Malware Devil

Loading...

Tuesday, September 29, 2020

Who’s Behind Monday’s 14-State 911 Outage?

Emergency 911 systems were down for more than an hour on Monday in towns and cities across 14 U.S. states. The outages led many news outlets to speculate the problem was related to Microsoft‘s Azure web services platform, which also was struggling with a widespread outage at the time. However, multiple sources tell KrebsOnSecurity the 911 issues stemmed from some kind of technical snafu involving Intrado and Lumen, two companies that together handle 911 calls for a broad swath of the United States.

Image: West.com

On the afternoon of Monday, Sept. 28, several states including Arizona, California, Colorado, Delaware, Florida, Illinois, Indiana, Minnesota, Nevada, North Carolina, North Dakota, Ohio, Pennsylvania and Washington reported 911 outages in various cities and localities.

Multiple news reports suggested the outages might have been related to an ongoing service disruption at Microsoft. But a spokesperson for the software giant told KrebsOnSecurity, “we’ve seen no indication that the multi-state 911 outage was a result of yesterday’s Azure service disruption.”

Inquiries made with emergency dispatch centers at several of the towns and cities hit by the 911 outage pointed to a different source: Omaha, Neb.-based Intrado — until last year known as West Safety Communications — a provider of 911 and emergency communications infrastructure, systems and services to telecommunications companies and public safety agencies throughout the country.

Intrado did not respond to multiple requests for comment. But according to officials in Henderson County, NC, which experienced its own 911 failures yesterday, Intrado said the outage was the result of a problem with an unspecified service provider.

“On September 28, 2020, at 4:30pm MT, our 911 Service Provider observed conditions internal to their network that resulted in impacts to 911 call delivery,” reads a statement Intrado provided to county officials. “The impact was mitigated, and service was restored and confirmed to be functional by 5:47PM MT.  Our service provider is currently working to determine root cause.”

The service provider referenced in Intrado’s statement appears to be Lumen, a communications firm and 911 provider that until very recently was known as CenturyLink Inc. A look at the company’s status page indicates multiple Lumen systems experienced total or partial service disruptions on Monday, including its private and internal cloud networks and its control systems network.

Lumen’s status page indicates the company’s private and internal cloud and control system networks had outages or service disruptions on Monday.

In a statement provided to KrebsOnSecurity, Lumen blamed the issue on Intrado.

“At approximately 4:30 p.m. MT, some Lumen customers were affected by a vendor partner event that impacted 911 services in AZ, CO, NC, ND, MN, SD, and UT,” the statement reads. “Service was restored in less than an hour and all 911 traffic is routing properly at this time. The vendor partner is in the process of investigating the event.”

It may be no accident that both of these companies are now operating under new names, as this would hardly be the first time a problem between the two of them has disrupted 911 access for a large number of Americans.

In 2019, Intrado/West and CenturyLink agreed to pay $575,000 to settle an investigation by the Federal Communications Commission (FCC) into an Aug. 2018 outage that lasted 65 minutes. The FCC found that incident was the result of a West Safety technician bungling a configuration change to the company’s 911 routing network.

On April 6, 2014, some 11 million people across the United States were disconnected from 911 services for eight hours thanks to an “entirely preventable” software error tied to Intrado’s systems. The incident affected 81 call dispatch centers, rendering emergency services inoperable in all of Washington and parts of North Carolina, South Carolina, Pennsylvania, California, Minnesota and Florida.

According to a 2014 Washington Post story about a subsequent investigation and report released by the FCC, that issue involved a problem with the way Intrado’s automated system assigns a unique identifying code to each incoming call before passing it on to the appropriate “public safety answering point,” or PSAP.

“On April 9, the software responsible for assigning the codes maxed out at a pre-set limit,” The Post explained. “The counter literally stopped counting at 40 million calls. As a result, the routing system stopped accepting new calls, leading to a bottleneck and a series of cascading failures elsewhere in the 911 infrastructure.”

Compounding the length of the 2014 outage, the FCC found, was that the Intrado server responsible for categorizing and keeping track of service interruptions classified them as “low level” incidents that were never flagged for manual review by human beings.

The FCC ultimately fined Intrado and CenturyLink $17.4 million for the multi-state 2014 outage. An FCC spokesperson declined to comment on Monday’s outage, but said the agency was investigating the incident.

Read More

The post Who’s Behind Monday’s 14-State 911 Outage? appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/whos-behind-mondays-14-state-911-outage-2/?utm_source=rss&utm_medium=rss&utm_campaign=whos-behind-mondays-14-state-911-outage-2
at No comments:
Labels:

Who’s Behind Monday’s 14-State 911 Outage?

Emergency 911 systems were down for more than an hour on Monday in towns and cities across 14 U.S. states. The outages led many news outlets to speculate the problem was related to Microsoft’s Azure web services platform, which also was struggling with a widespread outage at the time. However, multiple sources tell KrebsOnSecurity the 911 issues stemmed from some kind of technical snafu involving Intrado and Lumen, two companies that together handle 911 calls for a broad swath of the United States.

The post Who’s Behind Monday’s 14-State 911 Outage? appeared first on Security Boulevard.

Read More

The post Who’s Behind Monday’s 14-State 911 Outage? appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/whos-behind-mondays-14-state-911-outage/?utm_source=rss&utm_medium=rss&utm_campaign=whos-behind-mondays-14-state-911-outage
at No comments:
Labels:

DDoS Attacks Soar in First Half of 2020

Register for Dark Reading Newsletters

Subscribe to Newsletters

White Papers

image

Video

image
image
image
Cartoon
image

Current Issue

imageSpecial Report: Computing’s New NormalThis special report examines how IT security organizations have adapted to the “new normal” of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
image

Flash Poll

image
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world — and enterprise computing — on end. Here’s a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
image

Twitter Feed

Dark Reading - Bug Report

Bug Report

Enterprise Vulnerabilities
From DHS/US-CERT’s National Vulnerability Database
CVE-2020-15216
PUBLISHED: 2020-09-29

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one.
A patch is available, all users of goxmldsig should upgrade to at least revisio…

CVE-2020-4607
PUBLISHED: 2020-09-29

IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.

CVE-2020-24565
PUBLISHED: 2020-09-29

An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product.
An attacker must first obtain the ability to execute low-privileged code on the …

CVE-2020-25770
PUBLISHED: 2020-09-29

An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product.
An attacker must first obtain the ability to execute low-privileged code on the …

CVE-2020-25771
PUBLISHED: 2020-09-29

An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product.
An attacker must first obtain the ability to execute low-privileged code on the …

The post DDoS Attacks Soar in First Half of 2020 appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/ddos-attacks-soar-in-first-half-of-2020/?utm_source=rss&utm_medium=rss&utm_campaign=ddos-attacks-soar-in-first-half-of-2020
at No comments:
Labels:

NERC Publishes Practice Guide for assessing SVCHOST.EXE

One of our customers (you know who you are, thanks!) made us aware of a new practice guide titled “ERO Enterprise CMEP Practice Guide: Assessment of SVCHOST.EXE” published exactly two weeks ago today on September 15th, 2020. NERC seldom releases guidance like this, so they shouldn’t go unnoticed. They’ve published 3 such Critical Infrastructure Protection […]… Read More

The post NERC Publishes Practice Guide for assessing SVCHOST.EXE appeared first on The State of Security.

The post NERC Publishes Practice Guide for assessing SVCHOST.EXE appeared first on Security Boulevard.

Read More

The post NERC Publishes Practice Guide for assessing SVCHOST.EXE appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/nerc-publishes-practice-guide-for-assessing-svchost-exe/?utm_source=rss&utm_medium=rss&utm_campaign=nerc-publishes-practice-guide-for-assessing-svchost-exe
at No comments:
Labels:

5 Go-to-Market Tips for MSP Security Practices

The post 5 Go-to-Market Tips for MSP Security Practices appeared first on Digital Defense, Inc..

The post 5 Go-to-Market Tips for MSP Security Practices appeared first on Security Boulevard.

Read More

The post 5 Go-to-Market Tips for MSP Security Practices appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/5-go-to-market-tips-for-msp-security-practices/?utm_source=rss&utm_medium=rss&utm_campaign=5-go-to-market-tips-for-msp-security-practices
at No comments:
Labels:

The Risks to Updating Passwords on Microsoft 365

Understand the risk in updating passwords on Microsoft 365, and learn a new approach to securing a user’s core identity. Try JumpCloud Free.

The post The Risks to Updating Passwords on Microsoft 365 appeared first on JumpCloud.

The post The Risks to Updating Passwords on Microsoft 365 appeared first on Security Boulevard.

Read More

The post The Risks to Updating Passwords on Microsoft 365 appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/the-risks-to-updating-passwords-on-microsoft-365/?utm_source=rss&utm_medium=rss&utm_campaign=the-risks-to-updating-passwords-on-microsoft-365
at No comments:
Labels:

New Campaign by China-Linked Group Targets US Orgs for First Time

In a least one instance, the Palmerworm APT group was able to remain undetected on a compromised system for nearly six months, according to Symantec.

Researchers from Symantec have uncovered a new cyber espionage campaign by a likely China-based advanced persistent threat (APT) group called Palmerworm. The group is targeting organizations in multiple countries including, for the first time, the US.

Palmerworm has been using a collection of new malware, including payloads signed with stolen code-signing certificates, in the latest campaign, which Symantec estimated was launched in August 2019.

In a report this week, the security vendor said it had identified at least five victims of the new campaign so far. The victim list comprises three companies in the media, electronics, and finance sectors in Taiwan; a construction firm in China; and an engineering company in Japan. In some of these intrusions, the threat group remained active on the victim network for a whole year.

Symantec said it had also observed Palmerworm activity on some victim networks in the US recently, but it was not able to identify the organizations or industry sectors to which they belonged.

“Based on our visibility and data, this is the first time we have seen Palmerworm target the US,” says Jon DiMaggio, cyber threat analyst at Symantec, a division of Broadcom. In a least one instance, the threat actors were able to remain undetected on a compromised system for nearly six months, Symantec said.

Palmerworm has traditionally targeted organizations located in Asia. So the attacks in the US represent a shift in the group’s focus and are likely a trend that will continue, DiMaggio says.

After a few years of decline in activity from China following its 2015 non-hacking pact with the US, attacks from China have returned to prior levels.

“Beginning in 2018 we have noted the rise in activity, and the Palmerworm campaign is more evidence of the return of US targeting,” DiMaggio says. “Compared to the previous activity, the shift we see is likely a direct result in Palmerworm’s objective or mission evolving and changing to fit the needs of their handlers.”

Palmerworm, which is also referred to as Blacktech by some security firms, is a previously known threat actor that is thought to be carrying out at least some of its missions on behalf of the Chinese government. Most of its activities so far have been focused on organizations in Taiwan, Hong Kong, and Japan.

In 2017 security vendor Trend Micro tied three separate and long-running cyber espionage campaigns to Palmerworm/Blacktech. One of them was a data theft campaign focused on the theft of confidential data from private-sector and government organizations in Taiwan. The other two campaigns also involved the theft of IP and other data from government contractors and enterprises in the computer, electronics, healthcare, and financial sectors in East Asia.

At the time, Trend Micro described Palmerworm/Blacktech’s initial victims as not always being the group’s primary targets. Often, the group was observed using data obtained from one victim being used to target another organization. Trend Micro concluded that the documents the APT group stole in its initial attacks were likely just the first phase of a longer attack chain.

Last month Reuters reported Taiwanese government officials as describing Palmerworm/Blacktech as one of two China-backed groups responsible for a series of attacks beginning 2018 that targeted at least 10 government agencies and four technology companies in Taiwan. The attacks targeted at least 6,000 email accounts belonging to Taiwanese government officials, Reuters said.

New Malware, Same Tactics
According to Symantec, Palmerworm has been using at least four previously unseen backdoors in its latest attacks. The company identified the malware as Backdoor.Consock, Backdoor.Waship, Backdoor.Dalwit, and Backdoor.Nomri. Like it has in previous campaigns, Palmerworm is also using a slew of dual-use tools to break into systems and steal data. The tools include Putty for remote access and data exfiltration, PSExec for lateral movement, SNScan for network reconnaissance, and WinRAR for compressing stolen files before transmitting them to attacker-controlled systems.

As it has in previous attacks, Palmerworm operatives are using stolen code-signing certificates to digitally sign malicious payloads to evade enterprise malware detection mechanisms. In July 2018 researchers from ESET reported observing Palmerworm/Blacktech digitally signing their malware with a stolen D-Link Corp. certificate that the latter revoked after being informed about the theft.

Based on available data, it’s hard to say whether the primary motive for Packerworm’s latest attacks is cyber espionage or for targeting the supply chain.

“Only time and observation will allow us to determine if the current victims are the primary targets [or] secondary targets used for leverage in a more significant supply chain operation,” DiMaggio says.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts
More Webcasts
White Papers

More White Papers

Reports

More Reports

The post New Campaign by China-Linked Group Targets US Orgs for First Time appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/new-campaign-by-china-linked-group-targets-us-orgs-for-first-time-2/?utm_source=rss&utm_medium=rss&utm_campaign=new-campaign-by-china-linked-group-targets-us-orgs-for-first-time-2
at No comments:
Labels:

New Campaign by China-Linked Group Targets US Orgs for First Time

In a least one instance, the Palmerworm APT group was able to remain undetected on a compromised system for nearly six months, according to Symantec.

Researchers from Symantec have uncovered a new cyber espionage campaign by a likely China-based advanced persistent threat (APT) group called Palmerworm. The group is targeting organizations in multiple countries including, for the first time, the US.

Palmerworm has been using a collection of new malware, including payloads signed with stolen code-signing certificates, in the latest campaign, which Symantec estimated was launched in August 2019.

In a report this week, the security vendor said it had identified at least five victims of the new campaign so far. The victim list comprises three companies in the media, electronics, and finance sectors in Taiwan; a construction firm in China; and an engineering company in Japan. In some of these intrusions, the threat group remained active on the victim network for a whole year.

Symantec said it had also observed Palmerworm activity on some victim networks in the US recently, but it was not able to identify the organizations or industry sectors to which they belonged.

“Based on our visibility and data, this is the first time we have seen Palmerworm target the US,” says Jon DiMaggio, cyber threat analyst at Symantec, a division of Broadcom. In a least one instance, the threat actors were able to remain undetected on a compromised system for nearly six months, Symantec said.

Palmerworm has traditionally targeted organizations located in Asia. So the attacks in the US represent a shift in the group’s focus and are likely a trend that will continue, DiMaggio says.

After a few years of decline in activity from China following its 2015 non-hacking pact with the US, attacks from China have returned to prior levels.

“Beginning in 2018 we have noted the rise in activity, and the Palmerworm campaign is more evidence of the return of US targeting,” DiMaggio says. “Compared to the previous activity, the shift we see is likely a direct result in Palmerworm’s objective or mission evolving and changing to fit the needs of their handlers.”

Palmerworm, which is also referred to as Blacktech by some security firms, is a previously known threat actor that is thought to be carrying out at least some of its missions on behalf of the Chinese government. Most of its activities so far have been focused on organizations in Taiwan, Hong Kong, and Japan.

In 2017 security vendor Trend Micro tied three separate and long-running cyber espionage campaigns to Palmerworm/Blacktech. One of them was a data theft campaign focused on the theft of confidential data from private-sector and government organizations in Taiwan. The other two campaigns also involved the theft of IP and other data from government contractors and enterprises in the computer, electronics, healthcare, and financial sectors in East Asia.

At the time, Trend Micro described Palmerworm/Blacktech’s initial victims as not always being the group’s primary targets. Often, the group was observed using data obtained from one victim being used to target another organization. Trend Micro concluded that the documents the APT group stole in its initial attacks were likely just the first phase of a longer attack chain.

Last month Reuters reported Taiwanese government officials as describing Palmerworm/Blacktech as one of two China-backed groups responsible for a series of attacks beginning 2018 that targeted at least 10 government agencies and four technology companies in Taiwan. The attacks targeted at least 6,000 email accounts belonging to Taiwanese government officials, Reuters said.

New Malware, Same Tactics
According to Symantec, Palmerworm has been using at least four previously unseen backdoors in its latest attacks. The company identified the malware as Backdoor.Consock, Backdoor.Waship, Backdoor.Dalwit, and Backdoor.Nomri. Like it has in previous campaigns, Palmerworm is also using a slew of dual-use tools to break into systems and steal data. The tools include Putty for remote access and data exfiltration, PSExec for lateral movement, SNScan for network reconnaissance, and WinRAR for compressing stolen files before transmitting them to attacker-controlled systems.

As it has in previous attacks, Palmerworm operatives are using stolen code-signing certificates to digitally sign malicious payloads to evade enterprise malware detection mechanisms. In July 2018 researchers from ESET reported observing Palmerworm/Blacktech digitally signing their malware with a stolen D-Link Corp. certificate that the latter revoked after being informed about the theft.

Based on available data, it’s hard to say whether the primary motive for Packerworm’s latest attacks is cyber espionage or for targeting the supply chain.

“Only time and observation will allow us to determine if the current victims are the primary targets [or] secondary targets used for leverage in a more significant supply chain operation,” DiMaggio says.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

More Webcasts

White Papers

More White Papers

Reports

More Reports

The post New Campaign by China-Linked Group Targets US Orgs for First Time appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/new-campaign-by-china-linked-group-targets-us-orgs-for-first-time/?utm_source=rss&utm_medium=rss&utm_campaign=new-campaign-by-china-linked-group-targets-us-orgs-for-first-time
at No comments:
Labels:

Has 2020 Thrown a Spanner in Progress Toward Zero Trust?

Thus far, 2020 has been the year in which already-complicated things became true hornets’ nests. Keeping applications secure for local access wa…

(Feed generated with FetchRSS)

The post Has 2020 Thrown a Spanner in Progress Toward Zero Trust? appeared first on Security Boulevard.

Read More

The post Has 2020 Thrown a Spanner in Progress Toward Zero Trust? appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/has-2020-thrown-a-spanner-in-progress-toward-zero-trust-2/?utm_source=rss&utm_medium=rss&utm_campaign=has-2020-thrown-a-spanner-in-progress-toward-zero-trust-2
at No comments:
Labels:

Has 2020 Thrown a Spanner in Progress Toward Zero Trust?

Thus far, 2020 has been the year in which already-complicated things became true hornets’ nests. Keeping applications secure for local access wa…

(Feed generated with FetchRSS)

The post Has 2020 Thrown a Spanner in Progress Toward Zero Trust? appeared first on Security Boulevard.

Read More

The post Has 2020 Thrown a Spanner in Progress Toward Zero Trust? appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/has-2020-thrown-a-spanner-in-progress-toward-zero-trust/?utm_source=rss&utm_medium=rss&utm_campaign=has-2020-thrown-a-spanner-in-progress-toward-zero-trust
at No comments:
Labels:

Securing Slack: 5 Tips for Safer Messaging, Collaboration

Remote workers and scattered teams are relying on Slack more and more for messaging and collaboration. Here are a few extra tips for keeping data and systems more secure when using Slack.

Demand for business-focused messaging platforms like Slack have surged during the great work-from-home (WFH) migration. While that was a logical move considering the popular platform was literally built for distributed team communications, many security processes got trampled in the stampede.

(image by ink drop, via Adobe Stock)

“This growth in user counts is stress-testing digital collaboration applications — many of which weren’t originally crafted to handle such an enormous spike in usage over this short of a time frame,” says Michael Gorelik, CTO at Morphisec, an endpoint security provider.

“Our 2020 WFH Cybersecurity Threat Index found that business chat apps such as Slack and Microsoft Teams were rated by WFH employees as their second most essential tool in working remotely. Yet workers acknowledged they were the least cautious in using these types of services,” says Gorelik.

Despite, or perhaps because of, remote workers’ rather cavalier attitudes, the potential damages to companies from Slack security breaches are quite serious.

“We have all seen the examples of what happens when a CEO’s e-mail is leaked to the press, and it contains nuclear opinions on customer, employees, investors, and the market, in general. If people have historically had their guard down when communicating in e-mail, they likely have no filter at all with what they put in Slack,” warns Caleb Barlow, CEO of CynergisTek, a healthcare cybersecurity and compliance consultancy and managed services firm.

It is prudent for companies to secure their Slack channels. Here’s a roundup of Slack’s and security professionals’ recommendations of specific steps your company can take toward making Slack safer.

(Continued on next page)

Pam Baker is author of Data Divination: Big Data Strategies, which met with rave reviews and is currently being used in universities as a textbook for both business and tech courses. It’s also sold to business audiences in the general market. The US Chamber of Commerce and … View Full Bio

Previous

1 of 6

Next

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts
More Webcasts
White Papers

More White Papers

Reports

More Reports

The post Securing Slack: 5 Tips for Safer Messaging, Collaboration appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/securing-slack-5-tips-for-safer-messaging-collaboration/?utm_source=rss&utm_medium=rss&utm_campaign=securing-slack-5-tips-for-safer-messaging-collaboration
at No comments:
Labels:

Microsoft Outage, Joker Trojan, & Alien Android Trojan – SWN #69

This week, Dr. Doug discusses the Microsoft outage, Jokers wild, Alien Forking at Android, Ryuk, United Health, possessed coffee makers, and Jason Wood joins us for Expert Commentary to talk about REvil Ransomware!
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://wiki.securityweekly.com/swn69

The post Microsoft Outage, Joker Trojan, & Alien Android Trojan – SWN #69 appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/microsoft-outage-joker-trojan-alien-android-trojan-swn-69/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-outage-joker-trojan-alien-android-trojan-swn-69
at No comments:
Labels:

Microsoft Outage, Joker Trojan, & Alien Android Trojan – SWN #69

This week, Dr. Doug discusses the Microsoft outage, Jokers wild, Alien Forking at Android, Ryuk, United Health, possessed coffee makers, and Jason Wood joins us for Expert Commentary to talk about REvil Ransomware!
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://wiki.securityweekly.com/swn69

The post Microsoft Outage, Joker Trojan, & Alien Android Trojan – SWN #69 appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/microsoft-outage-joker-trojan-alien-android-trojan-swn-69-2/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-outage-joker-trojan-alien-android-trojan-swn-69-2
at No comments:
Labels:

How to mitigate Format String Vulnerabilities

Introduction: This article provides an overview of various techniques that can be used to mitigate Format String vulnerabilities. In addition to the mitigations that are offered by the compilers…

Go on to the site to read the full article

The post How to mitigate Format String Vulnerabilities appeared first on Security Boulevard.

Read More

The post How to mitigate Format String Vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/how-to-mitigate-format-string-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-mitigate-format-string-vulnerabilities
at No comments:
Labels:

IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications

Introduction: IoT Manufacturers Favor Convenience over Security Because IoT security is still an afterthought, cybercriminals in general consider smart devices a “low-hanging fruit” – a target easy…

Go on to the site to read the full article

The post IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications appeared first on Security Boulevard.

Read More

The post IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/iot-security-fundamentals-intercepting-and-manipulating-wireless-communications/?utm_source=rss&utm_medium=rss&utm_campaign=iot-security-fundamentals-intercepting-and-manipulating-wireless-communications
at No comments:
Labels:

The Top Internet of Things (IoT) Authentication Methods and Options

IoT Authentication

Gartner recently labeled Internet of Things Authentication as a high benefit in 2020 Gartner Hype Cycle for IAM Technologies. This blog covers your options for Internet of Things Authentication.

The post The Top Internet of Things (IoT) Authentication Methods and Options appeared first on Security Boulevard.

Read More

The post The Top Internet of Things (IoT) Authentication Methods and Options appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/the-top-internet-of-things-iot-authentication-methods-and-options-2/?utm_source=rss&utm_medium=rss&utm_campaign=the-top-internet-of-things-iot-authentication-methods-and-options-2
at No comments:
Labels:

IoT Security Fundamentals: IoT vs OT (Operational Technology)

Introduction: Knowing the Notions  Industrial Internet of Things (IIoT) incorporates technologies such as machine learning, machine-to-machine (M2M) communication, sensor data, Big Data, etc. This…

Go on to the site to read the full article

The post IoT Security Fundamentals: IoT vs OT (Operational Technology) appeared first on Security Boulevard.

Read More

The post IoT Security Fundamentals: IoT vs OT (Operational Technology) appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/iot-security-fundamentals-iot-vs-ot-operational-technology/?utm_source=rss&utm_medium=rss&utm_campaign=iot-security-fundamentals-iot-vs-ot-operational-technology
at No comments:
Labels:

ESB-2020.3342 – [Debian] libdbi-perl: Multiple vulnerabilities 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.3342
                        libdbi-perl security update
                             29 September 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           libdbi-perl
Publisher:         Debian
Operating System:  Debian GNU/Linux 9
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account
                   Denial of Service               -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-14393 CVE-2020-14392 CVE-2019-20919

Reference:         ESB-2020.3262
                   ESB-2020.3169

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2020/09/msg00026.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2386-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                                     
September 28, 2020                            https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------

Package        : libdbi-perl
Version        : 1.636-1+deb9u1
CVE ID         : CVE-2019-20919 CVE-2020-14392 CVE-2020-14393

Several vulnerabilities were discovered in the Perl5 Database
Interface (DBI). An attacker could trigger a denial-of-service (DoS)
and possibly execute arbitrary code.

CVE-2019-20919

    The hv_fetch() documentation requires checking for NULL and the
    code does that. But, shortly thereafter, it calls SvOK(profile),
    causing a NULL pointer dereference.

CVE-2020-14392

    An untrusted pointer dereference flaw was found in Perl-DBI. A
    local attacker who is able to manipulate calls to
    dbd_db_login6_sv() could cause memory corruption, affecting the
    service's availability.

CVE-2020-14393

    A buffer overflow on via an overlong DBD class name in
    dbih_setup_handle function may lead to data be written past the
    intended limit.

For Debian 9 stretch, these problems have been fixed in version
1.636-1+deb9u1.

We recommend that you upgrade your libdbi-perl packages.

For the detailed security status of libdbi-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libdbi-perl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEQic8GuN/xDR88HkSj/HLbo2JBZ8FAl9x3vIACgkQj/HLbo2J
BZ+IiQf+KXLvRwpgFI0gBXeeiH+AeyIJfCxUcSpWjHUM7+WTmG/UZAGuhriyYxg2
PFeVbvymu7jNYGcP8kse1gxJtrKv0JuN0FkKpCs+i7EPtOEX9wF/MyjkILs5ucY2
cK/DKeSdeoTvhuIjtSPYyIWpR8Ms8+9Gl5KVCydAO3qGEfXWX2XaIMdknKXArbw9
3ve+Zbu8MwTZSrAgq+8BUPQ54MP89b4hTjetau4/SS0pXtHg6ChaZfSeFq6HIUaG
J/Xa1rRLPp1f/Z1WMZRlxwt0F7qX9zBgsJuGnMhEpAYkz5twFk+Uwx/nG0aK2+L4
J/39oMQdeRpaInaxVnCdvBTmT2RTRg==
=o6S8
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBX3KcxeNLKJtyKPYoAQiKGA/8DhZ8URP3H2UOWKxCn9v3MbaNUnQ76P/P
4Og6qT1Ct9fgoo80zPbnqN2EsxEXx7AFl5UhZdrAWHklVk8kI5t5/iTwy1ACz7kv
ulHJUDAr57Ma0orZXw45t/5vsvL91pUNA/cNdr2qkFd/I9esWRdLdl2bn8Ena/07
NeThIrDAHjHoQ4RM255h13S6g4RBRO4cbOc6IdbZkdLWAekuoiKiUwNnxuYdRTIr
3nU0zeCMP9iQhTylvNhLP1R8/5aU7Zi6mgriaebSOwJ41T1DClBCjb8tZk+rUsHu
wRDVJ5YE/cy0IsHRq55Wq6IN6alDbQ7gvzFe8PdWL3NBg0Ci0Y+TH+RTWxHzmzJJ
ZN4LApNS8B0Kd9lUvY5YGqjFvIKacTkuFi/xfN/ZX4zn8e2GMKvde8RqGYDhnB6U
ZjWGxDowIeO7d7iClkCmGxjENx+TXvyFcgYZskTFdx/VOZr5JwilRktIcOntWXFU
QG13gN4G3Rk/x2o4KJuJSjyJRmbxMRE0nn41IvYTp9ghu4O+BvOP0Bw1MnNQhI+g
n+KvLdSZ+WqDFaP2wjQ56zAmBkGWJ6Yn6OmspebWe+ATHW4IBeE53vOoCrwxel5I
KCGYXkMF9ADvoMy5S7EoJ93m8ZCYD3+GtHR8V9zxRzk3ptS4YZWsnHdGTai77lyz
Q943aHQ0SVk=
=SYWx
-----END PGP SIGNATURE-----

Read More

The post ESB-2020.3342 – [Debian] libdbi-perl: Multiple vulnerabilities appeared first on Malware Devil.



https://malwaredevil.com/2020/09/29/esb-2020-3342-debian-libdbi-perl-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-3342-debian-libdbi-perl-multiple-vulnerabilities
at No comments:
Labels:
Subscribe to: Posts (Atom)

Barbary Pirates and Russian Cybercrime

In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...