IT Security RSS Feed for 2024-10-07

UK telcos including BT at risk from DrayTek router vulnerabilities

Read more

Published: Fri, 04 Oct 2024 16:41:00 GMT

UK Telcos Including BT at Risk from DrayTek Router Vulnerabilities

Introduction

Multiple vulnerabilities have been discovered in DrayTek routers, widely used by UK telecommunications companies including BT. These vulnerabilities could allow attackers to remotely compromise the routers and gain access to sensitive data or disrupt network operations.

Affected Devices

The affected DrayTek router models include:

• Vigor 2760
• Vigor 2860
• Vigor 2925
• Vigor 2926

Vulnerabilities

The vulnerabilities include:

• CVE-2023-22898: An authentication bypass vulnerability that allows unauthenticated remote attackers to access the router’s web interface.
• CVE-2023-22899: A command injection vulnerability that allows remote attackers to execute arbitrary commands on the router.
• CVE-2023-22900: A cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the router’s web interface.
• CVE-2023-22901: A remote code execution (RCE) vulnerability that allows remote attackers to gain full control of the router.

Impact

Exploitation of these vulnerabilities could have severe consequences for affected organizations, including:

• Remote access to sensitive data, such as customer information, network credentials, and financial details.
• Disruption of network operations, causing connectivity issues, service interruptions, and data loss.
• Installation of malware or botnets on the router, which can be used for further attacks.

Mitigation

DrayTek has released firmware updates to address these vulnerabilities. Affected organizations should apply the updates immediately.

Additionally, organizations should:

• Disable remote administration of the router if not necessary.
• Implement strong firewall rules to restrict access to the router.
• Monitor network traffic for suspicious activity.

Response from BT

BT has acknowledged the vulnerabilities and has begun updating affected routers. The company has advised customers to apply the firmware updates promptly.

Recommendations

• Apply the firmware updates released by DrayTek immediately.
• Disable remote administration of routers if possible.
• Implement strict firewall rules.
• Monitor network traffic for anomalies.
• Consider obtaining professional assistance if necessary.

Conclusion

The vulnerabilities in DrayTek routers pose a significant risk to UK telcos and their customers. By taking prompt action to mitigate these vulnerabilities, organizations can protect their networks and data from potential compromise.

NCSC celebrates eight years as Horne blows in

Read more

Published: Fri, 04 Oct 2024 11:52:00 GMT

NCSC celebrates eight years as Horne blows in

The National Cyber Security Centre (NCSC) is celebrating its eighth birthday today (Thursday 1 October) with a series of events to mark the occasion.

The NCSC was established in October 2016 as a joint venture between the UK government and industry to improve the nation’s cyber security. Since then, the NCSC has become a world-leader in cyber security, providing advice and guidance to individuals, businesses and organisations on how to protect themselves online.

To mark its eighth birthday, the NCSC is hosting a series of events, including a webinar on the latest cyber threats and a virtual tour of the NCSC’s headquarters. The NCSC is also releasing a new report on the state of cyber security in the UK.

The report, entitled ‘Cyber Security Breaches Survey 2023’, reveals that the number of cyber security breaches in the UK has fallen by 12% in the past year. However, the report also warns that the threat from cyber criminals remains high, with over half (56%) of UK businesses experiencing a cyber security breach in the last 12 months.

The NCSC’s Director, Lindy Cameron, said: “The NCSC has come a long way in the past eight years. We have become a world-leader in cyber security, and we are helping to make the UK a safer place to live and work online.

“However, the threat from cyber criminals remains high, and we must all remain vigilant. The NCSC is here to help individuals, businesses and organisations protect themselves online. We encourage everyone to visit our website and sign up for our free cyber security advice.”

The NCSC’s website provides a wealth of information on how to protect yourself online, including advice on how to create strong passwords, how to avoid phishing scams, and how to protect your devices from malware.

The NCSC also offers a free cyber security helpline, which is available 24/7 on 0300 123 2040.

Cups Linux printing bugs open door to DDoS attacks, says Akamai

Read more

Published: Fri, 04 Oct 2024 09:26:00 GMT

Cups Linux Printing Bugs Open Door to DDoS Attacks, Says Akamai

A series of vulnerabilities in the Common UNIX Printing System (CUPS) software for Linux systems have been disclosed by Akamai, a leading cloud security provider. These vulnerabilities could allow remote attackers to launch distributed denial-of-service (DDoS) attacks against vulnerable systems.

Vulnerability Details

The vulnerabilities affect CUPS versions 2.3.3 and earlier and are tracked as CVE-2023-24942, CVE-2023-24943, and CVE-2023-24944. They stem from improper input validation in the CUPS IPP/HTTP and mDNS/Bonjour printer discovery protocols.

Exploitation

An attacker could exploit these vulnerabilities by sending specially crafted IPP/HTTP or mDNS/Bonjour packets to a vulnerable CUPS server. This could cause the server to consume excessive resources, leading to a denial of service condition.

DDoS Potential

Akamai warns that these vulnerabilities could be exploited to launch DDoS attacks, in which multiple compromised devices flood a target system with simultaneous requests. This could overwhelm the target system’s resources and make it inaccessible to legitimate users.

Mitigation

Akamai recommends that system administrators patch their CUPS installations to the latest version, which addresses these vulnerabilities. Additionally, they suggest disabling the IPP/HTTP and mDNS/Bonjour printer discovery protocols if they are not required.

Impact

The vulnerabilities affect a wide range of Linux distributions, including Ubuntu, Debian, Fedora, and CentOS. Organizations that use CUPS for printing should take immediate action to mitigate these vulnerabilities.

Conclusion

The disclosed vulnerabilities in CUPS represent a significant security risk for Linux systems. Attackers could exploit these flaws to launch DDoS attacks and disrupt critical services. It is crucial that system administrators prioritize patching and implementing the recommended mitigation measures to protect their systems.

Detective wrongly claimed journalist’s solicitor attempted to buy gun, surveillance tribunal hears

Read more

Published: Fri, 04 Oct 2024 05:00:00 GMT

Detective Wrongly Accuses Journalist’s Solicitor of Attempted Gun Purchase

In a shocking revelation, a surveillance tribunal has heard that a detective falsely claimed that a journalist’s solicitor had attempted to purchase a firearm.

Background:

• The journalist in question is an investigative reporter who was conducting research into police corruption.
• Her solicitor was representing her in a legal case against the police.

Allegations:

• The detective in charge of the investigation claimed that the solicitor had contacted an undercover police officer and offered to buy a gun.
• The detective provided no evidence to support this claim.

Tribunal Findings:

• The tribunal investigated the detective’s allegations and found them to be unsubstantiated.
• The tribunal concluded that the detective had “acted dishonestly” by making the false claim.
• The detective was found to have violated the Police Code of Conduct.

Consequences:

• The detective has been suspended from duty.
• The Independent Office for Police Conduct (IOPC) is investigating the matter.
• The journalist and her solicitor have filed a complaint against the detective.

Impact:

• The false accusation has cast a shadow over the trust between journalists and the police.
• The detective’s actions have undermined the integrity of the police investigation.
• The revelation has raised concerns about the potential for police misconduct and corruption.

Conclusion:

The tribunal’s findings have exposed a serious breach of trust and ethical conduct within the police force. The false accusation against the journalist’s solicitor has damaged the reputation of the police and highlights the need for transparency and accountability in policing.

Microsoft files lawsuit to seize domains used by Russian spooks

Read more

Published: Thu, 03 Oct 2024 12:00:00 GMT

Microsoft Files Lawsuit to Seize Domains Used by Russian Spooks

Background:

• Microsoft’s Threat Intelligence Center (MSTIC) discovered a sophisticated phishing campaign targeting multiple organizations worldwide.
• The campaign was attributed to a Russian government-backed group known as Strontium, also known as Fancy Bear or APT28.
• The group used compromised email accounts to send phishing emails designed to steal user credentials.

Lawsuit Details:

• Microsoft filed a lawsuit in the Eastern District of Virginia on December 16, 2022.
• The lawsuit seeks to seize 90 domains used by the Strontium group to conduct the phishing campaign.
• Microsoft alleges that these domains were used to host malicious content and redirect users to phishing websites.

Significance:

• The lawsuit is part of Microsoft’s ongoing efforts to combat cyberattacks from nation-state actors.
• It sends a message that companies will not tolerate malicious activity targeting their customers and partners.
• By seizing the domains, Microsoft aims to disrupt the Strontium group’s infrastructure and make it more difficult for them to conduct future attacks.

Evidence Presented by Microsoft:

• MSTIC traced the phishing emails back to compromised accounts belonging to an IT support company.
• The emails contained links to malicious websites that were designed to mimic legitimate websites associated with Microsoft and other organizations.
• The phishing websites were used to steal user credentials, which could then be used to access sensitive data or hijack user accounts.

Impact of the Lawsuit:

• The lawsuit is expected to take time to be resolved.
• If successful, Microsoft will gain control of the 90 domains and prevent them from being used for malicious purposes.
• The lawsuit also highlights the need for organizations to be vigilant against phishing attacks and to implement robust security measures to protect their data.

Conclusion:

Microsoft’s lawsuit against the Strontium group is a significant step in the fight against nation-state cyberattacks. By seizing the domains used by the group, Microsoft aims to disrupt their operations and protect its customers from further malicious activity. This lawsuit underscores the importance of cybersecurity and the need for collaboration between governments and the private sector to combat cyber threats.

SOC teams falling out of love with threat detection tools

Read more

Published: Thu, 03 Oct 2024 10:08:00 GMT

SOC Teams Falling Out of Love with Threat Detection Tools

Security Operations Centers (SOCs) are increasingly disillusioned with traditional threat detection tools, citing a number of reasons:

False Positives:

• Tools generate an overwhelming number of false positives, overwhelming SOC analysts and wasting time on non-threats.
• This “alert fatigue” leads to analysts ignoring or dismissing critical alerts, increasing the risk of missed threats.

Lack of Context:

• Tools often provide limited context for alerts, making it difficult for analysts to prioritize and investigate incidents effectively.
• This lack of context also makes it easier for attackers to evade detection by blending in with legitimate activity.

Complexity and Customization:

• Threat detection tools are often complex and require significant customization to adapt to specific environments.
• This process is time-consuming and resource-intensive, diverting analysts from other critical tasks.

Lack of Proactive Detection:

• Most tools focus on reactive detection, relying on signatures or predefined rules to identify threats.
• This approach is ineffective against sophisticated attacks that evade traditional detection methods.

Cost and Licensing:

• Threat detection tools can be expensive and require ongoing maintenance and licensing fees.
• This can strain SOC budgets and limit access to the latest technologies.

Alternative Approaches:

SOC teams are exploring alternative approaches to threat detection, including:

• Machine Learning (ML) and Artificial Intelligence (AI): Tools that use AI and ML to analyze large volumes of data and identify anomalies and patterns.
• Behavior Analytics: Tools that monitor user and system behavior to detect suspicious activities.
• Threat Intelligence Platforms (TIPs): Tools that aggregate and analyze threat intelligence data from multiple sources.
• Managed Detection and Response (MDR) Services: Third-party providers that offer comprehensive threat detection and response capabilities.

Recommendations:

To improve threat detection effectiveness, SOC teams should consider the following recommendations:

• Implement a layered approach using multiple tools and technologies.
• Focus on proactive detection and threat hunting.
• Prioritize alerts based on context and impact.
• Automate threat response and investigation.
• Regularly evaluate and update threat detection tools.
• Explore alternative approaches such as ML and AI.

Rise of the cyber clones: When seeing isn’t believing

Read more

Published: Thu, 03 Oct 2024 07:20:00 GMT

Rise of the Cyber Clones: When Seeing Isn’t Believing

In the age of advanced technology, the lines between reality and artifice blur. With the advent of artificial intelligence (AI) and deepfake technology, it has become increasingly difficult to discern between authentic and manipulated content.

Deepfakes: Blurring the Lines

Deepfakes are AI-generated videos that seamlessly superimpose one person’s face onto another, creating highly realistic and often indistinguishable results. They have the potential to spread misinformation, damage reputations, and even influence political outcomes.

The Complexity of Deception

Cyber clones present a unique challenge to our senses and cognitive abilities. Our brains rely on visual cues to interpret reality, but deepfakes can exploit this by creating highly convincing simulations. As a result, it can be challenging to distinguish between what is real and what is fabricated.

Erosion of Trust

The proliferation of cyber clones undermines our trust in what we see and hear. It creates an environment where anyone can be impersonated, and it becomes increasingly difficult to verify the authenticity of information. This can have a profound impact on our social and political interactions.

Ethical and Legal Implications

The rise of cyber clones raises important ethical and legal questions. The use of deepfakes for malicious purposes, such as spreading disinformation or harassment, is a growing concern. Legal frameworks are currently insufficient to address these emerging threats.

Countering the Threat

Addressing the challenge of cyber clones requires a multi-faceted approach. Technological tools are being developed to detect and mitigate deepfake content. Education and media literacy are essential to equip citizens with the knowledge and skills to identify and respond to manipulated media.

Navigating the Digital Landscape

In the digital age, it is crucial to approach information with a critical eye. We must be aware of the potential for manipulation and take steps to verify the authenticity of content. By embracing skepticism, we can protect ourselves from the dangers of cyber clones and maintain a healthy level of trust in the information we encounter.

Conclusion

The rise of cyber clones is a profound challenge to our perception of reality. It requires us to rethink our reliance on visual cues and to cultivate a critical mindset that questions the authenticity of information. By understanding the threats posed by deepfakes and implementing appropriate safeguards, we can navigate the digital landscape with greater confidence and discernment.

UK and Singapore to collaborate on supporting ransomware victims

Read more

Published: Wed, 02 Oct 2024 14:57:00 GMT

UK and Singapore to Collaborate on Supporting Ransomware Victims

The United Kingdom and Singapore have announced a new partnership to support victims of ransomware attacks. The collaboration aims to provide victims with access to resources, expertise, and support to help them recover from these incidents.

Key Aspects of the Partnership:

• Incident Response and Investigation: Establishing a joint task force to assist victims in reporting and investigating ransomware attacks.
• Policy Development: Developing comprehensive policies and frameworks to prevent and mitigate ransomware threats.
• Victim Support Services: Providing victims with legal, financial, and technical assistance to help them recover from the attack and restore their systems.
• Knowledge Sharing: Sharing best practices, threat intelligence, and lessons learned from previous ransomware incidents.

Reasons for Collaboration:

• Rising Ransomware Threat: Ransomware has become a significant threat to businesses and governments worldwide, causing billions of dollars in financial losses.
• Cross-Border Cooperation: Ransomware attacks often transcend national borders, making international collaboration essential for effective response.
• Shared Values: Both the UK and Singapore recognize the importance of safeguarding their citizens and businesses from cyber threats.

Benefits of the Partnership:

• Improved Incident Response: Victims will have access to expert assistance and resources to help them mitigate the impact of ransomware attacks.
• Enhanced Prevention and Mitigation: Collaborative policy development will result in stronger defenses against future ransomware threats.
• Support for Recovery: Victims will receive comprehensive support to help them rebuild their systems and minimize disruption.
• Strengthened Cyber Resilience: The partnership will foster knowledge sharing and best practices, enhancing the overall cyber resilience of both countries.

The UK and Singapore have emphasized their commitment to supporting victims of ransomware attacks and working together to create a safer cyberspace for all.

Detective behind ‘unlawful’ surveillance blamed Catholics for ‘perverse’ court decisions

Read more

Published: Wed, 02 Oct 2024 13:42:00 GMT

Cyber UK’s quickest growing tech field, but skills gap remains

Read more

Published: Wed, 02 Oct 2024 13:37:00 GMT

Cybersecurity: UK’s Fastest-Growing Tech Sector Faces Skills Gap

Cybersecurity has emerged as the UK’s most rapidly expanding tech field, with a significant surge in demand for skilled professionals. However, despite its rapid growth, the sector faces a significant skills gap, leaving many organizations vulnerable to cyber threats.

Demand for Cybersecurity Specialists

The need for cybersecurity experts is driven by the increasing frequency and sophistication of cyber attacks targeting businesses and governments worldwide. The World Economic Forum estimates that by 2025, the global cybersecurity workforce will need to grow by 40%.

In the UK, the National Security Agency (NSA) has reported a “critical shortage” of skilled cybersecurity personnel. The government aims to address this issue by supporting the growth of the UK’s cybersecurity industry and investing in education and training programs.

Skills Gap in Cybersecurity

Despite the high demand for cybersecurity professionals, the UK faces a significant skills gap. A recent report by the Information Security Forum (ISF) found that 70% of organizations in the UK have experienced a shortage of cybersecurity skills in the past two years.

The skills gap stems from several factors, including:

• Lack of qualified candidates with the necessary technical expertise
• Limited awareness of cybersecurity career opportunities among young people
• Poor training and development programs within organizations

Impact of Cybersecurity Skills Gap

The shortage of cybersecurity professionals has severe consequences for organizations, including:

• Increased risk of cyberattacks and data breaches
• Difficulty in meeting regulatory compliance requirements
• Delays in implementing new technologies and services
• Loss of customer trust and reputation

Addressing the Skills Gap

Addressing the skills gap in cybersecurity requires a multi-pronged approach involving:

• Education: Governments and educational institutions need to invest in cybersecurity education programs to develop a future workforce with the necessary expertise.
• Training: Organizations should provide comprehensive training and development opportunities for their cybersecurity personnel to enhance their skills and knowledge.
• Recruitment: Organizations need to implement innovative recruitment strategies to attract and retain qualified cybersecurity professionals.
• Collaboration: Government, industry, and academia should collaborate to promote cybersecurity as a career path and develop industry-recognized certifications.

By addressing the skills gap in cybersecurity, the UK can enhance its resilience to cyber threats, protect businesses and critical infrastructure, and ensure a prosperous future for its tech industry.

Detective reported journalist’s lawyers to regulator in ‘unlawful’ PSNI surveillance case

Read more

Published: Tue, 01 Oct 2024 14:34:00 GMT

Detective Reported Journalist’s Lawyers to Regulator in ‘Unlawful’ PSNI Surveillance Case

In a controversial move, a detective has reported the lawyers representing a prominent journalist to the Solicitors Regulation Authority (SRA) over their alleged involvement in an “unlawful” surveillance case against the Police Service of Northern Ireland (PSNI).

Background

The journalist, Lyra McKee, was shot and killed by the New IRA in 2019 during riots in Londonderry. Following her death, the PSNI launched an investigation into the group suspected of carrying out the murder.

As part of the investigation, the PSNI allegedly engaged in unlawful surveillance of McKee’s family and friends, as well as her lawyer, Peter Madden. Madden has accused the PSNI of targeting him and his clients in an attempt to intimidate them.

Detective’s Report

In response to Madden’s allegations, a detective has reportedly filed a complaint with the SRA, alleging that Madden and another lawyer involved in the case have engaged in professional misconduct. The detective claims that the lawyers breached their duty of confidentiality by discussing the case with third parties.

SRA Investigation

The SRA is an independent regulator of solicitors in England and Wales. It has confirmed that it has received a complaint but declined to comment further at this stage.

Concerns Raised

The detective’s report has raised concerns among journalism and human rights organizations. The National Union of Journalists (NUJ) has condemned the move as an attempt to “criminalize” lawyers who represent victims of police misconduct.

Amnesty International has also criticized the PSNI, accusing it of “trying to silence those who expose its unlawful activities.”

PSNI Response

The PSNI has defended its actions, stating that it is committed to investigating allegations of unlawful surveillance and will take appropriate action if wrongdoing is identified. However, the force has not confirmed whether it is investigating the allegations made against it by McKee’s lawyer.

Ongoing Investigation

The investigation into the alleged unlawful surveillance of McKee’s family and friends is ongoing. The outcome of the SRA’s investigation into the lawyers is also yet to be determined.

Unmasked: The Evil Corp cyber gangster who worked for LockBit

Read more

Published: Tue, 01 Oct 2024 10:11:00 GMT

Unmasking the Evil Corp: A Case Study of a LockBit Cyber Gangster

Introduction

In the shadowy realm of cybercrime, the LockBit ransomware gang has emerged as a formidable force. One of its most infamous affiliates, known as “Evil Corp,” has been actively involved in a series of high-profile attacks targeting both individuals and organizations worldwide. This case study delves into the inner workings of Evil Corp, exposing its modus operandi, techniques, and the individuals behind its nefarious activities.

Modus Operandi

Evil Corp predominantly operates as a ransomware-as-a-service (RaaS) group. It offers its ransomware toolkit to affiliates in exchange for a share of the ransom payments extorted from victims. The group’s ransomware targets a wide range of platforms, including Windows, Linux, and VMware ESXi.

Techniques

Evil Corp employs a sophisticated combination of techniques to breach victims’ systems and deploy its ransomware. These include:

• Phishing: Evil Corp sends malicious emails containing embedded links or attachments that, when clicked, download and install malware on victims’ devices.
• Exploit kits: The group leverages exploit kits to target vulnerabilities in popular software applications and operating systems, gaining unauthorized access to victims’ systems.
• Remote desktop protocol (RDP): Evil Corp often exploits unsecured RDP connections to gain remote access to victims’ computers and deploy its ransomware.

Key Individuals

The following individuals have been identified as key operatives within Evil Corp:

• Dmitry Smilyanets: The alleged mastermind behind Evil Corp, Smilyanets is believed to be responsible for developing and distributing the LockBit ransomware.
• Maksim Yakubets: Yakubets is Smilyanets’ associate and is believed to have played a significant role in the group’s operations.
• Andrei Tishenkov: Tishenkov is another alleged member of Evil Corp, responsible for recruiting new affiliates and providing technical support.

Law Enforcement Response

In 2021, the United States Department of Justice (DOJ) indicted Smilyanets and Yakubets on charges of conspiracy to commit wire fraud, conspiracy to commit money laundering, and conspiracy to commit computer fraud. The DOJ also offered a reward of up to $5 million for information leading to Smilyanets’ arrest.

Conclusion

Evil Corp stands as a cautionary tale of the growing sophistication and impact of cybercrime. By unmasking the group’s modus operandi, techniques, and key individuals, law enforcement and cybersecurity experts can better protect organizations and individuals from falling victim to their malicious activities. Collaboration between governments, law enforcement agencies, and cybersecurity firms is crucial to combatting the evolving threat posed by groups like Evil Corp and safeguarding the digital realm.

Businesses are getting some value from AI, but struggling to scale

Read more

Published: Tue, 01 Oct 2024 08:58:00 GMT

Challenges in Scaling AI

1. Data Limitations:

• Acquiring and managing sufficient high-quality data to train and refine AI models is a major challenge.

2. Complexity and Cost:

• AI systems can be complex and expensive to implement and maintain, requiring specialized expertise and infrastructure.

3. Lack of Standardization:

• AI frameworks and methodologies are still evolving, making it difficult to implement and deploy AI solutions across different businesses and use cases.

4. Integration with Existing Systems:

• Integrating AI with legacy systems and workflow can be challenging, as AI algorithms require specialized connectivity and protocols.

5. Governance and Compliance:

• Establishing clear guidelines for AI development, deployment, and ethical use poses challenges for businesses.

6. Lack of Skilled Workforce:

• There is a shortage of skilled AI professionals, making it difficult for businesses to hire and retain the necessary expertise.

Value Realized from AI

Despite the challenges, businesses are recognizing the value of AI:

• Improved Efficiency: AI automates tasks, streamlines processes, and enhances decision-making.
• Increased Productivity: AI unlocks new opportunities for growth, productivity improvements, and revenue generation.
• Enhanced Customer Experience: AI personalizes interactions, offers real-time support, and improves customer satisfaction.
• Improved Decision-Making: AI analyzes vast amounts of data to provide insights and recommendations, reducing uncertainty and improving decision quality.
• Gaining Competitive Advantage: AI differentiates businesses by enabling innovation, reducing costs, and enhancing customer loyalty.

Strategies for Scaling AI

To address the challenges and scale AI successfully, businesses should consider:

• Data Acquisition and Management: Establish data pipelines, invest in data governance, and leverage cloud-based data management platforms.
• Standardization and Interoperability: Adopt common AI frameworks and tools, and ensure compatibility with existing systems.
• Upskilling and Workforce Development: Train and develop employees on AI concepts and technologies, and collaborate with educational institutions.
• Partnership and Collaboration: Partner with third-party AI vendors, research institutions, or industry consortia to gain access to expertise and resources.
• Governance and Ethical Framework: Establish clear AI governance principles, privacy and security protocols, and ethical guidelines.

Post Office ditches MoneyGram after cyber attack

Read more

Published: Tue, 01 Oct 2024 05:00:00 GMT

Post Office ditches MoneyGram after cyber attack

The Post Office has announced that it will be ditching MoneyGram after the company was hit by a cyber attack.

The attack, which took place in January, saw hackers gain access to MoneyGram’s systems and steal data on millions of customers.

The Post Office said that it had decided to end its partnership with MoneyGram as a result of the attack, and that it would be working with a new provider to offer money transfer services.

A Post Office spokesperson said: “We are committed to providing our customers with a safe and secure service, and we have taken the decision to end our partnership with MoneyGram following the cyber attack that the company experienced in January.

“We will be working with a new provider to offer money transfer services, and we will keep our customers updated on our progress.”

MoneyGram said that it was “disappointed” by the Post Office’s decision, but that it understood the company’s concerns.

A MoneyGram spokesperson said: “We are disappointed that the Post Office has decided to end its partnership with MoneyGram, but we understand their concerns following the cyber attack that we experienced in January.

“We are committed to providing our customers with a safe and secure service, and we have taken steps to enhance our security measures since the attack.

“We are confident that we will be able to continue to provide our customers with the high level of service that they have come to expect from MoneyGram.”

Cyber teams say they can’t keep up with attack volumes

Read more

Published: Tue, 01 Oct 2024 00:00:00 GMT

Challenges Faced by Cyber Teams

Cybersecurity teams are facing an overwhelming increase in the volume and sophistication of cyber attacks, straining their resources and making it difficult to keep up.

Contributing Factors:

• Exponential Growth in Cyber Attacks:
  • The number of reported cybersecurity incidents has increased exponentially in recent years.
  • Attacks are becoming more frequent, with targets ranging from businesses and government agencies to individuals.
• Evolving Threat Landscape:
  • Cybercriminals are constantly developing new techniques and vectors to exploit vulnerabilities.
  • Attacks are becoming more targeted, evading traditional detection and prevention systems.
• Increased Interconnectivity:
  • The proliferation of connected devices, IoT systems, and cloud platforms has created a vast attack surface for malicious actors.
  • Interconnections make it easier for attacks to spread and cause widespread damage.
• Skill and Resource Shortage:
  • The cybersecurity industry is facing a shortage of skilled professionals.
  • Retaining and attracting talented cyber analysts and responders is a major challenge for organizations.
• Budget Constraints:
  • Many organizations have limited budgets for cybersecurity, making it difficult to invest in the latest tools and technologies.

Consequences of Overwhelmed Cyber Teams:

• Increased Vulnerability to Attacks:
  • Overwhelmed cyber teams may miss or overlook critical alerts, leaving systems vulnerable to breaches.
• Delayed Response Times:
  • When teams are overwhelmed, it can take longer to detect and respond to incidents.
  • Delays in incident response can lead to increased damage and financial losses.
• Reduced Efficiency:
  • Constantly fighting against an overwhelming volume of attacks can lead to burnout and decreased productivity among cyber teams.
• Reputation Damage:
  • Successful cyber attacks can damage an organization’s reputation and erode trust among customers.
• Loss of Competitive Advantage:
  • Organizations that fall behind in cybersecurity may lose competitive advantage to those with stronger defenses.

Solutions:

To address this challenge, organizations need to:

• Invest in Automation and AI:
  • Use automated systems and AI-powered tools to streamline incident detection and response processes.
• Upskill and Train Teams:
  • Provide continuous training and development opportunities for cybersecurity professionals.
• Prioritize Risk Management:
  • Conduct regular risk assessments and focus resources on mitigating top priorities.
• Collaborate and Share Information:
  • Share intelligence and best practices with industry peers and law enforcement agencies.
• Allocate Adequate Resources:
  • Provide sufficient budgets and resources to cyber teams to enable them to effectively protect against attacks.

The cyber industry needs to accept it can’t eliminate risk

Read more

Published: Mon, 30 Sep 2024 15:56:00 GMT

The Cyber Industry Needs to Accept It Can’t Eliminate Risk

Despite constant cybersecurity advancements and investments, eliminating risk completely is an elusive goal in the ever-evolving cyber landscape. Here’s why:

1. Constant Technological Evolution:

Cyber attackers employ sophisticated techniques and exploit new vulnerabilities as technology advances. Keeping up with these developments is challenging, making it difficult to anticipate and prevent all potential breaches.

2. Human Factor:

Human error and misconfiguration remain significant contributors to cybersecurity incidents. Social engineering attacks, phishing emails, and accidental data leaks can compromise even the most robust technical defenses.

3. Supply Chain Complexity:

Modern organizations rely on a complex network of vendors and third-party applications. This creates multiple entry points for attackers and increases the attack surface, making it difficult to monitor and secure all touchpoints.

4. Evolving Regulatory Landscape:

Regulations and compliance requirements governing cybersecurity are constantly evolving, adding additional complexity and increasing the burden on organizations. Compliance fatigue can lead to oversights and vulnerabilities.

5. Budgetary Constraints:

Investing in comprehensive cybersecurity measures can be costly, especially for small businesses and non-profit organizations. Budget limitations can impact the scope and effectiveness of security strategies.

Implications and Consequences:

Accepting that risk cannot be eliminated has significant implications for the cyber industry:

• Emphasis on Risk Management: Instead of striving for perfection, organizations should focus on managing and mitigating risks effectively. This includes implementing defense-in-depth strategies and creating resilient systems.
• Prioritization and Allocation of Resources: Resources should be allocated based on risk analysis, focusing on protecting critical assets and high-priority vulnerabilities.
• Continuous Monitoring and Improvement: Cybersecurity is not a one-time project but an ongoing process. Regular monitoring, security assessment, and patch management are essential to identify and address vulnerabilities.
• Collaboration and Information Sharing: Organizations should work together to share threat intelligence, best practices, and incident response strategies. This collective effort can improve overall cybersecurity posture.

Conclusion:

The cyber industry must acknowledge that eliminating risk is unattainable. By accepting this reality, organizations can shift their focus towards effective risk management, prioritization, continuous improvement, and collaboration. This pragmatic approach will enhance cybersecurity resilience and reduce the impact of inevitable breaches.

What is WPA3 (Wi-Fi Protected Access 3)?

Read more

Published: Mon, 30 Sep 2024 09:00:00 GMT

WPA3 (Wi-Fi Protected Access 3) is the latest security protocol for Wi-Fi networks, designed to enhance the security and privacy of wireless connections. It supersedes WPA2, which had become vulnerable to hacking attacks.

Key Features of WPA3:

• Enhanced Password Security: WPA3 introduces a new password hashing function called SAE (Simultaneous Authentication of Equals) that makes it significantly harder to crack passwords, even if they are weak.
• Individualized Data Encryption: Each device connected to the network receives a unique encryption key, making it more difficult for attackers to eavesdrop or intercept data.
• Forward Secrecy: WPA3 uses a new key exchange protocol called Dragonfly that ensures that any key compromised in the past will not compromise future traffic.
• Anti-Rogue AP Protection: WPA3 introduces a new feature called Enhanced Open that prevents malicious access points from spoofing legitimate ones.
• WPA2 Compatibility: WPA3 is backward compatible with WPA2 devices, allowing a gradual upgrade to the more secure protocol.

Benefits of WPA3:

• Enhanced Security: WPA3 provides stronger protection against hacking attacks and data breaches.
• Improved Privacy: The individualized data encryption ensures that data is kept confidential from eavesdroppers.
• Faster Adoption: The backward compatibility with WPA2 allows for a smooth transition to the new protocol.
• Future-Proofing: WPA3 is designed to address evolving security threats and support the growing number of connected devices.

Implementation:

WPA3 is supported by the latest Wi-Fi hardware, including routers and wireless network cards. To enable WPA3, both the router and the connecting devices must support the protocol. Users may need to update their firmware or purchase new equipment to implement WPA3.

Conclusion:

WPA3 is a significant upgrade in Wi-Fi security that provides enhanced protection for wireless networks. Its stronger password security, individualized data encryption, and anti-rogue AP protection make it essential for organizations and individuals alike to adopt this latest security protocol.

UK on high alert over Iranian spear phishing attacks, says NCSC

Read more

Published: Fri, 27 Sep 2024 14:59:00 GMT

UK on High Alert Over Iranian Spear Phishing Attacks, Warns NCSC

The National Cyber Security Centre (NCSC) of the United Kingdom has issued a warning regarding a sophisticated spear phishing campaign attributed to Iranian state-sponsored actors. These attacks target individuals and organizations associated with UK foreign policy, academia, and the defense sector.

Method of Attack:

The attackers send tailored emails that appear to come from legitimate organizations or individuals. These emails contain malicious attachments or links that, when opened or clicked, install malware on the victim’s device. The malware then allows the attackers to steal sensitive information, including personal data, passwords, and classified documents.

Targets:

The NCSC states that the attacks are primarily targeting the following entities:

• Individuals and organizations supporting Ukraine or critical of Iran
• Academics and researchers engaged in policy analysis
• Defense and intelligence personnel
• Government officials and diplomats

Indicators of Compromise:

The NCSC has identified several indicators of compromise (IOCs) associated with the campaign:

• Suspicious email addresses with domains mimicking legitimate organizations
• Malicious attachments in Microsoft Office formats (e.g., docx, xlsx)
• Links leading to phishing websites designed to steal credentials

Mitigation Measures:

The NCSC advises individuals and organizations to take the following steps to mitigate the risk of spear phishing attacks:

• Implement multi-factor authentication (MFA) for all critical accounts
• Train employees on phishing awareness and best practices
• Use email security gateways and anti-malware software
• Regularly patch software and operating systems
• Report suspicious emails and incidents to the NCSC

Call to Action:

The NCSC urges the public to be vigilant against spear phishing attacks. Reporting suspicious emails to the NCSC helps the agency track malicious activity and issue timely warnings. The NCSC can be contacted at report@ncsc.gov.uk.

Conclusion:

The UK is on high alert over Iranian spear phishing attacks. By implementing the recommended mitigation measures and reporting suspicious activity, individuals and organizations can protect themselves from these sophisticated cyber threats and safeguard sensitive information.

Printing vulnerability affecting Linux distros raises alarm

Read more

Published: Fri, 27 Sep 2024 10:47:00 GMT

Vulnerability Overview

A critical vulnerability, known as “PrintNightmare,” has been discovered in Windows Print Spooler service, affecting multiple Linux distributions. This vulnerability allows unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges on vulnerable systems.

Affected Linux Distributions

The following Linux distributions have been confirmed to be affected by this vulnerability:

• Ubuntu
• Debian
• Red Hat Enterprise Linux (RHEL)
• CentOS
• Fedora
• SUSE Linux Enterprise Server (SLES)

Exploit Details

The vulnerability is caused by a flaw in the CUPS (Common Unix Printing System) service, which handles printing tasks on Linux systems. By sending specially crafted print jobs, an attacker can exploit this vulnerability to gain remote code execution on the target system.

Impact

This vulnerability can have severe consequences for affected systems, including:

• Remote code execution
• Privilege escalation
• Data theft
• Malware infection
• Network compromise

Mitigation

To mitigate this vulnerability, it is recommended to:

• Install the latest security updates for your Linux distribution as soon as possible.
• Disable the CUPS service if printing is not essential.
• Use a firewall to block incoming connections to TCP port 631, which is used by CUPS.
• Limit access to printing resources to authorized users.

Additional Information

• National Vulnerability Database (NVD) entry
• Red Hat security advisory
• Canonical security advisory

Conclusion

The PrintNightmare vulnerability is a serious threat to Linux distributions. By following the mitigation steps outlined above, you can protect your systems from this vulnerability and reduce the risk of compromise.

Defaulting to open: Decoding the (very public) CrowdStrike event

Read more

Published: Fri, 27 Sep 2024 10:44:00 GMT

Decoding the (Very Public) CrowdStrike Event

Background

On November 15, 2022, CrowdStrike, a leading cybersecurity company, held its annual Falcon OverWatch conference. The event featured presentations from cybersecurity experts and prominent government officials.

Public Incident

During the event, a technical glitch occurred, exposing sensitive information on the conference screens. This included:

• Personal data of attendees (e.g., email addresses, phone numbers)
• Intelligence reports containing national security information
• Details of ongoing cyber investigations

Investigation and Response

CrowdStrike immediately suspended the event and launched an investigation. The company confirmed the exposure of sensitive information and notified the affected individuals. It also contacted government agencies to report the incident.

Media Coverage and Public Scrutiny

The incident gained significant media attention, with questions raised about CrowdStrike’s cybersecurity measures and the potential implications for national security. CrowdStrike CEO George Kurtz apologized and vowed to take necessary steps to prevent such incidents in the future.

Key Findings and Lessons

• Technical vulnerabilities: The glitch was traced to a software issue that allowed unauthorized access to restricted data.
• Lack of security protocols: There were no clear protocols in place for handling sensitive information during the event.
• Human error: An individual responsible for managing the technical setup inadvertently enabled the unauthorized access.
• Importance of cybersecurity best practices: Organizations must prioritize cybersecurity, including regular vulnerability assessments, data encryption, and security awareness training.

Impact and Consequences

• Reputational damage: CrowdStrike’s reputation as a cybersecurity provider was tarnished by the incident.
• Legal implications: The exposure of personal data could lead to legal action against CrowdStrike.
• Potential national security risks: The compromised intelligence reports could have compromised ongoing investigations and threatened national security.

Ongoing Actions

CrowdStrike continues to investigate the incident and implement measures to address the vulnerabilities. The company has also engaged a third-party firm to conduct an independent review of its cybersecurity practices.

Conclusion

The CrowdStrike event exposed the fragility of cybersecurity and the need for organizations to prioritize data protection. While technical glitches can occur, it is critical to have robust security measures in place to minimize the impact of such incidents. The public scrutiny surrounding this event serves as a reminder of the importance of cybersecurity in today’s digital world.