You are here

Home » Cybersecurity

Cybersecurity

FBI IC3 Reflects on Trends over 20 Year History

In a posting notifying partners that it is marking its twentieth anniversary, the FBI’s Internet Crime Complaint Center (IC3) reflects on how cyber crime has evolved over the course of its history. In its first full year of operation, the IC3 logged nearly 50 complaints. Most of them revolved around internet auction fraud, non-delivery scams, and the infamous messages from alleged princes or princesses with untapped fortunes they wanted to share with recipients. Average losses for victims were low, compared to today’s numbers (in 2001, the average victim lost $435).

Sodinokibi Ransomware Can Now Encrypt Open and Locked Files

When a file is open or locked, most ransomware applications can’t encrypt them without first shutting down the process involved. Applications like database or mail servers lock open files so that other programs can’t modify them. The lock prevents data from being corrupted by two processes writing to a file at the same time. But now the Sodinokibi (aka REvil) ransomware has a new feature for terminating processes that have locked a file, meaning it can encrypt such a file.

New Information on North Korean Malicious Cyber Activity

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Defense have provided new information on malicious cyber activity by the North Korean government. In three new Malware Analysis Reports (MARs), these agencies discuss and provide technical information for three malware variants used by the North Korean government: COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH. In addition to providing malware descriptions, the MARs contain suggested response actions and recommended mitigation techniques.

Advantech WebAccess Node (ICSA-20-128-01) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on improper validation of array index, relative path traversal, SQL injection, stack-based buffer overflow, heap-based buffer overflow, and out-of-bounds read vulnerabilities in Advantech WebAccess Node. Versions 9.0.0 and 8.4.4 and prior are affected. Successful exploitation of these vulnerabilities may allow information disclosure, remote code execution, and compromise system availability. Advantech has released updated versions of the affected products to address the vulnerabilities.

Fazecast jSerialComm (ICSA-20-126-01)

CISA has published an advisory on an uncontrolled search path element vulnerability in Fazecast jSerialComm. Versions 2.2.2 and prior of jSerialComm and versions 1.5.x, 1.6.x, and 1.7.x of EcoStruxure IT Gateway are affected. Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on a targeted system. Fazecast recommends users update jSerialComm to Version 2.3 or later. Schneider Electric recommends users upgrade EcoStruxure IT Gateway to Version 1.8.1 or later.

SAE IT-systems FW-50 Remote Telemetry Unit (RTU) (ICSA-20-126-02) – Product Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on cross-site scripting and path traversal vulnerabilities in SAE IT-systems FW-50 Remote Telemetry Unit (RTU). FW-50 RTU, Series: 5 Series; CPU-type: CPU-5B; Hardware Revision: 2; CPLD Revision: 6 is affected. Successful exploitation of these vulnerabilities may allow an attacker to execute remote code, disclose sensitive information, or cause a denial-of-service condition. SAE IT-systems has provided options for addressing these vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.

The Importance of Business Continuity Planning

COVID-19 forced some organizations to exercise a business continuity plan that may not have formally existed prior to the pandemic. With the current pandemic running its course and activities still fresh in our minds, there is no better time than the present to formalize or refresh organizational business continuity and preparedness plans. OT security firm Applied Risk highlights some business continuity best practices and key activities for critical infrastructure entities.

CISA Alert: APT Groups Target Essential Services during COVID-19 Pandemic

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published a joint Alert with its U.K. counterpart, the National Cyber Security Centre (NCSC), warning that they continue to see indications advanced persistent threat (APT) groups are exploiting the COVID-19 pandemic. Although the Alert highlights activity by these actors against the healthcare sector, it also notes that other sectors, especially those that provide essential services during the pandemic, are being targeted. Targeted sectors include those associated with local governments.

Pages

Subscribe to Cybersecurity