Cybersecurity

The NCCIC has released an advisory on OS command injections, improper access control, and insufficiently protected credentials vulnerabilities in Creston TSW-X60 and MC3. For TSW-X60, all versions prior to 2.001.0037.001 are affected. For MC3, all versions prior to 1.502.0047.001 are affected. Successful exploitation of these vulnerabilities may allow remote code execution with escalated system privileges. Crestron recommends users upgrade their devices to the newest firmware.

The U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a Trojan malware variant—referred to as KEYMARBLE—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.

Social engineering is commonplace, convincing, and requires continuous consideration. Dr. Larry Ponemon, founder and chairman of Ponemon Institute, discusses the ever-present social engineering threats. He covers three key elements of every organization’s cybersecurity program – people, processes, and technology – and how they fit into combatting these threats.

The NCCIC has released an advisory regarding multiple stack-based buffer overflows, and out-of-bounds read vulnerabilities affecting Delta Electronics CNCSoft and ScreenEditor products. CNCSoft Version 1.00.83 and prior, and the accompanying, ScreenEditor Version 1.00.54 are affected. Exploitation of both vulnerabilities cause the software to crash due to the failure to validate user input. Currently there are no known public exploits; however, this vulnerability is remotely exploitable, and could be successfully exploited by an attacker with a low skill level.