System hacking

FBI warns of cyber threats to agriculture. “Low and slow” fraud. Israel to investigate

[ad_1]

Attacks, Threats, and Vulnerabilities

China accused of cyber attacks on Norwegian IT systems (ComputerWeekly.com) China-based cyber attackers have been blamed for multiple assaults on IT systems in Norway.

White House warns of ransomware attacks over Labor Day weekend (NY1) One official recommended some precautions Thursday.

White House double downs on warning about cyberattacks over the holidays (The Record by Recorded Future) White House deputy national security adviser Anne Neuberger on Thursday urged U.S. organizations to be on guard against malicious digital activity ahead of the Labor Day holiday.

Feds warn organizations not to take a cyber vacation after high-profile hacking on holidays (CBS News) In a joint advisory, the FBI and CISA said they “observed an increase in highly impactful ransomware attacks occurring on holidays and weekends — when offices are normally closed.”

Why Ransomware Hackers Love a Holiday Weekend (Wired) Looking forward to Labor Day? So are ruthless gangs of cybercriminals.

Juniper Breach Mystery Starts to Clear With New Details on Hackers and U.S. Role (Bloomberg) Tech company installed a flawed NSA algorithm that became ‘a perfect example of the danger of government backdoors.’

Recently Patched Confluence Vulnerability Exploited in the Wild (SecurityWeek) Hackers started exploiting a critical Confluence vulnerability just one week after Atlassian announced the availability of a patch.

Flaws in Moxa Railway Devices Could Allow Hackers to Cause Disruptions (SecurityWeek) Railway wireless communication devices made by Moxa are affected by 60 vulnerabilities, including ones that could allow hackers to cause disruptions.

Unpatched Exchange Servers an overlooked risk (ARN) Attackers are targeting older, unpatched Microsoft Exchange Servers with much success because organisations don’t properly assess the risk.

Hacked SolarWinds Software Lacked Basic Anti-Exploit Mitigation: Microsoft (SecurityWeek) Software vendor SolarWinds failed to enable ASLR, an anti-exploitation feature available since the launch of Windows Vista 15 years ago. The oversight that made it easy for attackers to launch targeted malware attacks in July this year.

Gift Card Gang Extracts Cash From 100k Inboxes Daily (KrebsOnSecurity) Some of the most successful and lucrative online scams employ a “low-and-slow” approach — avoiding detection or interference from researchers and law enforcement agencies by stealing small bits of cash from many people over an extended period. Here’s the story…

Threat Thursday: Who’s Afraid of Phobos Ransomware? (BlackBerry) Phobos ransomware is closely related to the CrySIS and Dharma malware families. The name ‘Phobos’ is likely inspired by the Greek god who was believed to be the personification of fear and panic.

US farm loses $9 million in the aftermath of a ransomware attack (The Record by Recorded Future) A US farm lost a whopping $9 million due to a temporary shutdown of its farming operations following a ransomware attack earlier this year; the FBI said this week.

Cyber Criminal Actors Targeting the Food and Agriculture Sector with Ransomware Attacks (FBI Cyber Division Private Industry Notification) Ransomware attacks targeting the Food and Agriculture sector disrupt operations, cause financial loss, and negatively impact the food supply chain.

Recruiting Firm Apparently Pays Ransom After Being Targeted by Hackers (SecurityWeek) Administrative staffing agency Career Group, Inc. this week started sending notification letters to customers who were affected by a data breach that occurred in late June.

Positive Technologies: 91% of Industrial Companies Open to Cyber-Attacks (Positive Technologies) Positive Technologies today released new research that examines information security risks present in industrial companies, the second-most targeted sector by cybercriminals in 2020. Among key findings, an external attacker can penetrate the corporate network at 91% of industrial organizations, and Positive Technologies penetration testers gained access to the industrial control system (ICS) networks at 75% of these companies.

Information security risks at industrial companies (Positive Technologies) Industrial companies attract criminals by their size, the importance of business processes, and their impact on the world and people’s lives.

Accellion-related breach disclosures continue to unfold (SearchSecurity) Beaumont Health is the latest to disclose a data breach related to last year’s attack on Accellion’s legacy software.

Ransomware Gangs: the Newest Form of International Cyber Criminals (KAKE) By Author: by Caitlyn-Rae Arendse, Security Television Network

Security Patches, Mitigations, and Software Updates

iOS 15 now prompts users if they want to enable Apple personalized ads, after it was previously on by default (9to5Mac) For iOS 15 users, Apple has begun prompting for their consent to enable Personalized Ads for their Apple ID, which allows Apple to use your App Store purchase history and several other demographics, to inform what advertising is displayed in the News and Stocks apps, as well as for targeting App Store Search Ads. Apple…

Advantech WebAccess (CISA) 1. EXECUTIVE SUMMARY

CVSS v3 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Advantech
Equipment: WebAccess
Vulnerability: Stack-based Buffer Overflow
2. RISK EVALUATION

Successful exploitation of this vulnerability may allow remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of WebAccess, an HMI platform, are affected:

JTEKT TOYOPUC Products (CISA) 1. EXECUTIVE SUMMARY

CVSS v3 4.3
ATTENTION: Exploitable remotely/low attack complexity
Vendor: JTEKT Corporation
Equipment: TOYOPUC products
Vulnerability: Allocation of Resources Without Limits or Throttling
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a remote attacker to deny Ethernet communications between affected devices without authorization.

Johnson Controls Sensormatic Electronics Illustra (CISA) 1. EXECUTIVE SUMMARY

CVSS v3 7.8
ATTENTION: Low attack complexity
Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc.
Equipment: Illustra
Vulnerability: Off-by-one Error
2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a local attacker to obtain super user access to the underlying Linux operating system.

Apple to Delay iPhone Update That Could Scan Device for Illegal Content (Wall Street Journal) The tech giant plans to make improvements to software that aimed to report collections of sexually exploitative images of children, amid a backlash from critics concerned about privacy erosion.

Indonesia at Highest Risk Level of Cyber Threat: TrendMicro  (Jakarta Globe) Around 81 percent of Indonesian companies anticipate the possibility of customer data leakage in the next year, the cyber security firm said

FBI: Americans lost more than $8 million to sextortion scams this year (<!–…

[ad_2]

Read More:FBI warns of cyber threats to agriculture. “Low and slow” fraud. Israel to investigate

Products You May Like