Vulnerabilities
FireFox 89 – vulnerabilities and bugs fixed
Cisco – multiple product vulnerabilities tied to Lasso SAML Implementation
Cisco – Webex, SD-WAN, and ASR 5000
Cybersecurity News
- Weekends and holidays are often the target timeframe for cybercriminals to launch their attacks because they know their activities may go undetected or security teams may not be able to act quickly enough. A case in point is the cyberattack on JBS Foods which shut down their global operations over the holiday weekend. https://www.bleepingcomputer.com/news/security/food-giant-jbs-foods-shuts-down-production-after-cyberattack/
-
SolarWinds attackers, Nobelium, are conducting an ongoing phishing campaign after gaining access to US Agency for International Development’s (USAID) Constant Contact account. The phishing attack has so far targeted some 3,000 accounts at more than 150 organizations across several industry verticals mostly in the US. If successfully deployed, these payloads let attackers remain persistent on compromised systems so they can move laterally, steal data, deploy additional malware, and infect other machines on the network. https://www.darkreading.com/attacks-breaches/solarwinds-attackers-impersonate-usaid-in-advanced-email-campaign/d/d-id/1341163?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple
- Amazon recently announced an experiment called Sidewalk that allows internet bandwidth sharing with other nearby internet users. The bandwidth sharing experiment impacts devices like Alexa, Echo, Ring, and other internet-connected devices. At this time, we are recommending you opt-out of this experiment. https://news.softpedia.com/news/amazon-s-wireless-mesh-networking-experiment-destroys-users-privacy-533073.shtm
- Preying on the unemployed, cybercriminals are posting fake job listings in hopes of luring job seekers into filling out background check documents. The goal of the scam is to acquire personal information that can be used or sold. The criminal group went so far as to set up phone interviews with “recruiters” and the “HR department” of Geosyntec, a real consulting company. Almost 100 people applied via LinkedIn ads the group posted. Last year, some 16,000 people reported being victims of employment scams with losses totaling more than $59 million, according to the FBI. https://krebsonsecurity.com/2021/05/how-to-tell-a-job-offer-from-an-id-theft-trap/
Cybersecurity Term of the Week
-
Office of Foreign Assets Control (OFAC) and the Financial Crimes Enforcement Network (FinCEN) are government agencies charged with protecting US financial institutions from money laundering and related crimes. These groups recently presented new guidelines related to direct ransomware payments warning financial institutions and payment intermediaries of potential sanctions and risks involved in making ransom payments. The advisory also provided information on requirements for Suspicious Activity Reports (SARs) under anti-money laundering regulations.
Shawn’s Soapbox
There is a tradeoff between online convenience and the digital security of your personal information. Where do you draw the line and how do you make good decisions about what information to share? We trade security vs. usability vs. convenience all the time. Often cybersecurity simply gets in the way of users going about their day-to-day business. Security professionals push for more security and strive to implement strong and effective measures that will safeguard their organization’s digital assets from cybercriminals. But for users, security is increasingly a hindrance, an annoyance, and very often seen as an inhibitor of business, rather than an enabler. There will come a point where security must win out at the cost of convenience. https://medium.com/@marcoessomba/dilemma-cyber-security-vs-20c1c74a78c9