You are here

Home » Cybersecurity

Cybersecurity

Building a Digital Defense with Mobile Apps

The FBI’s Portland, Oregon office has published an advisory discussing best practices for mobile apps, such as those used for messaging, banking, gaming, and more. Some of these apps might have legitimate work functions and been vetted by an organization for use. In workplaces where employees are allowed to connect their personal devices to business networks, other apps are likely being accessed. If these other apps have vulnerabilities, that constitutes a vulnerability for the network.

When Technology Fails, It’s Up to Users to Stop the Spread of Malware – Coronavirus News Themed Malware Evading Detection

Malware authors are really good at modifying malware code to evade detection by antivirus and other security products, including artificial intelligence and machine learning security engines. They also predictably incorporate trending news for their lures. So it comes as no surprise that miscreants are currently using coronavirus-themed news to bypass detection technologies. Specifically, BleepingComputer recently observed Emotet and TrickBot samples using strings from actual CNN news stories in their malware files.

Delta Electronics Industrial Automation CNCSoft ScreenEditor (ICSA-20-077-01)

CISA has published an advisory on stack-based buffer overflow and out-of-bounds read vulnerabilities in Delta Electronics Industrial Automation CNCSoft ScreenEditor. Versions 1.00.96 and prior are affected. Successful exploitation of these vulnerabilities could cause buffer overflow conditions that may allow information disclosure, remote code execution, or crash the application. Delta recommends updating to the latest version of CNCSoft v1.01.24 (with ScreenEditor v1.00.98) and restricting the interaction with the application to trusted files.

Most Ransomware Attacks Take Place at Night or over the Weekend

According to a report just published by cybersecurity company FireEye, 76 percent of all ransomware infections occur outside working hours, with 49 percent taking place during nighttime over the weekdays and 27 percent taking place over the weekend. The reason why attackers choose to trigger the ransomware encryption process during the night or weekend is because most companies don't have IT staff working those shifts, and if they do, they are most likely short-handed.

Microsoft Releases Out-of-Band Security Updates for Server Message Block RCE Vulnerability

CISA advises that Microsoft has released out-of-band security updates to address a remote code execution vulnerability (CVE-2020-0796) in Microsoft Server Message Block 3.1.1 (SMBv3). A remote attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review the resources and apply the necessary updates or workarounds. Read the advisory at CISA.

Rockwell Automation Allen-Bradley Stratix 5950 (ICSA-20-072-03)

CISA has published an advisory on an improper access control vulnerability in Allen-Bradley Stratix 5950. Versions 1783-SAD4T0SBK9, 1783-SAD4T0SPK9, 1783-SAD2T2SBK9, and 1783-SAD2T2SPK9 are affected. Successful exploitation of this vulnerability could allow an attacker to write a modified image to the component. Rockwell Automation recommends users update to firmware version FRN v6.4.0 , which addresses the reported vulnerability. It has also provided a series of general security guidelines. CISA also recommends a series of measures to mitigate the vulnerabilities.

ABB Asset Suite (ICSA-20-072-02) – Product Used in the Energy Sector

CISA has published an advisory on an authorization bypass through user-controlled key vulnerability in ABB Asset Suite. Versions 9.6 and prior, excluding 9.4.2.6 and 9.5.3.2, are affected. Successful exploitation of this vulnerability could allow an attacker access to unauthorized information in the application by direct resource access. ABB recommends users apply updates as soon as they are able. CISA also recommends a series of measures to mitigate the vulnerabilities.

ABB eSOMS (ICSA-20-072-01) – Product Used in the Energy Sector

CISA has published an advisory on numerous vulnerabilities in ABB eSOMS. Versions 6.02 and prior are affected. In the most severe case, an attacker who successfully exploited these vulnerabilities could take over a user’s browser session, discover session-based information, or affect the confidentiality of sensitive information within the application. ABB recommends users update their version of eSOMS to 6.0.3 or 6.1. CISA also recommends a series of measures to mitigate the vulnerabilities.

Building a Digital Defense with Browsers

The FBI’s Portland, Oregon office has published an advisory discussing best practices for web browsers, which are essential for operations in any organization but can serve as openings through which bad actors intrude into systems. Noting that the browsers that are available have different levels of privacy and security, the advisory encourages organizations spend time researching browsers to figure out which one meets their needs and expectations. Once a browser is selected, however, default settings can still leave an organization vulnerable.

Pages

Subscribe to Cybersecurity