The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published a Trust in Smart City Systems report. It is intended to serve as a resource guide for discussions between smart city decision-makers, designers, and implementers during the initial, high-level design of a smart city project and make decisions based on a more complete understanding of the tradeoffs.
CISA has published an advisory on a cleartext transmission of sensitive information vulnerability in Honeywell ControlEdge PLC and RTU. ControlEdge PLC R130.2, R140, R150, and R151 and ControlEdge RTU R101, R110, R140, R150, and R151 are affected. Successful exploitation of these vulnerabilities could allow an attacker to obtain passwords and session tokens. Honeywell provided detailed information for mitigation on the insecure communication in Control Edge PLC\RTU, available in a support document. CISA also recommends a series of measures to mitigate the vulnerability.
Australians reported 167,797 scams to the Australian Competition and Consumer Commission (ACCC)-controlled Scamwatch in 2019, a 34 percent increase over the year prior. The financial impact in 2019 to Australians was just over $634 million (in Australian dollars). The greatest losses in 2019 by type of scam were: $132 million to business email compromise (BEC) scams, $126 million to investment scams, and $83 million lost to dating and romance scams.
The Cybersecurity and Infrastructure Security Agency (CISA) is passing through an Australian Cyber Security Centre ASCS Advisory 2020-008 regarding what it believes to be a sustained cyber attack against Australian government and commercial networks involving “copy-paste compromises.” While the attack is being attributed to a sophisticated state-based threat actor, the methods being used are described as nothing mo
Microsoft has released security updates to address a vulnerability in Windows 10 version 1903. An attacker could exploit this vulnerability to overwrite or modify a protected file and gain elevated privileges. CISA encourages users and administrators to review Microsoft’s Security Advisory for CVE-2020-1441 and apply the necessary updates.
On Friday, June 19, 2020, an Anonymous-aligned hacktivist group Distributed Denial of Secrets (DDoSecrets) published nearly 270GB of data stolen from technology service provider Netsential. DDoSecrets is a WikiLeaks-style organization that describes itself as a “transparency collective” whose goal is the “free transmission of data in the public interest” and Netsential manages portals for content delivery and membership for many law enforcement organizations, including police departments, fusion centers, and the FBI.
Researchers have the right to dub malware findings whatever they want, but in doing so it seems prudent to avoid possible confusion with previous activity similarly named.
Earlier this week cybersecurity experts revealed 19 vulnerabilities in a small library developed by software company Treck that has been widely used and integrated into many enterprise and consumer-grade products over the last 20+ years.
CISA has published an advisory on out-of-bounds write, deserialization of untrusted data, and code injection vulnerabilities in ICONICS GENESIS64, GENESIS32 The following products using GenBroker64, Platform Services, Workbench, FrameWorX Server; v10.96 and prior are affected: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI. The following products using GenBroker32 v9.5 and prior are affected: GENESIS32 and BizViz. Successful exploitation of these vulnerabilities may allow remote code execution or denial of service. ICONICS is releasing a patch for the affected products.
CISA has published an advisory on out-of-bounds write, deserialization of untrusted data, and code injection vulnerabilities in Mitsubishi Electric MC Works64, MC Works32. For MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions are affected. MC Works32 Version 3.00A (9.50.255.02) is also affected. Successful exploitation of these vulnerabilities may allow remote code execution, a denial-of-service condition, information disclosure, or information tampering. Mitsubishi Electric recommends updating to the latest software version or applying security patches.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
