You are here

Home » Cybersecurity

Cybersecurity

Continued Use of Legitimate IT Tools for Malicious Intent - Analysis Report: JBoss Verify and EXploitation Tool (JexBoss)

Malicious threat actors commonly use legitimate IT network based tools against us – tools like Metasploit, PowerShell, PsExec, Nessus, and Shodan, that were originally developed to help defend and manage our networks. Following ongoing WaterISAC reporting, the NCCIC released an analysis report today illustrating the continued use of IT tactics, techniques, and procedures (TTPs) to gain footholds into our organizations.

Consumers Abandon Brands after Data Breaches, according to Survey

Ping Identity conducted a survey of more than 3,000 people across the U.S., the U.K., France, and Germany to understand consumer sentiments and behaviors toward brands impacted by data breaches. They survey found that 78% of respondents would stop engaging with a brand online and 36% would stop engaging altogether if the brand had experienced a breach. Additionally, nearly half (49%) would not sign up and use an online service or application that recently experienced a data breach.

When Accounts are “Hacked” Due to Poor Passwords, Victims Must Share the Blame

A article by cybersecurity expert Troy Hunt observes that intrusions into networks and systems are often made possible by employees’ poor choice of passwords at the targeted organization, rather than the sophisticated exploit of vulnerable code often suggested when attacks are disclosed. Troy notes that the tendency today is to imply that there is no responsibility on behalf of the victim.

Hackers Attack Utility Companies’ IT Systems rather than ICS, according to Report

According to cyber threat detection and hunting firm Vectra’s Spotlight Report on Energy and Utilities, utility companies are more likely to have hackers target their IT systems than attack critical infrastructure. It noted there is a difference between attacks that probe IT networks for information and access about critical infrastructure versus attacks against ICS. "The two are interconnected, but the targeted assets are different," the report’s authors said. "Cyber-criminals have been testing and mapping-out attacks against energy and utilities networks for years.

NCCIC Security Tip: Website Security

The U.S. Department of Homeland Security National Cybersecurity and Communications Integration Center (NCCIC) has produced a new Security Tip, Website Security. Website security refers to the protection of personal and organizational public-facing websites from cyber attacks, and the Security Tip discusses their impacts and numerous methods for defending websites against them.

Fr. Sauter AG Case Suite (ICSA-18-305-04)

The NCCIC has released an advisory on an improper restriction of xml external entity reference vulnerability in Fr. Sauter AG Case Suite. Versions 3.10 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to remotely retrieve unauthorized files from the system. Fr. Sauter AG recommends users apply Service Release 1 for the current CASE Suite Version 3.10. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

Circontrol CirCarLife (ICSA-18-305-03)

The NCCIC has released an advisory on authentication bypass using an alternate path or channel and insufficiently protected credentials vulnerabilities in Circontrol CirCarLife. All versions prior to 4.3.1 are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to retrieve credentials stored in clear text to bypass authentication, and see and access critical information. Circontrol has released a new version of the software. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

Schneider Electric Software Update (ICSA-18-305-02) – Product Used in the Energy Sector

The NCCIC has released an advisory on a DLL hijacking vulnerability in Schneider Electric Software Update (SESU). All versions prior to 2.2.0 are affected. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system. Schneider Electric has created a fix for this vulnerability (Version 2.2.0). The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities. NCCIC/ICS-CERT.

Pages

Subscribe to Cybersecurity