👉 What’s happening in cybersecurity today?
Apple, Bluetooth Keyboard, Phemedrone Stealer, Windows Defender, Android Malware, Chinese, Financial Fraud, GitLab, Password Reset, Juniper, Networking Gear, Raptor Technologies, British Cosmetics Retailer, Lush, Law Firm, Burr & Forman, Singing River Healthcare, Ransomware, Patient Data, Lithuania, NoName, AI-Driven Misinformation, Elections, US Homeland Security, Water Sector, Pakistan Police, Cybercrime Investigation Unit, Ukrainian, Cryptojacking, API Security.
🚨 Cyber Alerts
Apple releases Magic Keyboard Firmware Update 2.0.6 to address a Bluetooth keyboard injection flaw (CVE-2024-0230), allowing attackers with physical access to extract the pairing key and spy on Bluetooth traffic. Discovered by Marc Newlin of SkySafe, the vulnerability could enable attackers to inject keystrokes and perform actions like installing apps and executing arbitrary commands. The update applies to various Magic Keyboard models, addressing a session management issue and enhancing security checks.
Phemedrone Stealer, an active malware strain, is exploiting CVE-2023-36025, a Windows Defender SmartScreen vulnerability. This malware, written in C#, targets web browsers, cryptocurrency wallets, and messaging apps. Despite a patch, threat actors use the exploit to bypass Windows Defender SmartScreen, emphasizing the need for organizations to update and protect against evolving malware threats.
A new Android malware, masquerading as a security app, impersonates law enforcement, alleging the victim’s involvement in financial fraud. The attackers manipulate victims into downloading a malicious app, guiding them to input sensitive information. The malware, blocking incoming calls and messages, allows fraudsters to conduct financial fraud, emphasizing the need for caution in downloading apps from untrusted sources.
GitLab has fixed a critical vulnerability (CVE-2023-7028) that allowed attackers to hijack password reset emails, potentially leading to account takeovers. The flaw affected GitLab versions 16.1 to 16.7.1, impacting user accounts that allowed logins with usernames and passwords, including those with single sign-on (SSO) options. Users are advised to update their GitLab instances to patched versions and enable two-factor authentication (2FA) for added security.
Juniper Networks has addressed a critical remote code execution (RCE) vulnerability in its SRX Series firewalls and EX Series switches, rated 9.8 on the CVSS scoring system. The flaw, tracked as CVE-2024-21591, allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS) or Remote Code Execution (RCE) and obtain root privileges on the device. Juniper Networks recommends disabling J-Web or restricting access to trusted hosts as temporary workarounds until the fixes are deployed.
💥 Cyber Incidents
Cybersecurity researcher Jeremiah Fowler discovered a non-password protected database containing an estimated 4 million records, including sensitive school safety data and personally identifiable information (PII) of students, parents, and school staff. The exposed database belonged to Raptor Technologies, a Texas-based school security company. The records included school incident response plans, background check system details, information on at-risk students, court-ordered protection orders, and documents related to safety protocols. Fowler responsibly disclosed the issue to Raptor Technologies, which took action to secure the exposed database, restricting public access the following day.
Lush, the British cosmetics retailer, is dealing with a cybersecurity incident that prompted an investigation by external IT forensic specialists. While the nature of the incident remains undisclosed, the company is taking immediate measures to secure and screen all systems, aiming to contain and minimize the impact. The National Cyber Security Center has certified several firms for cyber incident response, and Lush has informed relevant authorities, emphasizing its commitment to taking cybersecurity seriously.
Burr & Forman LLP, a law firm based in Alabama, reported a recent data security incident impacting some clients’ information. The breach, identified on a laptop in October 2023, involved unauthorized access to documents containing personal information, including names, Social Security numbers, medical coding details, and insurance information. The law firm, taking the matter seriously, has enhanced network security, engaged in an investigation, and notified affected individuals, while cooperating with Oceans Healthcare, whose systems were unaffected by the incident.
A recent ransomware attack on Mississippi-based healthcare provider Singing River has exposed sensitive patient data, impacting over 250,000 individuals. The breach, orchestrated by the Rhysida ransomware gang, forced several hospitals offline, leading to disruptions in patient care. Singing River is offering credit monitoring and identity restoration services to affected individuals, while experts warn of potential misuse of healthcare data for identity theft, fraud, and other malicious activities on the dark web.
Several prominent organizations in Lithuania, including Compensa Vienna Insurance Group, If Insurance, Lithuanian Roads Association, AD REM, INIT, and Balticum, have allegedly fallen victim to the NoName attack. The threat actors, identified as the NoName ransomware group, have been actively sharing posts detailing the impact of the cyberattack on Lithuania websites. In a disturbing twist, the threat actor responsible for the cyberattack on Lithuania’s websites posted claims of sending “DDoS missiles to sites” and condemned Lithuanian Ambassador Valdemaras Sarapinas for supporting Ukraine in the ongoing Russia-Ukraine conflict.
📢 Cyber News
11. AI Misinformation Impact on Global Elections
AI-driven misinformation emerges as a top risk in the World Economic Forum’s 2024 Global Risks Report, with potential to impact elections worldwide. The report warns of AI’s role in spreading false information, leading to societal unrest, violent protests, and challenges to newly elected governments. As elections unfold in major economies, including the United States, the United Kingdom, the European Union, and India, the consequences of AI-generated disinformation may have far-reaching implications. The rise of generative AI tools is exacerbating the challenge, enabling the spread of propaganda and false narratives at an alarming rate.
A federal watchdog calls for better coordination between government agencies, highlighting issues in cybersecurity efforts for the water and wastewater sector. The report faults the Cybersecurity and Infrastructure Security Agency (CISA) for inadequate collaboration with the Environmental Protection Agency (EPA). With concerns over aging IT infrastructure and cybersecurity readiness in the water sector, the watchdog recommends the development of a memorandum of understanding between CISA and EPA to establish clear roles and collaboration mechanisms. The report also emphasizes the need for improved communication with the water sector coordinating council to address sector-specific concerns effectively.
Islamabad Police enhance capabilities with a newly established Cybercrime Investigation Unit, empowered by recent amendments to the Prevention of Electronic Crimes Act. In collaboration with the Federal Investigation Agency (FIA), the initiative aims to address evolving digital threats through specialized training and expertise. The establishment of the Cybercrime Investigation Centre at the F-6 Service Centre further fortifies Islamabad’s capabilities in combating cyber threats, fostering community involvement in the fight against digital offenses.
A 29-year-old Ukrainian national has been arrested for orchestrating a sophisticated cryptojacking scheme, amassing over $2 million in illicit profits. The alleged mastermind was apprehended in Mykolaiv, Ukraine, on January 9 by the National Police of Ukraine, supported by Europol and an unnamed cloud service provider after months of collaboration. The suspect is accused of infecting servers of a well-known American company with a virus since 2021, compromising 1,500 accounts and creating over one million virtual computers to sustain the malware operation. Cryptojacking involves unauthorized use of computing resources to mine cryptocurrencies, and the arrest followed a cloud provider’s tip to Europol about compromised accounts.
APIs, crucial for the functioning of today’s websites and apps, are becoming prime targets for cyber threats, warns Cloudflare. Businesses leverage APIs extensively to enhance their digital offerings, but if not managed or secured properly, APIs can be exploited by threat actors to access sensitive information. With APIs dominating global internet traffic, especially in Africa and Asia, the rise in popularity has led to increased attack volume, with HTTP Anomaly, Injection attacks, and file inclusion being the top three attack types. Organizations struggle to protect what they cannot see, emphasizing the need for improved API security measures.
Copyright © 2024 CyberMaterial. All Rights Reserved.
