Cybersecurity

Since version 76 (current version is 80), Google Chrome no longer displays the “https” and subdomain “www” to users in the address bar. A “feature” that miscreants are taking advantage to compromise legitimate websites with credit card and login skimming malware. Unfortunately, a PLC vendor in Spain reportedly fell victim to this technique that enabled skimming code to be injected into its website. This recent scheme, as reported by journalist Brian Krebs, uses the domain “htt.ps” to trick users into thinking they are seeing the “https://” they have been taught to look for.

CISA advises that Microsoft has released a security advisory to address a remote code execution vulnerability (CVE-2020-0796) in Microsoft Server Message Block 3.1.1 (SMBv3). A remote attacker can exploit this vulnerability to take control of an affected system. SMB is a network file-sharing protocol that allows client machines to access files on servers.

March 10, 2020

CISA has updated this advisory with additional information on the affected products. Read the advisory at CISA.

February 11, 2020

CISA has updated this advisory with additional information on the affected products and mitigating measures. Read the advisory at CISA.

January 14, 2020

During the recent RSA cybersecurity conference, Microsoft engineers said that 99.9 percent of the compromised accounts they’ve tracked don’t use multi-factor authentication (MFA). In most cases, the account hacks happen through simplistic attacks, which MFA is typically effective against. The primary sources of most hacks of Microsoft accounts was password spraying, when an attacker picks a common and easy-to-guess password, and goes through a long list of usernames until they get a hit and can access an account using said password.