code Execution Flaw in Palo Alto GlobalProtect VPN
Cybersecurity vendor Palo Alto Networks is calling urgent attention to a remote code execution vulnerability in its GlobalProtect portal and gateway interfaces, warning that it’s easy to launch network- based exploits with root privileges. The Santa Clara, Calif.-based Palo Alto Networks said the security defect can be exploited to allow an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The company slapped a critical-severity rating on the CVE-2021-3064 vulnerability and noted that an attacker must have network access to the GlobalProtect interface to exploit this issue.
https://www.securityweek.com/remote-code-execution-flaw-palo-alto-globalprotect-vpn
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
