You are here

Home

Cybersecurity

Most Ransomware Attacks Take Place at Night or over the Weekend

According to a report just published by cybersecurity company FireEye, 76 percent of all ransomware infections occur outside working hours, with 49 percent taking place during nighttime over the weekdays and 27 percent taking place over the weekend. The reason why attackers choose to trigger the ransomware encryption process during the night or weekend is because most companies don't have IT staff working those shifts, and if they do, they are most likely short-handed.

Microsoft Releases Out-of-Band Security Updates for Server Message Block RCE Vulnerability

CISA advises that Microsoft has released out-of-band security updates to address a remote code execution vulnerability (CVE-2020-0796) in Microsoft Server Message Block 3.1.1 (SMBv3). A remote attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review the resources and apply the necessary updates or workarounds. Read the advisory at CISA.

Rockwell Automation Allen-Bradley Stratix 5950 (ICSA-20-072-03)

CISA has published an advisory on an improper access control vulnerability in Allen-Bradley Stratix 5950. Versions 1783-SAD4T0SBK9, 1783-SAD4T0SPK9, 1783-SAD2T2SBK9, and 1783-SAD2T2SPK9 are affected. Successful exploitation of this vulnerability could allow an attacker to write a modified image to the component. Rockwell Automation recommends users update to firmware version FRN v6.4.0 , which addresses the reported vulnerability. It has also provided a series of general security guidelines. CISA also recommends a series of measures to mitigate the vulnerabilities.

ABB Asset Suite (ICSA-20-072-02) – Product Used in the Energy Sector

CISA has published an advisory on an authorization bypass through user-controlled key vulnerability in ABB Asset Suite. Versions 9.6 and prior, excluding 9.4.2.6 and 9.5.3.2, are affected. Successful exploitation of this vulnerability could allow an attacker access to unauthorized information in the application by direct resource access. ABB recommends users apply updates as soon as they are able. CISA also recommends a series of measures to mitigate the vulnerabilities.

ABB eSOMS (ICSA-20-072-01) – Product Used in the Energy Sector

CISA has published an advisory on numerous vulnerabilities in ABB eSOMS. Versions 6.02 and prior are affected. In the most severe case, an attacker who successfully exploited these vulnerabilities could take over a user’s browser session, discover session-based information, or affect the confidentiality of sensitive information within the application. ABB recommends users update their version of eSOMS to 6.0.3 or 6.1. CISA also recommends a series of measures to mitigate the vulnerabilities.

Building a Digital Defense with Browsers

The FBI’s Portland, Oregon office has published an advisory discussing best practices for web browsers, which are essential for operations in any organization but can serve as openings through which bad actors intrude into systems. Noting that the browsers that are available have different levels of privacy and security, the advisory encourages organizations spend time researching browsers to figure out which one meets their needs and expectations. Once a browser is selected, however, default settings can still leave an organization vulnerable.

Federal Commission Releases Report on Recommendations for Improving Cybersecurity

The Cyberspace Solarium Commission (CSC) has released its final report, which includes over 80 recommendations to improve the U.S.’s cybersecurity posture and practices. The recommendations in the report support six cybersecurity pillars: 1) Reform the U.S. Government’s Structure and Organization for Cyberspace; 2) Strengthen Norms and Non-Military Tools; 3) Promote National Resilience; 4) Reshape the Cyber Ecosystem; 5) Operationalize Cybersecurity Collaboration with the Private Sector; and 6) Preserve and Employ the Military Instrument of National Power.

Security Awareness - ICS Component Vendor Impacted by Malware Due to Google Chrome “Feature”

Since version 76 (current version is 80), Google Chrome no longer displays the “https” and subdomain “www” to users in the address bar. A “feature” that miscreants are taking advantage to compromise legitimate websites with credit card and login skimming malware. Unfortunately, a PLC vendor in Spain reportedly fell victim to this technique that enabled skimming code to be injected into its website. This recent scheme, as reported by journalist Brian Krebs, uses the domain “htt.ps” to trick users into thinking they are seeing the “https://” they have been taught to look for.

Unpatched Microsoft Exchange Servers Vulnerable to CVE-2020-0688

CISA advises that Microsoft Exchange Servers affected by a remote code execution vulnerability, known as CVE-2020-0688, continue to be an attractive target for malicious cyber actors. A remote attacker can exploit this vulnerability to take control of an affected system that is unpatched. Although Microsoft disclosed the vulnerability and provided software patches for the various affected products in February 2020, advanced persistent threat actors are targeting unpatched servers, according to recent open-source reports.

Pages

Subscribe to Cybersecurity