The Polyfill.io Supply Chain Attack

Over 100,000 websites were impacted after a Chinese company called Funnull bought the Polyfill.io domain and modified the service’s script to redirect users to scam websites instead of doing what they were supposed to do. It’s anyone’s guess how a company can do this, even in China, but this is 2024. But the sheer damage that spread like wildfire made me dive into the incident to understand the mechanics and implications of the attack. Here’s what I found.

What is a Polyfill?

Let’s clarify what a polyfill is, because I wasn’t really in the loop what it is either, to be honest. In web development, a polyfill is a type of code that adds modern functionality to older browsers that don’t support it. JavaScript is the best example that does this. This way a user with an outdated browser can still see everything as opposed to broken parts interspersed with the rest.

Polyfill.io was a popular service that provided these scripts to hundreds of thousands of websites, allowing developers to maintain a consistent codebase across all browsers. But see the past tense – it was a popular service.

The Polyfill.io Attack Unfolds

Earlier this year, Polyfill.io was purchased by Funnull, a company supposedly officially based in Slovenia but many attributes suggest a Chinese origin instead. Unfortunately all of this came under scrutiny after the attack took place.

After Polyfill.io the cybersecurity firms like Sansec and c/side raised alarms immediately. Scripts served by Polyfill.io began injecting malicious code into websites, redirecting users to unwanted and often dangerous sites, e.g. a fake Sportsbook site or “www.googie-anaiytics.com” – a clever misspelling of Google Analytics. Scams often employ these tactics to confuse users.

The Scale of Impact

The scale of this attack is staggering because it was lightning quick and came without notice. Over 100,000 websites are affected, including the likes of JSTOR, Intuit, and the World Economic Forum. The malicious code targets mobile devices the most and activates only under specific conditions.. The modified scripts are designed to evade reverse engineering and avoid triggering when they detect admin accounts or web analytics services. My presumption with 10 years in the field is that this is because the actors behind the attack wanted to remain unnoticed for longer.

Google’s Response

Google quickly began notifying advertisers about the potential risks of landing pages that use Polyfill.io’s services. Soon after, they went further and started blocking Google Ads for websites using the compromised scripts, noticeably reducing traffic to these sites. At that point everyone woke up, it seems, and started taking steps to mitigate the issue.

To be clear – modern browsers don’t need this service. It is mostly there for legacy purposes. The original developer of Polyfill.io who sold the service advised immediate removal. Cloudflare and Fastly quickly set up mirrors that cut away the infected code.

So what now?

For now, the Polyfill.io domain has been redirected to Cloudflare, but the DNS servers haven’t changed. This means the malicious actors could regain control at any time. My 2 cents is this is a stark reminder to stay away from old services like this. In 2024 most users are forced to upgrade and most devices are newer than needed anyway.

AT&T with an investigation into a data breach

Due to a data breach that affected 73 million current and past customers and contained personally identifiable information (PII) such as Social Security numbers, AT&T has opened an investigation. The leaked data was found on the dark web in the beginning of April. It’s unclear if AT&T or one of its vendors provided the information directly.

Nevertheless, AT&T has made it clear that there isn’t any proof of illegal access resulting in the exfiltration of data from its systems. Presumably from 2019 or earlier, the leaked data lacks critical information such as specific call history or financial details. An estimated 7.6 million active and 65.4 million past account holders have been impacted.

Sophos report is warning: SMBs are being targeted more than ever

A concerning new trend for 2024 is the increase in malware attacks against small and medium-sized businesses (abbreviated as SMBs). A Sophos report claims that nearly half of all malware incidents discovered on SMB endpoints in the previous year were caused by keyloggers, spyware, and info stealers. The later are pieces of malware that are specifically created to steal sensitive data and login credentials. The difficulties in identifying these cyberthreats, which further compromises authentic accounts and expands the avenues for cybercriminals to operate, are brought to light by the researchers.

The most likely and worst case scenario is the ongoing development of ransomware attacks, which are expected to increase in frequency by over 60% in the next few years with respect to remote encryption. The second most frequent threat variant is business email compromise, which also includes pre-attack phone calls and conversational emails to the target.

While these statistics are exponential, the major issue brought out by the researchers is the fact that these cyberthreats are too hard to spot. This results in more legitimate accounts exploited and victims to the growing opportunism of the cyber criminals.

Adobe with 24 patches for April 2024

Adobe fixed 24 CVEs in Adobe After Effects, Photoshop, Commerce, InDesign, Experience Manager, Media Encoder, Bridge, Illustrator, and Adobe Animate with nine patches that were released in April. The majority of these updates are for Experience Manager, but they are all just fixing basic Cross-site Scripting (XSS) vulnerabilities. Nevertheless, these Important-severity bugs have the potential to cause code execution if they are used maliciously.

The Animate and Commerce patches are the only other patches that address multiple CVEs. There are four bugs fixed in the Animate patch. Two of these have a critical rating and have the potential to cause arbitrary code execution. Two other Critical-rated bugs—one related to improper input validation and one related to XSS—are also fixed by the Commerce patch. Code execution could result from either.

At the time of release, none of the bugs that Adobe fixed this month were known to the public or targeted by active attacks. These updates have a deployment priority rating of 3 according to Adobe.

Microsoft released a whopping 147 new CVEs

Microsoft released 147 new CVEs in April. All are in Microsoft Windows and Windows Components; Office and Office Components and Azure; .NET Framework and Visual Studio; SQL Server; DNS Server; Windows Defender; Bitlocker; Windows Secure Boot. When counting in the third-party CVEs acquired this month, the CVE count comes to 155. Three of these bugs arrived via the ZDI program.

Of the new patches released, three are rated Critical, 142 Important, and two Moderate in severity. This is the biggest release from Microsoft this year and the largest since at least 2017. As far as we can tell, it’s the largest Patch Tuesday release from Microsoft of all time. It’s not clear if this is due to a backlog from the slower months, a surge in vulnerability reporting. It will be interesting to see which trend continues. None of the CVEs are listed as currently under active attack or as publicly known at the time of release.

Hackers Exploiting WP-Automatic Plugin Bug

A high-severity security vulnerability in the ValvePress Automatic plugin for WordPress is being actively exploited. The weakness, cve-2024-27956, has a CVSS rating of 9.9/10 and affects all versions of the plugin before 3.92.0. Although the fault was repaired on February 27, 2024, when version 3.92.1 was revealed, the changelog does not mention it. Bad actors might utilize the fault to access sites without the owner’s permission, persuade admin‐level user accounts, upload malware payloads, and potentially seize control of unprotected systems. The bug arises from a deficiently implemented authentication check associated with the plugin’s user authentication protocol.

Two Cisco Zero-Day Vulnerabilities Exploited for Espionage

A new malware operation used two zero-day vulnerabilities in Cisco networking equipment to distribute custom malware and enable stealth data collection inside the targeted environments. Cisco Talos, who named the campaign ArcaneDoor, claims to have discovered the malware and that the attacker is a sophisticated state-sponsored threat actor known as UAT4356 (also tracked as Storm-1849 by Microsoft). According to a blog post, Talos said that the compromise was discovered and documented in on early January of 2024. 

The adversaries are exploiting:

• CVE-2024-20353 (CVSS rating: 8.6) – Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial-of-Service Vulnerability
• CVE-2024-20359 (CVSS rating: 6.0) – Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability 

This case is a reminder to all of us that a zero-day attack is a powerful weapon that cybercriminals use to exploit a security hole that is not known to the public.

CISA Hacked via Ivanti Vulnerabilities

For more than a month, the world has been responding to Ivanti VPN vulnerabilities, but new information keeps coming to light. How can businesses expect to perform any better if the U.S. Cybersecurity and Infrastructure Security Agency can be hacked using the same method they warned everyone else about?

The U.S. cybersecurity agency, CISA, confirmed that a threat actor had compromised two of its internal systems by taking advantage of vulnerabilities in Ivanti products. Two zero-day vulnerabilities that were being exploited by a Chinese nation-state threat actor were revealed by Ivanti on January 10. 

Robust Cybersecurity is still the most important advantage that businesses can have in any competitive market. You will attract more and better clients and increase your revenue if you can demonstrate to your clients that you are highly resistant to the Citrix Netscaler vulnerabilities, CISCO ASA vulnerabilities, and Ivanti VPN vulnerabilities. Businesses that are unable to accomplish this will either suffer from a cyberattack or from a loss of clients.

UnitedHealth Has Suffered a Cyberattack

Pharmacies around the US are finding it difficult to control the distribution of prescription drugs to patients as a result of a cyberattack on UnitedHealth. Hackers breached the network of Change Healthcare, a UnitedHealth subsidiary that handles prescription processing for tens of thousands of pharmacies across the country.

Prescriptions could not be sent by pharmacies to insurance companies for reimbursement due to a cyber incident. The continuous problem prevented Naval Hospital in Camp Pendleton, California, from processing any prescription claims, and Evans Army Community Hospital in Colorado reported delays in prescription orders that affected refills and dispensing. A small pharmacy in Norton, Kansas called Moffet Drug and the prescription discount service GoodRx both reported service interruptions. 

In a filing with the Securities and Exchange Commission (SEC), UnitedHealth revealed that there’s a chance that a group of hackers funded by a foreign country planned the cyberattack. The business quickly identified and contained the attack, alerted law enforcement, and started working to get its systems back online.

In response, the American Hospital Association recommended that hospitals cut off from UnitedHealth’s network until the problem was fixed in order to reduce their vulnerability to hackers. Change Healthcare thinks that because disruptions persisted during the attack, the attack was contained within its network.

“Mother of all Breaches” brings more security implications

Early in 2024, researchers from Security Discovery and Cybernews stumbled upon a dataset that included 26 billion compromised accounts from a variety of platforms, including Tencent, Adobe, Dropbox, LinkedIn, X (Twitter), Canva, and Telegram. This discovery was named as the “mother of all breaches” (MOAB).

The widespread hack has affected numerous international government agencies, including those in the US, Brazil, Germany, the Philippines, and Turkey. The recently released dataset contains some new information in addition to data that was stolen in earlier breaches. The disturbing thing is that businesses could face serious issues due to the continuous risk the 12-terabyte dataset poses to client information and business security. Thanks to the data that is available, threat actors can now launch more effective cyberattacks and easily carry out crimes like identity theft.

Therefore, it is advised that businesses adopt a proactive stance and monitor their infrastructure for signs of unusual activity, such as phishing attempts, unexpected network traffic, suspicious account activity, unknown access scenarios, and notable customer feedback. When everything is taken into account, the MOAB cyber incident emphasizes how important it is for businesses everywhere to drastically change their viewpoint on effective network security.

A million scam was achieved by a ransomware group.

A significant section of the US healthcare sector was the target of a cyberattack conducted more than a month ago by a group of Russian hackers. The group planned a ransomware attack against a national Optum healthcare management system that manages patient accounts, including insurance claims, prescription orders, and payment processing.

Optum allegedly paid AlphV, a hacker group also going by the name Black Cat, to get rid of the ransomware and get back the stolen data. Blockchain’s ledger shows that on Friday, seven transfers totaling $3,348,114 were made from one account to seven different accounts. After fees, the total came to about $22 million. Later, an unidentified person on a dark web forum verified the$22 million payment but claimed AlphV took the money but kept lying and delaying the recovery of the stolen data.

This 4TB of “critical data” is sourced from multiple insurance and healthcare providers, including Medicare, Loomis, CVS-Caremark, and Metlife. A seizure notice appeared on AlphV’s website shortly after, most likely as a result of FBI and foreign agency action. However, the UK’s National Crime Agency—which was given particular credit on the notice—denied any involvement.

After more research, it was discovered that the seizure notice was a copy of one from another AlphV website, suggesting that the group is really defrauding its affiliates and creating the appearance of an FBI takedown. AlphVs may decide to go into hiding for the time being, reorganize, and then reappear on the dark web using a new identity. This is a typical strategy used by hacker groups under legal threat. This incident demonstrates that hackers will do whatever it takes to make quick profits.

Lockbit Has Made a Comeback

International law enforcement agencies severely disrupted the well-known ransomware group Lockbit in February. More than a thousand decryption keys were obtained by law enforcement as part of this operation, and several known Lockbit associates are currently being held.

These keys might aid in the recovery of affected data for group victims. Although this was good news, events changed a few days later. Lockbit seems to have already made a comeback with new encryptors and servers. In light of recent law enforcement actions, it is unclear if this group has been significantly impacted or if they have simply moved their operations elsewhere.

Meta Faces GDPR Complaint for Consent Withdrawal Fees

Meta is under fire for requiring users to pay up to €251.88 per year to withdraw consent for tracking on Facebook and Instagram. This goes against GDPR rules, which mandate that withdrawing consent should be as easy as giving it. NOYB filed a complaint in Austria, challenging Meta’s approach and demanding a fee-free withdrawal method. This case could set a precedent for privacy charges and impact Meta’s operations in the EU.

Urgent: GitLab Releases Critical Updates

GitLab issued critical updates for CVE-2023-7028, a severe email verification flaw allowing account takeovers, and CVE-2023-5356, which prevented command execution via Slack/Mattermost integrations. Users are urged to update GitLab to the latest versions and enable 2FA for enhanced security.

GitHub Addresses High-Severity Vulnerability

GitHub resolved a high-severity vulnerability (CVE-2024-0200) exposing credentials, leading to the rotation of key credentials, including GitHub Actions and Codespaces keys. Users need to import new keys to stay secure. GitHub continues its proactive cybersecurity measures.

Outlook Calendar Invite Vulnerability

Varonis researchers disclosed a Microsoft Outlook vulnerability (CVE-2023-35636) that leaks hashed passwords through malicious calendar invites. While patched in December 2023, it’s crucial to stay vigilant against such threats, use Kerberos over NTLM for authentication, and keep software updated.

Massive Data Leak: Mother of All Breaches (MOAB)

A colossal data leak, dubbed the “Mother of all Breaches” (MOAB), exposed 12 terabytes of data with over 26 billion records from platforms like LinkedIn and Twitter. This poses severe threats, including identity theft and phishing attacks. Users are advised to enhance cybersecurity practices, use strong passwords, and enable multi-factor authentication.

New Malvertising Scheme Spreading CACTUS Ransomware

A hacking group known as Twisted Spider, has been detected using a new malvertising scheme to spread the CACTUS ransomware. This group had previously been linked to the QakBot malware, which had been taken down by law enforcement. To adapt, Twisted Spider turned to Storm-1044 services. They infect target computers with the DanaBot initial access Trojan, a threat observed since November 2023. DanaBot specializes in stealing information, including login credentials, and gives this stolen data to hackers. Once inside a network, Storm-1044 moves laterally, effectively handing control to Twisted Spider. Subsequently, the CACTUS ransomware is unleashed on the compromised systems, becoming a favorite among ransomware operators.

In conclusion, that’s a wrap for our January 2024 Cybersecurity Monthly Recap. We hope this update has provided you with valuable insights into the evolving world of cybersecurity and data privacy. Your engagement is essential to us, so feel free to share any interesting articles or news updates in the comments section below. Stay safe and stay secure!

Microsoft Disables MSIX App Installer Protocol Exploited Widely in Malware Attacks

Microsoft has made a significant security update by disabling a feature known as the ms-appinstaller protocol handler in its App Installer. This decision was taken because cybercriminals were exploiting this feature to spread malware, which could lead to ransomware attacks. The ms-appinstaller protocol handler was initially designed to make installing apps easier, but attackers found a way to use it for harmful purposes. They created malicious app packages, which appeared legitimate, and distributed them through various channels like Microsoft Teams and deceptive online advertisements. These advertisements often mimicked popular software, luring users to download harmful content.

To combat this threat, Microsoft has updated the App Installer to a newer version (1.21.3421.0 or higher), where the ms-appinstaller protocol handler is turned off by default. This change aims to close the loophole that attackers were exploiting and is a proactive step by Microsoft to enhance the security of its users by preventing the distribution of malware through this method.

Operation Triangulation Targets Apple iOS Devices

In a recent revelation, a highly complex and sophisticated type of spyware attack, known as “Operation Triangulation,” has been identified targeting Apple’s iOS devices. This attack is particularly alarming because it managed to bypass the robust hardware-based security features that Apple is known for. Discovered by the Russian cybersecurity firm Kaspersky, which itself was one of the targets, this attack chain is considered the most intricate and advanced they’ve ever seen. Active since 2019, this campaign took advantage of unique vulnerabilities within Apple’s system that had not been exploited before.

The attack begins with a seemingly harmless iMessage that contains a malicious attachment. This is a “zero-click” attack, meaning it doesn’t require any action from the user, like clicking a link, to activate. The spyware then silently works to gain extensive control over the device, bypassing security measures to gather sensitive information. It achieves this by chaining together four previously unknown flaws (zero-day flaws) in iOS, allowing the attackers to deeply infiltrate and plant spyware in devices up to iOS version 16.2. This level of access and the method of execution make it a particularly dangerous and stealthy form of cyber espionage.

Carbanak Banking Malware Resurfaces

Carbanak, a notorious banking malware, has recently made a comeback with a twist in its operations. Previously known for targeting banks, Carbanak has now been spotted in ransomware attacks. This change in strategy was noted in the November 2023 ransomware attacks analyzed by the cybersecurity firm NCC Group. They observed that Carbanak has evolved, now incorporating new methods and techniques to enhance its effectiveness in cyberattacks.

What’s new with Carbanak is how it’s being spread. The malware has been distributed through compromised websites, cleverly disguised as various business-related software programs. It mimics popular tools like HubSpot, Veeam, and Xero, tricking users into downloading it. Carbanak, active since at least 2014, is known for its abilities to steal data and remotely control infected systems. Originally a banking malware, it has been associated with the FIN7 cybercrime syndicate, a group known for targeting financial institutions. This shift to ransomware tactics marks a significant evolution in its use, making it more threatening to a broader range of targets.

EU Negotiators Come To Agreement on EU AI Act 

The European Union has made a significant step forward with the agreement on the EU Artificial Intelligence (AI) Act. This act is a comprehensive set of rules to manage the development and use of AI within the EU. A key aspect of this agreement is the distinction between different types of AI models, categorized into two types: high impact and low impact. High impact models, due to their potential significant influence or risk, are subject to strict regulations.

These regulations include the requirement to conduct thorough evaluations of the models, assess and reduce systemic risks, perform adversarial testing, report serious incidents to the European Commission, ensure robust cybersecurity measures for the data used by these models, and also report on the energy efficiency of the models. The enforcement of the AI Act will not start immediately; it is expected to begin two years after the act is officially passed, which is projected to be around 2026.

Interpol Says Trafficking For Cyber Scams Is Expanding Globally 

Interpol recently conducted its first major operation specifically targeting a growing global issue: human trafficking being used to fuel online fraud schemes. During this operation, which took place over four days in mid-October, Interpol carried out over 270,000 inspections across 450 locations known for human and migrant trafficking activities. The troubling trend they’re addressing involves human trafficking victims being deceived with false promises of high-paying jobs in foreign countries. Once these individuals arrive, they are forced by traffickers to engage in online scams.

This issue has been particularly prevalent in Southeast Asia, where Chinese criminal organizations have expanded into countries like Cambodia and Myanmar. These groups use a mix of corruption and violence to operate their scamming activities, largely beyond the reach of law enforcement. However, Interpol’s recent findings indicate that this practice is not confined to Southeast Asia. The operation revealed the spread of these criminal activities to other regions, such as Peru, where over forty Malaysian victims of human trafficking were rescued from being compelled to commit online fraud. This expansion highlights the global scale of the problem and the need for continued international efforts to combat these criminal networks.

ALPHV Blackcat Emplys New Ransomware Tactics

ALPHV Blackcat, a notable ransomware group, has evolved its tactics in carrying out cyber attacks. Instead of just using ransomware, they now also engage in phishing and compromising accounts to steal data and extort money from their victims, without necessarily deploying ransomware. This means they can gain control over a victim’s data and then demand money for not releasing or misusing it.

Recently, ALPHV Blackcat released an updated version of their ransomware, dubbed “ALPHV Blackcat Ransomware 2.0 Sphynx.” This new version comes with enhanced capabilities like better evasion of security defenses and additional tools for the affiliates who carry out the attacks. It’s capable of targeting both Windows and Linux devices, as well as VMWare instances. The FBI reports that ALPHV Blackcat affiliates have attacked over 1,000 entities worldwide, with about 75% of these attacks occurring in the United States. The group has demanded over $500 million in ransoms and has received nearly $300 million in payments. This widespread impact underlines the serious threat posed by this ransomware group. For more detailed information, you can read the full advisory on the Cybersecurity & Infrastructure Security Agency (CISA) website here.

2023 Is A Record Year for Ransomware

2023 has been a record-breaking year in terms of ransomware attacks, highlighting a growing cybersecurity threat worldwide. According to research by NCC Group, by the end of November 2023, there were 4,276 ransomware attacks globally, which is more than double the number from the previous year. And this count doesn’t even include the data for December.

In addition to the increase in ransomware attacks, there’s also a significant number of new vulnerabilities discovered this year – over 26,000, as per Qualys researchers. However, only a small fraction of these vulnerabilities, around 7,000, were considered high risk, and even fewer, 206, had weaponized code available. These particular vulnerabilities are of special concern to information security professionals because they are more likely to be exploited. Notably, over 32% of these critical vulnerabilities were related to network infrastructure or web applications, areas that require urgent patching or mitigation. The average time to exploit vulnerabilities this year was 44 days, but some were exploited the same day they became public.

Conclusion

As we conclude the events, December 2023 serves as a reminder of the dynamic and challenging cybersecurity environment we navigate. It stresses the importance of continuous learning, adaptation, and collaboration among cybersecurity professionals, organizations, and governments to protect digital assets and maintain trust in our technology-driven world.

Widespread Ransomware Attacks

November 2023 started with a series of ransomware attacks targeting a diverse range of victims from healthcare organizations to educational institutions. Among the notable incidents, the TransForm Shared Service Organisation experienced a significant data breach affecting five Canadian hospitals, with the Daixin Team claiming responsibility.

A massive ransomware attack paralyzed local government services across 70 municipalities in Germany. The attack encrypted servers of the local municipal service provider Südwestfalen IT, demonstrating the increasing risk to public sector infrastructure.

In a turn of events, Dallas County successfully interrupted a data exfiltration attempt during a ransomware attack, preventing file encryption and highlighting the importance of proactive cybersecurity measures.

Boeing confirmed a cyberattack impacting its parts and distribution business. The LockBit ransomware group claimed responsibility for the attack, underscoring the vulnerability of even the largest global corporations. Meanwhile, the American Airlines pilot union faced a ransomware attack, with sensitive information of thousands of pilots and applicants accessed, raising serious privacy concerns.

Moneris, a Canadian banking tech giant, and MeridianLink, a financial software company, confirmed cyberattacks, with MeridianLink facing an unusual extortion tactic by AlphV/Black Cat.

Toyota Financial Services, a subsidiary of the Toyota Group that provides financial services to customers and dealers, was attacked by Medusa ransomware, a malware group that encrypts data and demands payment for decryption. The operators of Medusa ransomware threatened to leak the data of Toyota Financial Services if the ransom was not paid. The company confirmed that it detected unauthorized access to some of its systems in Europe and Africa, and that it was working to resolve the issue and protect its customers’ data.

Yamaha Motor Co., Ltd. confirmed that one of the servers managed by its motorcycle manufacturing and sales subsidiary in the Philippines, Yamaha Motor Philippines, Inc. (YMPH), was accessed without authorization by a third party and hit by a ransomware attack. According to the information that was disclosed, some employees’ personal information stored by YMPH had been leaked. The news release also states that Yamaha Motor and YMPH have set up a countermeasures team and have been working to prevent further damage, investigate the scope of the impact, and recovering the systems with the help of an external internet security company. Yamaha Motor apologized for the inconvenience and worry caused by the incident and reported it to the Philippine authorities.

Major Data Breaches

Marina Bay Sands, a luxury resort and casino in Singapore, has disclosed a data breach that affected 665,000 customers who visited the property between January 2014 and March 2020. The breach exposed personal information such as names, contact details, loyalty program numbers, and government-issued identification numbers. The resort said it had notified the affected customers and offered them free identity theft protection services. It also said it had enhanced its security measures and was cooperating with the authorities to investigate the incident.

McLaren Health Care, a Michigan-based health system, has announced a data breach that impacted 2.2 million people who received medical services at its facilities between February 2019 and October 2020. The breach occurred when an unauthorized party gained access to a third-party vendor’s systems that stored McLaren’s patient data. The data included names, dates of birth, medical record numbers, insurance information, and limited treatment information. McLaren said it had notified the affected individuals and offered them free credit monitoring and identity protection services. It also said it had terminated its relationship with the vendor and was working with law enforcement to investigate the incident.

Samsung Electronics has notified some of its UK customers of a data breach that exposed their personal information to an unauthorized individual. The breach occurred between July 1, 2019, and June 30, 2020, and affected customers who made purchases from the Samsung UK online store. The data included names, contacts, dates of birth, and product registration data. Samsung said it had fixed the issue, notified the authorities, and offered free identity theft protection services to the affected customers

Vulnerabilities and Patches

Four zero-day vulnerabilities (ZDI-23-1578 to ZDI-23-1581 ) were identified in Microsoft Exchange, enabling attackers to execute arbitrary code or steal sensitive information remotely on vulnerable Exchange servers. These vulnerabilities underscore the ongoing risks in widely used communication platforms and the necessity of immediate updates.

CISA warned federal agencies to secure Juniper devices against four vulnerabilities (CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) that are being exploited by hackers to launch remote code execution attacks. The vulnerabilities affect the Junos OS web server, which runs on various Juniper products, such as routers, switches, and firewalls. The advisory underscored the need for heightened security in network infrastructure, as the hackers can send malicious requests or headers to the web server and execute arbitrary commands on the unprotected device without needing any authentication.

In another advisory, CISA highlighted three vulnerabilities (CVE-2023-36033, CVE-2023-36025, and CVE-2023-36036) disclosed by Microsoft during its Patch Tuesday updates. They affect Microsoft Exchange Server, Microsoft Office, and Microsoft Windows and their inclusion in CISA’s vulnerability list reflected the significance of these bugs and the need for rapid patching.

November also marked the addition of three actively exploited vulnerabilities (CVE-2023-36584, CVE-2023-1671, CVE-2020-2551) to CISA’s KEV catalog. The flaws are affecting Microsoft devices, a Sophos product, and an Oracle solution, underlining the ongoing threat landscape in these software and hardware products.

A critical vulnerability tracked as CVE-2023-36052 was addressed by Microsoft, this time in Azure CLI, a tool that allows users to manage Azure resources from the command line. The vulnerability, which was discovered by a security researcher from Palo Alto Networks, could expose the credentials of users who run Azure CLI commands in GitHub Actions or Azure DevOps pipelines. Microsoft has fixed the vulnerability and advised users to update their Azure CLI version to 2.31.0 or later, and to revoke and regenerate any compromised credentials.

Conclusion

This is how the cybersecurity landscape looked like in November 2023 through our lenses. It was a month that presented a dynamic and evolving set of security challenges that highlighted the importance of adopting robust security practices because, in times when cyber threats continue to advance, the best defense is an informed and proactive approach.

Photo by Pixabay: https://www.pexels.com/photo/security-logo-60504/

Definition of Cybersecurity

Cybersecurity is the practice of keeping private data, systems, networks, and programs safe from hacking, theft, and other digital threats. In the context of college, this means keeping personal and academic information safe from possible threats.

Use Only Verified Writing Help Services

When it comes to academic tasks, students often find themselves overwhelmed, seeking efficient solutions to navigate through the challenges of writing assignments. In this digital age, online help services play a pivotal role in getting you ready for writing. Highly qualified writers in the field of academic research papers are readily available on Papersowl. You can pay to write paper and professionals will provide invaluable support for students tackling complex assignments. For those seeking tailored assistance, consider leveraging the expertise of online help services. These platforms connect you with experienced professionals, ensuring the quality and authenticity of your work. 

Importance of Cybersecurity in College

Because there is so much personal and academic information moving around in college and university networks, these places are popular spots for cyber risks. It’s clear that strong cybersecurity steps are needed for everything from student records to financial information. Let’s take a look at some of the most common cyber risks that college students face.

Common Cybersecurity Threats in College

Phishing Attacks

Phishing attacks try to get private information by tricking people, usually through fake emails or texts. Because college students use email so much, they are more likely to be affected by these kinds of threats.

Malware

Malicious software, or malware, can get into computers and change or delete data. With so many gadgets connected, college networks are perfect places for malware to grow if the right safety measures aren’t taken.

Password Breaches

Hackers can quickly take advantage of weak passwords. As college students juggle many accounts and tasks, they might accidentally weaken their security by using passwords that are easy to figure out.

Public Wi-Fi Risks

There is often public Wi-Fi on college campuses, but these networks aren’t always safe, leaving users open to threats. If you don’t take the right steps, private data sent over these networks could be at risk.

Essential Cybersecurity Tips for College Students

Strong Password Practices

A basic step in protection is to make strong, unique passwords and change them often. Don’t use information that is easy to guess, like names or dates.

Two-Factor Authentication

When you can, use two-factor verification. This makes things safer by needing a second way of proving who you are, like a verification code sent to your phone.

Secure Wi-Fi Usage

Use a virtual private network (VPN) to protect your internet connection when you’re on public Wi-Fi. This keeps your info safe from people who might want to listen in on it.

Regular Software Updates

Software and hardware should always be kept up to date. Updates often come with security patches that fix bugs and make it less likely that they will be used against you.

Protecting Personal Devices

Antivirus Software

To find and get rid of bad software, install antivirus software from a reputable company. Scan your gadgets often to keep them safe from possible threats.

Firewall Settings

Turn on firewalls on your devices to keep an eye on and manage all network data, both coming and going. This adds another layer of protection against people who shouldn’t be there.

Device Encryption

Adding an extra layer of security by encrypting your devices makes sure that the data is still safe even if your device is lost or stolen.

Social Media and Online Presence

Privacy Settings

Check and make changes to your social media private settings. Social engineering attacks are less likely to happen if you limit the information that everyone can see.

Caution with Personal Information Sharing

Watch out for the things you post online. Don’t post private information that could be used against you, like where you live or what you do every day.

Cybersecurity Education Initiatives

Workshops and Seminars

Take part in classes and seminars on cybersecurity that your college puts on. These classes can help you learn important things and give you useful advice on how to stay safe online.

Online Courses

Look into online classes that teach the basics of cybersecurity. You can make smart choices about your internet safety if you learn more about this topic.

Campus Resources

Use the campus tools that are set aside for cybersecurity. It’s important to know where to look for help, whether it’s a specialized support team or helpful materials.

Reporting Cybersecurity Incidents

Importance of Reporting

Report any possible cybersecurity events right away. Reporting threats early can stop more damage and keep others from falling for the same ones.

Reporting Channels

Learn how to report cybersecurity problems on your school through the right channels. This could be a number or a special email address.

Staying Informed on Cybersecurity Trends

Following Cybersecurity Blogs

Follow reputable blogs in the area of cybersecurity to stay up to date on the latest trends. This information makes you more likely to take advantage of new security steps.

Subscribing to Newsletters

Sign up for cybersecurity newsletters to get regular updates on new threats and ways to protect yourself. The best way to protect yourself from new online risks is to learn about them.

Conclusion

Because everything in college is linked, cybersecurity is not a choice but a must. College students can make themselves safer from cyber threats by following the important tips in this piece. Keep in mind that you are the one who is responsible for keeping your information safe. Keep yourself aware and alert, and have a safe time in college online.

Spanish Authorities Arrest 34 Cybercriminals Involved in Data Theft from 4 Million Individuals

The Spanish National Police has taken down a cybercriminal organization involved in a wide range of computer scams that targeted over four million individuals. This operation involved 16 targeted searches and the arrest of 34 group members across multiple cities in Spain. During the police raids, firearms, luxury cars, cash, and computers containing data on four million people were seized.

The arrested individuals were linked to email and SMS phishing schemes, including impersonating delivery companies and utilities. They also used deceitful ‘son in distress’ calls to extort money from parents and rerouted merchandise by exploiting an insider’s position in a tech company. Their scams were diverse, with one involving a false loan scheme where they stole customer data from financial institutions and tricked victims into providing sensitive information on phishing sites.

The group’s estimated profit from these activities amounted to €3,000,000, which was funneled into cryptocurrency investment platforms. Law enforcement continues to work on identifying more culprits and victims in the coming months.

Seiko watch company data breach exposes 60,000 records

Japanese watch company Seiko confirmed on 25th of October 2023 that a data breach exposed the personal information of 60,000 customers. The breach occurred in August 2023, but was not discovered until October.

The Seiko data breach is believed to have been caused by a vulnerability in the company’s website. The hackers were able to exploit the vulnerability to gain access to Seiko’s customer database. The company has taken steps to fix the vulnerability in its website and has notified the affected customers of the breach. The company has also offered them free credit monitoring services.

Cloudflare reports a significant surge in HTTP DDoS attacks

The latest quarterly report from Cloudflare, released on 26th of October, reveals that the third quarter of 2023 witnessed a significant surge in HTTP distributed denial-of-service (DDoS) attacks, marking a 65% increase compared to the preceding quarter. Additionally, layer 3/4 DDoS attacks, which focus on compromising infrastructure resources, saw a 14% rise over the same period. The analysis revealed that gaming and gambling companies were the primary targets of DDoS attacks, likely due to the lucrative nature of these industries and their persistent vulnerabilities.

Interestingly, various regions experienced different attack patterns, with the software sector and farming industry being the most targeted in North America and Latin America. Cloudflare played a vital role in thwarting nearly 140 billion daily cybersecurity threats, including a record-breaking DDoS attack peaking at 201 million requests per second. As a result, organizations are encouraged to implement automated HTTP DDoS Protection to safeguard against the increasing prevalence of such attacks.

Cybercriminals target Las Vegas-area parents with threats

Cybercriminals have been targeting Las Vegas-area parents with threats to release their children’s personal information, including names, addresses, phone numbers, and social security numbers, if they do not pay a ransom. The criminals are believed to have obtained the information from a data breach that occured in August 2023 at a local school district, according to the information shared by DataBreaches.net. Parents are being urged to change their passwords and be extra vigilant about online security. They are also being advised to monitor their children’s credit reports for any unauthorized activity.

Malware disguised as cryptominer infects 1 million PCs

Antivirus provider Kaspersky has uncovered a highly sophisticated strain of malware known as “StripedFly”, which has been masquerading as a cryptocurrency miner to avoid detection for over five years. This deceptive malware has infected more than 1 million Windows and Linux computers worldwide since 2016. Kaspersky’s security researchers initially detected two infections linked to WINNIT.exe in their antivirus products, leading to the discovery of StripedFly. While it was originally categorized as a cryptocurrency miner, a deeper analysis revealed its complexity, incorporating techniques believed to have originated from the US National Security Agency, including a version of the infamous EternalBlue exploit.

StripedFly employs its custom EternalBlue attack to infiltrate unpatched Windows systems and quietly propagate across networks, even infecting Linux machines. The malware can gather sensitive data, capture screenshots, gain control over affected devices, and record microphone input. To avoid detection, StripedFly employs a unique method: it includes a cryptocurrency mining module to divert attention from its full capabilities. The identity of the malware’s creators remains unclear, but its use of the NSA-originated exploit highlights the ongoing risks associated with such leaked tools.

Critical vCenter Server vulnerability reported, VMware releases a fix

VMware released a fix for a critical vulnerability in its vCenter Server software on 25th of October 2023. The vulnerability could allow attackers to gain unauthorized access to vCenter Server and take control of virtual machines. The prominent virtualization and cloud technology provider, has rated the security vulnerability at 9.8 out of 10 because it enables remote code execution, which makes it a high-priority concern for users. The issue is associated with an out-of-bounds write vulnerability in the implementation of the DCE/RPC protocol used for network-distributed application communication. VMware has urged users to apply the available updates for affected products to address the vulnerabilities.

Boeing claimed by LockBit ransom gang

The LockBit ransomware gang has reportedly targeted The Boeing Company, a major global aerospace, commercial jetliner manufacturer, and U.S. military and defense contractor. This Russian-linked group announced its intrusion on Boeing via its dark leak site on 27th of October 2023, and claimed to have a substantial amount of sensitive data. The ransomware gang set a November 2nd deadline for Boeing to contact them, otherwise, they threatened to publish all available data. While the specific amount of exfiltrated data remains undisclosed, LockBit estimated the combined value of Boeing and its subsidiaries at $60 billion. They also stated that they breached Boeing using a zero-day exploit, though they provided no further details about the nature of this vulnerability.

In light of the cybersecurity news this month, it’s crucial for both individuals and organizations to prioritize security. To stay safe online, remember to use strong passwords and multi-factor authentication, exercise caution when handling email attachments and links, maintain updated software, and stay informed.

Summer’s almost over, but the cyber world is heating up! We’ve collected the biggest cyber news from August, so you can stay in the loop. Here’s a breakdown of what happened this month:

1. Discord.io Shuts Down After Huge Data Leak

On August 14, Discord.io experienced a massive data leak, exposing info like usernames, emails, and hashed passwords of 760,000 users. Luckily, payment details were safe. The breach’s magnitude forced Discord.io to halt its operations. If you got a premium membership after July 16, 2023, expect a refund. For now, their site simply reads, “We are stopping all operations for the foreseeable future.”

2. Duolingo’s User Data Surfaces on Dark Web

A shady figure posted data of 2.6 million Duolingo users on a dark web forum on August 22. They claimed to get this data from an application interface open since March 2023. The data mostly had names, usernames, and emails. Duolingo stressed that there wasn’t an actual breach and are investigating further.

3. Tesla’s Employee Data Leaked by Ex-Staff

Data from over 75,000 current and former Tesla workers was taken, including addresses, phone numbers, and emails. Two ex-employees appear to be behind this, having leaked it to the press. The exact location of this breach remains unknown. Tesla’s supporting the victims and working with law enforcement.

4. Global Strike Against Qakbot Malware

The Justice Department and international allies cracked down on the Qakbot botnet, a malware infecting 700,000+ computers. They seized $8.6 million in cryptocurrency profits from this operation. Through spam emails, Qakbot helped ransomware groups cause havoc worldwide. Efforts against it have now detached many victim computers from its grip.

5. 14 Cyber Criminals Caught in Africa

A major bust across Africa saw 14 cybercriminals arrested, linked to over $40 million in losses. The operation, named ‘Africa Cyber Surge II’, was spearheaded by INTERPOL and AFRIPOL, aiming to combat various cybercrimes. Successful collaboration led to multiple dark website takedowns and arrests related to art fraud and messaging scams.

6. Malware Disguised as IT Tools

There’s a sneaky new trend: hackers are using malware disguised as popular IT tools. They’re fooling victims through Google Ads and search results, often making it hard for security teams to spot. Monitoring source IPs helps them decide who sees their malicious content.

7. Over 600 Citrix Servers Under Threat

A severe vulnerability affected 600+ Citrix servers in early August, letting hackers install malicious software. These compromises can let criminals access systems whenever they want. Companies are urged to up their cyber defense, patch vulnerabilities, and monitor for unauthorized access.

8. Cloudflare R2 Misused by Cybercriminals

Since February, there’s been a shocking rise in phishing pages hosted via Cloudflare R2. While it’s designed to guard against major online threats, it’s being used to make attacks even more powerful. Most attacks aim for Microsoft logins, but some also target other major platforms. This underlines the need for continuous updates in online security.

Stay safe out there, and let’s see what the cyber world brings us next month!

Widespread Vulnerability Uncovered: GitHub Repositories Prone to RepoJacking Attack

A recent study unveiled a massive security threat lurking in the depths of GitHub repositories: RepoJacking. Millions of repositories, including those owned by industry leaders like Google and Lyft, are potentially at risk from this attack. RepoJacking, also known as dependency repository hijacking, empowers malicious actors to seize control of obsolete usernames or organization names, and subsequently deploy trojanized repositories brimming with malicious code.

RepoJacking essentially targets the weak link in the system: when a repository owner changes their username, it creates a gateway for malevolent actors to assume the old username and shatter the secure link. Another risk comes into play when the original account gets deleted following a change in repository ownership, opening another avenue for cyber attackers to take control using the former username.

This form of attack could have far-reaching implications, particularly affecting projects dependent on the compromised repository. Cyber adversaries could poison the entire software supply chain by introducing harmful content fetched from their controlled repositories. To protect from such hazards, Aqua recommends routine checks on code for any links connected to external GitHub repositories and maintaining control over old usernames.

NSA Advises Measures to Thwart BlackLotus Bootkit Threatening Windows Systems

The U.S. National Security Agency (NSA) has issued guidelines to help organizations combat the powerful Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus. This advanced crimeware, first identified by Kaspersky in October 2022, is capable of bypassing Windows Secure Boot protections. BlackLotus achieves this feat by exploiting a known Windows flaw, Baton Drop, found in susceptible boot loaders not included in the Secure Boot DBX revocation list.

BlackLotus, unlike firmware threats, focuses on the earliest software stage of the boot process for persistence and evasion, although there’s no evidence to suggest its targeting of Linux systems. Given its strategic positioning, BlackLotus enables threat actors to meddle with security mechanisms and launch additional payloads with heightened privileges.

The NSA suggests several mitigation measures, including updating recovery media, monitoring changes to the EFI boot partition, scrutinizing device integrity measurements and boot configuration, customizing UEFI Secure Boot to block outdated Windows boot loaders, and removing the Microsoft Windows Production CA 2011 certificate on devices that exclusively boot Linux. Microsoft is expected to fully close this attack vector by early 2024.

U.S. Cybersecurity Agency Lists Six Exploitable Flaws, Recommends Urgent Updates

In a critical update, the U.S. Cybersecurity and Infrastructure Security Agency has added six vulnerabilities to its Known Exploited Vulnerabilities catalog, urging immediate action. The list includes three Apple flaws (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439), two issues in VMware (CVE-2023-20867 and CVE-2023-20887), and a Zyxel device vulnerability (CVE-2023-27992), all of which have evidence of active exploitation. Particularly concerning are CVE-2023-32434 and CVE-2023-32435, both associated with Operation Triangulation, a long-term cyber espionage campaign starting in 2019.

The Federal Civilian Executive Branch (FCEB) agencies have been advised to promptly apply vendor-provided patches to secure their networks against potential threats. This announcement comes in conjunction with CISA’s alert about three vulnerabilities in the Berkeley Internet Name Domain (BIND) 9 Domain Name System (DNS) software suite that could lead to a denial-of-service condition.

‘nOAuth’ Flaw in Microsoft Azure AD Threatens Account Security

An alarming security flaw has been discovered in the Microsoft Azure Active Directory (AD) Open Authorization (OAuth) process. This vulnerability, dubbed ‘nOAuth’ by the discovering firm Descope, could have been leveraged to achieve a full account takeover. The misconfiguration flaw involves an attacker modifying email attributes under “Contact Information” in the Azure AD account. By exploiting the “Log in with Microsoft” feature, malevolent actors can gain control of a victim’s account.

The attack procedure is alarmingly straightforward: a malicious actor creates an Azure AD admin account, alters their email address to match that of a potential victim, and misuses the single sign-on feature on a susceptible app or website. Successful exploitation could give cybercriminals open access to set up persistence, steal data, and execute further post-exploitation activities.

Over 100,000 Stolen ChatGPT Account Credentials Up for Sale on Dark Web

Cybersecurity firm Group-IB revealed that from June 2022 to May 2023, more than 101,100 compromised OpenAI ChatGPT account credentials were found on unauthorized dark web marketplaces. Of these, India had the dubious honor of contributing the most stolen credentials. The surge in compromised ChatGPT accounts reached a peak in May 2023, with the Asia-Pacific region experiencing the highest concentration of stolen ChatGPT credentials over the year.

The report also highlighted the tools of choice for cybercriminals, with the notorious Raccoon info stealer accounting for the majority of the breaches, followed by Vidar and RedLine. Information stealers have become the darling of cybercriminals for their ability to lift passwords, cookies, credit cards, and other data from browsers and cryptocurrency wallet extensions.

The analysis from Group-IB’s Threat Intelligence report indicates that these findings stem from malware on individual devices and not a breach at OpenAI. As a protective measure, users are urged to adhere to good password hygiene practices and enable two-factor authentication (2FA) to prevent account takeover attacks.