Weekly InfoSec News Brief 3-9 August
Last Thursday, Mozilla released a security update for FIrefox (v 39.0.3) to patch a serious vulnerability that was being actively exploited by hackers apparently out of Russia or Ukraine. The flaw is in the built-in PDF reader, allowing arbitrary JavaScript execution with access to the local file system. The flaw affects Firefox on all operating systems. This allowed the attackers to search for and upload files, and they used this capability to steal common files that would contain login information on Windows and Linux systems. If your organization runs Firefox at all, it is important to update to the latest version as soon as possible.
https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
http://arstechnica.com/security/2015/08/0-day-attack-on-firefox-users-stole-password-and-key-data-patch-now/
Yahoo's Ad Network Hijacked to Deliver Malware
Malwarebytes discovered last week (and reported to Yahoo) that Yahoo's ad network was being abused to deliver malware to visitors via the Angler Exploit Kit. This exploit kit is often used to deliver various malware payloads, with ransomware one of the most common. The exploit kit examines visitors' browser configurations to select the most likely-to-succeed exploit method, with Adobe Flash exploits being the most popular over the past several months. This broad use of a trusted site and trusted advertising network to deliver malware demonstrates why avoiding untrustworthy sites is not enough to ensure safety from web-based attacks; anyone browsing the Internet needs to keep their systems up-to-date, and employ effective anti-malware software. Security vendor RiskIQ claims that malicious web advertising increased 260% in the first half of this year, and that fake software update ads are now the most prevalent means of malware infections.
http://www.scmagazine.com/hackers-spread-malware-via-yahoo-ads/article/430290/
http://www.infosecurity-magazine.com/news/malicious-ads-soar-260-over-the/
"Internet of Things" Security Becoming Increasingly Hot Topic
As more and more devices beyond traditional are being connected to the Internet, the security of these devices is becoming a serious issue. Unlike traditional computers, these devices are often difficult to patch or update when needed, and most organizational security systems are not optimized to monitor or provide for their security. Recent news on these issues have included a vulnerability in a popular drug pump used in hospitals that can allow a hacker to affect the dosage and a vulnerability in Chrysler's Internet-connected entertainment system that can allow an attacker to override the car's controls. What Internet-connected "things" does your organization employ? Common examples include thermostats, surveillance cameras, and environmental monitors. Does your vulnerability management and security monitoring strategy include these devices?
http://www.bbc.com/news/technology-33759428
http://www.wired.com/2015/07/patch-gm-onstar-ios-app-avoid-wireless-car-hack/
http://thehill.com/policy/cybersecurity/250060-feds-widen-auto-hacking-investigation
Cloud-based file storage and synchronization is an extremely powerful productivity tool, and very popular in most organizations today. To some extent this usage is planned and sanctioned as part of the enterprise IT plan, but more often it is not. Yet a lot of business data is often stored with these services. This data is then often synchronized or downloaded to personal PCs or mobile devices, and now security researchers have shown another vulnerability that could allow an attacker to steal the access token that allows a user's device to synchronize data. If your organization does not have policy to regulate the use of these services and technology to enforce that policy, you need to consider how to address this issue.
http://www.scmagazine.com/cloud-storage-sites-vulnerable-to-new-wave-of-attacks/article/431249/
WordPress Releases a New Version, Fixes Six Security Issues Including a Serious SQL Injection Bug
WordPress released version 4.2.4 of their web content management/blogging software last Tuesday. The new release fixes six security issues, the most serious of which was a SQL injection flaw (CVE-2015-2213) which could allow an attacker to execute arbitrary SQL commands on the connected database. This new version follows less than two weeks after the previous version release, and organizations are urged to update as soon as possible.
http://www.theregister.co.uk/2015/08/06/vulnerable_again_wordpress_issues_urgent_patch/
https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/
Serious Mac OS X Vulnerability Being Exploited in the Wild; Patch Expected Soon from Apple
The "DYLD" vulnerability in Apple's Mac OS X operating system was publicized in early June, but it was not until last week that reports came out that attackers were actively using the vulnerability to exploit Mac systems over the Internet. The vulnerability is a serious one, potentially allowing attackers to run arbitrary code against Mac systems using administrative privileges. The latest beta of the next update for OS X (10.10.5) has a patch for the vulnerability, and the final release of the update is likely this week. Mac users should be on the lookout for this update in the App Store and are encouraged to install it as soon as possible.
http://www.cnet.com/news/apple-reportedly-set-to-patch-serious-security-bug-in-mac-os-x/
Comments
Post a Comment