Home Blog Page 204

Over 100,000 Security Cameras in U.K. Are Hackable: Report

vulnerability in IoT devices

New research from consumer advocacy organization Which? revealed that more than 100,000 wireless security cameras installed in U.K. homes and businesses are vulnerable to cyber threats. Security cameras manufactured by HiChip that use software like CamHi app, Accfly, ieGeek, and SV3C might allow attackers to spy, steal personal data, or even change the camera’s password, according to Which?

“Many of these potentially vulnerable cameras are still on sale from online marketplaces such as Amazon, eBay and Wish.com, and more than 12,000 were activated in UK homes over the past three months alone,” Which? said in a security alert.

According to Which? investigation with Paul Marrapese, a U.S.-based security researcher, more than 3.5 million security cameras worldwide are still vulnerable to cyber risks. It is found that a majority of these cameras are located in Asia, and over 700,000 cameras are active across Europe, including more than 100,000 in the U.K.

Security Issues with Unsecure Cameras

Security flaws that exist in the design of the cameras’ software allow an attacker to:

  • Access the video stream of the camera to spy on homes
  • Talk to people in homes if the camera has a microphone
  • Steal or change passwords
  • Find the exact location of a home
  • Target other devices connected to a home network
  • Add one’s camera to an online botnet

The Experiment

Which? stated that they made an experiment on five wireless security cameras namely – Accfly, Genbolt, Elite Security, SV3C, and ieGeek. The researchers claimed that they were able to compromise the devices remotely. It is estimated that around 47 camera brands globally could potentially have this security flaw, including 32 brands sold in the U.K.

According to Which?, the camera brands with potential vulnerabilities include Dericam, Alptop, Luowice, Besdersec, CPVAN, Ctronics, COOAU, Jennov, LEFTEK, QZT, and Tenvis. Which? also claimed that any wireless camera that uses the CamHi app could be compromised. It also advised users with a camera working on the CamHi app to remove from their network.

 How to Protect your Security Cameras

Which? also suggested some protective measures to safeguard security cameras against potential risk. These include:

  • Change passwords. Many wireless cameras have weak default passwords, such as “admin.” Set a secure password connecting three random words that you’ll be able to remember
  • Keep your camera software updated. Not only does this keep your devices secure, but it often adds new features and other improvements
  • If in doubt, disconnect it. If you don’t use the feature that lets you remotely access the camera from your phone or tablet, it’s recommended that you disable it.

3 Critical Cybersecurity Gaps Enterprises Face with Collaboration Apps and How to Close Them

Zoom, video conferencing, webinar, zoom two-factor authentication, top data breaches of 2020

With millions of Americans and their employers adapting to government-mandated stay at home orders and social distancing advisories, it’s no surprise that we’ve seen a huge surge in the popularity of collaboration tools that allow businesses and consumers to stay connected with the outside world. Apps like Zoom, Slack, Microsoft Teams and WebEx have seen their user numbers skyrocket since businesses started to enforce work-from-home decrees to flatten the curve. In fact, Zoom added more active users (2.2M) in January and February alone than it did in the entirety of 2019. However, this rapid ascension has also spotlighted severe security vulnerabilities that adversaries have started to pick up on.

By Andrew Homer, VP of Security Strategy at Morphisec

Why? Most adversaries operate on a business model that will be familiar to those in the corporate world; they spend their time building exploits for tools that are widely used to maximize their return on investment and thus their profits. Now that collaboration tools like Zoom, Slack and WebEx are increasing in popularity, threat actors have started to focus on them. This is particularly concerning because collaboration app software providers often are not organized around quickly patching zero-days and hardening their software, largely because they have not needed to be before now. And it shows.

No less than Google, SpaceX, and even NASA, recently banned their remote employees from using Zoom. Shifts from such prominent organizations have shined a spotlight on the widely popular video conferencing tool’s security flaws. While “ZoomBombing” trolls can certainly be embarrassing, those are more pranksters than serious threat actors. What those news stories do, however, is highlight Zoom’s vulnerabilities in the face of sophisticated ransomware, zero-day attacks, and malware targeting their current weaknesses.

Just a couple of weeks ago, Morphisec Labs researchers presented a discovery that the Zoom app itself can be used as a delivery tool for recording and stealing information. A sophisticated attack using a trusted collaboration application like Zoom is particularly alarming because it is trusted, signed, and perhaps even whitelisted in some cases. As a result, an attack via Zoom likely will not flag any alarms on detection logic that might be thrown with other recording software. Traditional antivirus software would have no remedy for defending against this type of breach.  This is just one example. Another is that Zoom is vulnerable to a classic Windows  ‘UNC path injection’ revealed by a former NSA hacker, which was exploited to allow remote attackers to steal victims’ Windows login credentials or take control of the computer to run commands.

Three Critical Cybersecurity Gaps

Although Zoom is the video conferencing app most often in the news right now, its security weaknesses are not unique amongst collaboration apps. If anything, the only reason Zoom is in the news for exploits is because of its exponential user growth; threat actors see the higher user counts and likely decided to focus on building exploits to cash in. With that in mind, let’s go through what three of the biggest cybersecurity gaps are right now with collaboration tools like Zoom.

1. Collaboration Apps Cannot Patch Vulnerabilities Fast Enough

For the past 20 years, Microsoft Word and Adobe Flash have been two of the most targeted applications for cybercriminals. The reason is that these two pieces of software are ubiquitous, which appeal to financially-motivated cybercriminals looking to get the best ROI for their efforts. As a result, Microsoft and Adobe both have armies of security experts on staff to plug vulnerabilities as they appear.

With spending on collaboration applications predicted to exceed $48 billion by 2024, it’s no wonder that cybercriminals see dollar signs in this segment. Unfortunately, collaboration apps are not structured to quickly patch security flaws. The reason is simple: they haven’t been targets until now because their user numbers weren’t high enough to attract threat actors. The other problem facing collaboration app vendors is that there is a severe shortage of security experts worldwide and there are not enough tools to quickly and efficiently find flaws in these tools.

Exploiting collaboration apps can lead to remote code execution, which allows the adversary to run their malicious code on the infected machine. For example, Slack recently experienced an exploit that allowed the adversary to completely exfiltrate messages, contact lists, and every other form of data tied to the messaging application. Zoom has also recently reported several zero-day attacks, including the UNC path exploit and one that enabled attackers to install malware on targeted machines.

With unknown zero-days making up 80% of successful attacks, these widely used tools and their users are relegated to a helpless position.

2. Higher Risk of Browser-Based Attacks

Coupled with risky patching processes is a much higher risk of browser-based attacks, especially for applications like WebEx, Go to Meeting and Zoom that are accessible via a browser. This vulnerability exists because video conferencing and collaboration tools require their own code to be loaded into the browser to support their functionality. As a result, the risk of attack remains high since these vendors do not yet heavily invest in secure coding. This can lead to an attacker abusing the loaded code to eventually remotely execute code on behalf of the browser.

While sandboxing within some browsers may make this method better than relying on the applications, a recent report from Positive Technologies found that in nine times out of 10, hackers are able to easily attack website visitors and a whopping 82% of web application vulnerabilities lie in the web application’s source code.

This high risk of vulnerability via the web browser should give any IT security professional pause. Browser attacks such as drive-by downloads and browser-based phishing are at high risk with collaboration apps. This is especially true today given how exposed many of these applications are to threat actors and the rise in WFH employees.

3. Increased Risk of Successful Social Engineering Attacks

Phishing emails are the most used malware delivery mechanism today. In fact, internal data from Morphisec illustrates phishing campaigns are skyrocketing as malicious parties look to take advantage of a captive audience of work-from-home employees. Between March 8 and April 12, Morphisec saw phishing and adware attacks soar from just 2,000 dt per week to more than 90,000 dt per week.

Collaboration apps, in particular messaging tools like Slack and Microsoft Teams, provide new avenues for these bad actors to deliver phishing attacks and act upon them, while video conferencing apps especially run the risk of being used for social engineering. A successful attack in this context could result in credential-stealing on a remote employee’s machine and, if the user is an admin, the attacker could further their goals in a more streamlined manner.

Of course, adding fuel to the fire is the almost 2,000 domains containing the word ‘Zoom’ that have been created so far this year — even though Zoom isn’t the only target. Enterprises need to be wary of a magnitude of new phishing websites that have been developed to exploit vulnerable WFH employees and even parents homeschooling their children.

Attackers can use phishing tactics on remote employees to have them install a remote desktop tool, which can then be leveraged to deliver a payload. Just a few short months ago, it was discovered that ConnectWise Control was being abused to deliver the Zeppelin ransomware. So as business operations become virtual, safe browsing behavior becomes more important than ever.

How to Close Collaboration Apps’ Gaps and Counter Higher Security Risk

The world is in the middle of the greatest work-from-home experiment of all time as a result of COVID-19, and collaboration applications will only grow in importance as many enterprises recognize the financial benefits of remote working. This presages a corresponding increase in security risk, which CISOs and other security executives need to account for. To close the security gaps in collaboration apps, companies should:

  • Implement basic security hygiene measures such as two-factor authentication for password protection where possible. Also, make sure to standardize on a single video collaboration tool and set it as a hard-line policy among employees. This will help prioritize patching efforts, as well as how to plan for upgrading legacy systems and applications. This is often only a minor inconvenience for employees and goes a long way to prevent breaches.
  • Deploy more proactive defense mechanisms that can protect against malicious use of collaboration applications, unlike traditional antivirus protection. Moving target defense is one example of this type of solution, which morphs application memory and protects collaboration apps from cyberattacks by changing the structure of the application on the endpoint. This changes the targeted application from a known to an unknown, complicating the job of the hacker as suddenly they are unable to identify the target application. This also instantly protects collaboration apps against the in-memory exploits, new zero-days, fileless attacks and evasive malware that we expect to proliferate in the coming month.
  • Harden endpoints in a deterministic and automatic way to ensure full business continuity against an attack. This is a core feature of moving target defense, enabling security teams to protect applications without human intervention. This makes it easier for remote workers to access the collaboration tools they need when they need them.

Protecting Enterprises from the New Zero-Day Frontier

Despite their importance for enterprises, the reality is that collaboration applications are often unequipped for prime time. Slack, Zoom, Microsoft Teams, WebEx, Go to Meeting, and other tools all have their security flaws and will continue to be exploited now and in the future.

Compared to most other enterprise applications, they simply lack robust security posturing, making them particularly vulnerable to zero-day attacks and evasive malware. But they need to be protected more effectively against the worst cyberattacks. And this is what moving target defense excels at, including automatic hardening of remote endpoints that enable work from home employees to access the collaboration apps they need to be productive.

Moving target defense looks tailor-made for this moment, but the protection it provides only lasts as long as the collaboration apps remain in the company toolkit. Far from being an asset just to survive through COVID-19, MTD is — and should be — the centerpiece of an effective, enduring endpoint security strategy.

About the Author

Andrew Homer is VP of Security Strategy at Morphisec and has numerous years of hands-on experience creating strategic technology partnerships and leading teams through growth phases. Prior to Morphisec, he was Director of Business Development and Technology Alliances at RSA, where he led the company’s technology ecosystem, strategic alliances and embedded OEM partnerships. Homer has also held business development positions at Dell, EMC and VMware.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

 

 

Cybercriminals Attacked Unsecured Databases 18 Times Per Day

cyberattacks on U.S. and U.K., Barnes & Noble cyberattack, zero trust

Every minute is an opportunity for threat actors when they found a server left online unsecured. A latest security experiment by Comparitech led by cybersecurity researcher Bob Diachenko discovered that cybercriminals attacked a model of an unsecured database 18 times in a single day.

In a security alert, Comparitech explained how unauthorized third parties find, gain access, and alter exposed data without any authentication process, leaving users’ privacy at risk.

The company set up a honeypot to know how quickly the hackers would attack an Elasticsearch server with a dummy database and fake data in it. Comparitech left the exposed data from May 11 until May 22, 2020. It found 175 attacks in just eight hours after the server deployed, with the number of attacks in one day totaled to 22.

“The first attack came on May 12, just 8 hours and 35 minutes after deployment. Our honeypot averaged 18 attacks per day,” Comparitech said in a statement.

Image Courtesy: Comparitech

Comparitech also pointed out that hackers used IoT search engines like Shodan.io or BinaryEdge To find vulnerable servers online. “Within just one minute of being indexed by Shodan, two attacks took place. It’s worth noting that over three dozen attacks occurred before the database was even indexed by search engines, demonstrating how many attackers rely on their own proactive scanning tools rather than waiting on passive IoT search engines like Shodan to crawl vulnerable databases,” the statement added.

Attackers Location

The researchers found attackers’ locations based on their IP addresses. The highest numbers of attacks originated from:

  • 89 attacks came from the U.S.
  • 38 attacks came from Romania
  • 15 attacks came from China

Attack Methods Used

Researchers found that most requests were aimed at getting information about the status of the database and its settings. These include:

  • 147 attacks used the GET request method
  • 24 attacks used the POST method, which was particularly popular for attacks originating in China
  • One attack used the PUT method with the intent to change the server configuration
  • One attack used the OPTIONS method to get information about the connection
  • One attack used the HEAD method to get the headers of requests without receiving the responses

All attackers were not looking to steal data. Some targeted servers to mine cryptocurrency, steal passwords, and destroy data, Comparitech stated.

 

Flaw in Facebook Messenger App Allows Attackers to Run Persistent Malware

Security researchers from Reason Labs disclosed a critical vulnerability in the Facebook Messenger application for Windows that could allow attackers to hijack a call within the Messenger code to inject malware. The researchers also stated that it is a persistent threat that provides hackers undetected access to the application. The flaw was discovered in Facebook Messenger version 460.16, however, it is now fixed by the social media giant with the updated version 480.5 after Reason Labs reported the issue.

According to Reason Labs, the flaw initiates a call to load Windows Powershell from the C:\python27 path, which is generated while downloading version 2.7 of Python, and does not exist in most of the Windows installations. Cybercriminals can hijack these calls to stealthily execute malware without administrator knowledge.

GIF Courtesy: Reason Labs

In order to test the bug, Reason Labs researchers created a reverse shell  with msfvenom and a listener with Metasploit.  The reverse shell was then renamed Powershell.exe and was installed into the Python directory (c:\python27). The researchers found that the vulnerable app triggered the call and executed the reverse shell, proving that potential attackers can abuse the flaw for persistent malware attacks.

GIF Courtesy: Reason Labs

It is better to be vigilant about the potential vulnerabilities in online applications for messaging and videoconferencing, and other remote working tools, as we are spending more time online since the beginning of the pandemic. Even Facebook reported a 70% rise in time spent on its apps since the outbreak and a 50% increase in messaging apps.

 

COVID-19 Cyberthreats Spike in India, Brazil, and the U.K.: Google

COVID-19 Cyberthreats Spike in India, Brazil, and the U.K.: Google

Google has warned about the emerging COVID-19 cyberthreats in India, Brazil, and the U.K. The search engine giant stated that attackers are using malware and phishing emails that imitate legitimate financial incentives to entice users to respond.

Neil Kumaran, Gmail Security Product Manager, and Sam Lugani, Lead Security PMM for G Suite and GCP, said that they have seen an increased number of email attacks, most of them COVID-19 related scams, in the targeted countries. They also mentioned that earlier Gmail blocked 18 million malware and phishing emails, and more than 240 million spam emails daily during the pandemic.

“Specifically, we’ve been seeing COVID-19-related malware, phishing, and spam emails rising in India, Brazil, and the UK. These attacks and scams use regionally relevant lures, financial incentives, and fear to create urgency and entice users to respond,” the team said in a statement.

India

In India, Google noticed potential victims being targeted with the malicious emails that appear to come from health service providers and COVID-19 tracking apps like the Aarogya Setu app. Aarogya Setu is a smartphone application developed by the Indian government to help people assess themselves on the risk of infecting with Coronavirus.

Image Courtesy: Google

“As India is opening back up and employees are getting back to their workplaces, we’re starting to see more attacks masquerading as COVID-19 symptom tracking. And with more and more people looking to buy health insurance in India, phishing scams targeting insurance companies have become more prevalent. Often these scams rely on quoting established institutions, and getting viewers to click on malicious links,” Google said.

Brazil

In Brazil, Google warned about the surge in phishing attacks targeting streaming services due to their rising popularity, claiming the recipient will be fined if they do not respond.

Image Courtesy: Google

The U.K.

In the U.K., hackers are impersonating government organizations to steal confidential and personal information.

Image Courtesy: Google

The threat actors are designing schemes and campaigns referring to the government’s Small Business Grant Fund, in turn luring citizens into downloading malicious files.

Preventive Measures

Google also listed certain safety recommendations for users to prevent such email attacks. These include:

  • Avoid downloading files that you do not recognize; instead, use Gmail’s built-in document preview
  • Check the integrity of URLs before providing login credentials or clicking a link—fake URLs generally imitate real ones and include additional words or domains
  • Report phishing emails
  • Turn on two-step verification to help prevent account takeovers, even in cases where someone obtains your password
  • Consider enrolling in Google’s Advanced Protection Program (APP)—we’ve yet to see anyone in the program be successfully phished, even if they are repeatedly targeted
  • Be thoughtful about sharing personal information such as passwords, bank account or credit card numbers, and even your birthday

Along with social distancing guidelines, it is advisable to follow cyber precautions for seamless functioning of businesses operations.

 

 

Fake ‘Black Lives Matter’ Campaign Spreads Trickbot Malware

cyber insurance, Axio for SolarWinds Impact

Cybersecurity experts have found a fake Black Lives Matter voting campaign leveraging the popularity and sentiments of people in the ongoing protests against racism to spread Trickbot, an information-stealing malware. The phishing campaign is being touted to be run more efficiently as the fake email claims complete anonymity of the voters registered in luring potential victims.

Leveraging ‘Black Lives Matter’ Campaign

Leveraging the popularity of ongoing movements, celebrities, and the latest buzz topics, and luring potential victims into opening phishing emails is a popular trait of cybercriminals. This has been evident from earlier instances, for example, when the Emotet malware operators used environmental activist Greta Thunberg’s popularity to infect computers in Europe and Asia. The phishing emails back then looked like any other invite from Greta for a climate change summit or demonstration with email subjects carrying enticing text like “Demonstration 2019” or “I invite you.”

Similarly, pretending to be an email from the “Country administration,” the ongoing phishing campaign also targets potential victims by using subject lines such as, “Vote anonymously about Black Lives Matter.” Like other phishing campaigns, this email also contains a malicious word file as an attachment. When a user clicks on the “Enable Content” option while opening the Word file, the macros start running and downloads the Trickbot malware. When executed, this malware can further drop other payloads to carry out malicious activities.

What Trickbot Steals?

Historically, Trickbot malware is a banking Trojan. However, with time it has evolved in nature. Some of its top traits are:

  • Lateral movement in the network for maximum damage
  • Exfiltrating user credentials from browsers
  • Exfiltrating Active Directory Services databases
  • Stealing cookies and OpenSSH keys
  • Theft of RDP, VNC, and PuTTY Credentials
  • Installing additional payloads (e.g. ransomware)

 

COVID-19 Drives 79.39% Towards SaaS: CISO MAG Market Trends Report

SaaS

As the lockdown was imposed on many countries in late March 2020, most companies were forced to resort to a distributed work environment. This also boosted cloud adoption, and the demand for the SaaS model soared. This (and other cloud adoption trends) are strongly reflected in CISO MAG’s Cloud Security survey. The complete research report on Cloud Security trends is published in the June issue of CISO MAG here: https://staging-cisomag.com/magazine/

“Decision-makers in businesses of all sizes, and across geographies confirmed that cloud security is top of mind for executives as cloud adoption accelerates. These concerns are warranted, migrating to the cloud involves several risks identified in this detailed and informative survey. However, these security risks and concerns may be a result of a lack of clarity or understanding of the shared responsibility model related to security. As well as, a misconception about the potential security services available to organizations as they migrate to the cloud,” said AJ Yawn, a cloud security expert who is also on the Board of ISC2.

Key findings

  • A multi-cloud strategy is here to stay. This is reflected in our data with 19.39% having 6 or more cloud vendors.
  • Half the respondents (49.7%) opt for hybrid cloud environments and are not ready to commit fully to public or private clouds. This is due to rigid compliance and regulatory norms.
  • In the wake of COVID-19 and a distributed work environment, more organizations (39%) are opting for SaaS based delivery models, moving away from on-premise solutions.
  • Half the respondents (52.12%) said they are not confident about the public cloud because of issues like confidentiality and privacy of data.
  • There is a lack of understanding about who is responsible for security in the cloud – the customer or the cloud service provider. 76.36% said it is the responsibility of the cloud service provider.
  • 39% said they were concerned about data ownership when choosing a cloud service provider.
  • A skills gap in the security team is a major security challenge for 45.45% of respondents.
  • 88% said it is crucial to perform a proper and comprehensive risk assessment as part of the Cloud Computing project.
  • Two-thirds (66.67%) said security, privacy, and compliance should be integrated into the Cloud Computing team from the initiation of the project.

“This survey highlights the need for companies to continue to study and refine their cloud infrastructure needs and their risk appetite surrounding these services. Our results show that security is often a critical decision point, and in many cases, may be the deciding factor to move or not move a service to the cloud,” said Dick Wilkinson, Chief Technology Officer, New Mexico Judicial Information Division.

CISO MAG conducts a Cloud Security survey annually, and the last such survey (and research report) was published in July 2019.

The next CISO MAG Market Trends Report is on Data Security, and it will be published in the September issue of CISO MAG. For participation in this issue write to [email protected] or [email protected]

FBI Warns About Fake Mobile Banking Apps, Trojans

The FBI recently issued a warning about threat actors targeting users with fake banking apps to compromise bank accounts, as more people are using online banking during the coronavirus pandemic.

In an official statement, the FBI stated that online and mobile banking apps witnessed a 50% surge in usage since the beginning of 2020. Citing the U.S. financial data study, FBI stated that 36% of Americans plan to use mobile applications for various banking activities, and 20% of them plan to visit branch locations less often. “With city, state, and local governments urging or mandating social distancing, Americans have become more willing to use mobile banking as an alternative to physically visiting branch locations,” FBI said.

Fake Banking Apps and Trojans

It is expected that cybercriminals try to abuse new mobile banking customers through app-based banking trojans and fake banking apps. The FBI advised the public to be cautious while downloading banking apps, as hackers spread fake apps concealing malicious intent in them. This incident reminds us about the detection of 65,000 fake apps on major app stores in 2018, by U.S. research organizations.

“Cyber actors target banking information using banking trojans, which are malicious programs that disguise themselves as other apps, such as games or tools. When the user launches a legitimate banking app, it triggers the previously downloaded Trojan that has been lying dormant on their device. The Trojan creates a false version of the bank’s login page and overlays it on top of the legitimate app. Once the user enters their credentials into the false login page, the Trojan passes the user to the real banking app login page so they do not realize they have been compromised,” the FBI said in a statement.

Preventive Measures

The FBI recommended certain security measures to defend against banking Trojan attacks, these include:

  • Enable two-factor or multi-factor authentication on devices and accounts to protect them from malicious compromise
  • Use strong two-factor authentication if possible, via biometrics, hardware tokens, or authentication apps
  • Use multiple types of authentication for accounts if possible. Layering different authentication standards is a stronger security option
  • Monitor where your Personal Identifiable Information (PII) is stored and only share the most necessary information with financial institutions
  • Use passwords that contain upper case letters, lower case letters, and symbols.
  • Use a minimum of eight characters per password
  • Create unique passwords for banking apps
  • Use a password manager or password management service

 

June 2020 Patch Tuesday: Microsoft Fixes 129 CVEs

Microsoft September 2021 Patch Tuesday

Microsoft released its June 2020 Patch Tuesday software security update to fix a total of 129 newly discovered CVEs (Common Vulnerabilities and Exposures) affecting various versions of Windows operating systems and related software products.

The security patches apply to various Microsoft products including Microsoft Windows, Microsoft Edge, ChakraCore, Internet Explorer, Microsoft Office, Microsoft Office Services and Web Apps, Windows Defender, Microsoft Dynamics, Visual Studio, Azure DevOps, Adobe Flash Player, and Microsoft Apps for Android, according to Microsoft’s advisory.

The “June 2020 Patch Tuesday” is  Microsoft’s biggest patch Tuesday security update ever. It released  115 patches in March 2020, and 113 fixes in April 2020. Of 129 vulnerabilities, the tech giant classified 11 as critical, 109 as important, 7 as moderate, and 2 as low in risk severity.

Critical Vulnerabilities

Microsoft stated that three critical vulnerabilities exist in Microsoft Edge and VBScript engine that could allow hackers to perform remote code execution by tricking a user into visiting a maliciously crafted web site. These vulnerabilities include:

Other critical vulnerabilities would require an attacker to trick users into downloading specially designed malicious files. If abused, these vulnerabilities could allow an attacker to execute commands on the targeted device with the same privileges as the user. These include:

Satnam Narang, Staff Research Engineer at Tenable said, “Microsoft continues its streak of releasing patches for over 100 CVEs, as June 2020s Patch Tuesday release contains fixes for 129 CVEs, 11 of which are rated as critical. For the second month in a row, none of the vulnerabilities patched this month were exploited in the wild nor publicly disclosed. Most notably in this month’s release are a trio of fixes for vulnerabilities in Microsoft Server Message Block (SMB), two of which reside in SMB version 3.1.1 (SMBv3),”

Microsoft urged system administrators and users to install these updates as soon as possible to protect their devices from privilege escalation and spoofing attacks. “These updates are intended to help our customers keep their computers up-to-date. We recommend that you install all updates that apply to you,” Microsoft said.

 

Cyber 9-Line: The 911 for Reporting Malware Threats

National security Agency

The U.S. Cyber Command (USCYBERCOM) in collaboration with the country’s National Guard has launched a malware sharing portal, “Cyber 9-Line.” This portal is created with the intent of sharing common knowledge related to cyberthreats and attacks carried out by foreign adversaries and securing the country’s cyberspace.

How Cyber 9-Line Works

The Cyber 9-Line helps the National Guard units and USCYBERCOM to stay in sync by rendering quick communication of a cyber incident on a two-way channel. These reports are then shared with the Cyber National Mission Force (CNMF), who further diagnose the cyberattack to determine the motive and source of the adversary. Eventually, the feedback from the investigation is shared with the two agencies as well as with the state and county governments to address and restrict the cyber incident. This process is key in decreasing the latency of incident response and strengthening the cybersecurity across various verticals in the government and nation.

Cyber 9-Line, however, is not just limited to acting as a communication channel. The reporting and feedback from this system is added to the unclassified cyber Big Data Platform (BDP). This increases the critical defense capabilities and provides matching and analysis of previously known malware records to further reduce latency and deploy proactive cybersecurity measures in a shorter span.

What NSA Says…

According to the National Security Agency (NSA),  most states and territories have scheduled the Cyber 9-Line training and/or are establishing their accounts. However, 12 states have already completed the registration process and begun leveraging the resources on offer. NSA also accepted that their foremost priority at this moment is securing the 2020 Presidential elections.

U.S. Army Brig. Gen. William Hartman, who also leads the USCYBERCOM’s Election Security Group and is a CNMF Commander said, “This level of cooperation and feedback provides local, state and Department of Defense partners with a holistic view of threats occurring in the United States and abroad. Dealing with a significant cyber incident requires a whole-of-government defense; bidirectional lines of communication and data sharing.”

Thus, this is a foot in the right direction for improving cybersecurity measures in the country.

 

1...203204205...410Page 204 of 410