Texas Cybersecurity Weekly
|
|
Malspam Campaigns Using IQY Attachments to Bypass AV Filters and Install RATs
June 6, 2018 - Dark Reading
Malspam campaigns, such as ones being distributed by Necurs, are utilizing a new attachment type that is doing a good job in bypassing antivirus and mail filters. These IQY attachments are called Excel Web Query files and when opened will attempt to pull data from external sources. The problem is that the external data being imported by the spreadsheet can also be a formula that will be executed by Excel. These formulas can then be used to locally launch PowerShell scripts that download and install malware onto the computer, which is explained later in the article.
|
|
VPNFilter Poses Broader Threat Than First Thought; Endpoints At Risk Too
June 6, 2018 - Dark Reading
The danger posed by the recently uncovered VPNFilter malware that has infected some 500,000 home-office routers and network attached storage devices worldwide may be substantially broader than initially assumed. Researchers from Cisco Talos, who were the first to report on the threat last week say that new information from partners and the company's own research shows several more devices are being targeted than first thought.
|
|
A Totally Tubular Treatise on TRITON and TriStation
June 7, 2018 - Fire Eye
In December 2017, FireEye's Mandiant discussed an incident response involving the TRITON framework. The TRITON attack and many of the publicly discussed ICS intrusions involved routine techniques where the threat actors used only what is necessary to succeed in their mission. For both INDUSTROYER and TRITON, the attackers moved from the IT network to the OT (operational technology) network through systems that were accessible to both environments. Traditional malware backdoors, Mimikatz distillates, remote desktop sessions, and other well-documented, easily-detected attack methods were used throughout these intrusions.
|
|
Chrome Releases
June 13, 2018 - Google
Ladies and gentlemen, behold! Chrome Beta 68 (68.0.3440.23) for Android has been released and is available in Google Play. A partial list of the changes in this build is available in the Git log. Details on new features is available on the Chromium blog, and developers should check out our updates related to the web platform here.
|
|
Mozilla Foundation Security Advisory 2018-14
June 6, 2018 - Mozilla
Security vulnerabilities fixed in Firefox 60.0.2, ESR 60.0.2, and ESR 52.8.1
|
|
Cisco Releases Security Updates for Multiple Products
June 6, 2018 - US-CERT
Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.
NCCIC encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates.
|
|
Adobe Security Bulletin
June 7, 2018 - Adobe
Adobe has released security updates for Adobe Flash Player for Windows, macOS, Linux and Chrome OS. These updates address critical vulnerabilities in Adobe Flash Player 29.0.0.171 and earlier versions. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Adobe is aware of a report that an exploit for CVE-2018-5002 exists in the wild, and is being used in limited, targeted attacks against Windows users. These attacks leverage Office documents with embedded malicious Flash Player content distributed via email.
|
|
Multiple Vulnerabilities in Adobe Flash Player Could Allow for Remote Code Execution (APSB18-19)
MS-ISAC ADVISORY NUMBER: 2018-062
DATE(S) ISSUED: June 7, 2018
OVERVIEW:
Multiple vulnerabilities have been discovered in Adobe Flash Player, the most severe of which could allow for arbitrary code execution. Adobe Flash Player is a widely distributed multimedia and application player used to enhance the user experience when visiting web pages or reading email messages. Successful exploitation of the most severe of these vulnerabilities could result in the attacker gaining control of the affected system. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.
THREAT INTELLIGENCE:
There has been a report of the vulnerability described in CVE-2018-5002 being exploited in the wild in limited, targeted attacks against Windows users. These attacks leverage Office documents with embedded malicious Flash Player content and are distributed via email.
|
|
Multiple Vulnerabilities in Cisco Products Could Allow for Remote Code Execution
MS-ISAC ADVISORY NUMBER: 2018-063
DATE(S) ISSUED: June 7, 2018
OVERVIEW:
Multiple vulnerabilities have been discovered in Cisco products including AnyConnect Secure Mobility Client, Cisco AnyConnect Network Access Manager, Cisco FireSIGHT System Software, Cisco Unity Connection, Cisco Identity Services Engine, Cisco Unified Communications Manager Software, Cisco Unified Computing System Software, Cisco UCS Director Software, Cisco Integrated Management Controller Supervisor Software, Cisco Wide Area Application Services, Cisco WebEx, Cisco Unified IP Phone Software, Cisco Adaptive Security Appliance Software, Cisco Firepower Threat Defense Software, Cisco IOS XE Software, Cisco Prime Collaboration Provisioning, Cisco Meeting Server, Cisco IP Phone 6800, 7800, and 8800 Series Phones, many Cisco Voice Operating System, and Cisco Network Services Orchestrator.
Successful exploitation of the most severe of these vulnerabilities could result in remote code execution in the context of the affected application. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.
THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.
|
|
A Vulnerability in Mozilla Firefox Could Allow for Arbitrary Code Execution
MS-ISAC ADVISORY NUMBER: 2018-064
DATE(S) ISSUED: June 8, 2018
OVERVIEW:
A vulnerability has been identified in Mozilla Firefox, which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet. Successful exploitation of this vulnerability could allow for arbitrary code execution. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
THREAT INTELLIGENCE:
There are currently no reports of this vulnerability being exploited in the wild.
|
|
Critical Patches Issued for Microsoft Products, June 12, 2018
MS-ISAC ADVISORY NUMBER: 2018-065
DATE(S) ISSUED: June 12, 2018
OVERVIEW:
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.
|
|
A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution
MS-ISAC ADVISORY NUMBER: 2018-066
DATE(S) ISSUED: June 13, 2018
OVERVIEW:
A vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.
THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.
|
|
Billions in cryptocurrency wealth wiped out after hack
June 11, 2018 – CNN Money
A cyberheist at a little-known virtual currency exchange helped wipe billions of dollars off the value of bitcoin and other digital currencies. The price of bitcoin slumped more than 7% after South Korea's Coinrail announced that it had been targeted by cyberthieves. In a statement Monday, the exchange said that it had a suffered a security breach in which hackers stole about 30% of its virtual currencies.
Coinrail said it had temporarily suspended trading in digital currencies and was fully cooperating with investigators to try to track down the missing funds. The exchange did not disclose the value of tokens stolen. The theft was of less well-known cryptocurrencies rather than bitcoin itself.
|
|
Dignity Health under investigation after data breach affects 56K patients
June 13, 2018 – Becker's Healthcare
San Francisco-based Dignity Health, a 39-hospital system operating in three states, is under federal investigation after a breach compromised the data of 55,947 patients, the San Francisco Chronicle reports. The breach occurred April 24 but wasn't reported to HHS' Office for Civil Rights until May 31. As mandated by HIPAA, breaches that affect more than 500 patients must be reported to the agency within 60 days of discovery. Dignity's breach was the third-largest reported that month, according to the publication. The breach stemmed from a sorting error on an email list formatted by Healthgrades, an online appointment-scheduling site under contract with Dignity. The error led Dignity to accidentally send misaddressed emails to patients that included the wrong patient's name, and in some cases, their physician's name. No financial, insurance or medical information was compromised.
|
|
2018 SANS Security Awareness Report: Building Successful Security Awareness Programs
SANS, 2018
The SANS Security Awareness Report was developed to enable security awareness professionals to make data-driven decisions on how to improve their security awareness program and to allow
them to benchmark their programs against others. In short, to more definitively answer the question “What makes great security awareness programs successful?” To accomplish this, The SANS Institute conducts a global survey of security awareness professionals every year. This year, the survey received responses from 1,718 qualified security awareness professionals; spanning 65 countries from around the world; this represents nearly double the responses as the previous year. This report is based on the results of that survey and comparisons with those done in prior years. An exciting development in this year’s report is that the data set is now large enough that it can be used to begin answering some of
the more challenging questions relating to the continued successful development of the security awareness industry. We can identify and visualize correlating factors which help or harm programs and begin to see the effect of multiple variables on program development, maturity, and impact, and can do so across different industries.
|
|
Federal Cybersecurity Risk Determination Report
and Action Plan
Executive Office of the President of the United States, 2018
This Risk Report presents a high-level assessment of government cybersecurity risks, identifies actions to improve Federal cybersecurity, and acknowledges that OMB and the agencies must work together over the coming months to identify how to implement those actions. Together, these sections comprise the determination report and action plan required by Executive Order 13800.
|
|
DHS Office of Academic Engagement Released Exercise Starter Kit for Cybersecurity Scenario
June 11, 2018 – Department of Homeland Security
The U.S. Department of Homeland Security’s Office of Academic Engagement (OAE) recently released three Exercise Starter Kits for the academic community as part of the
Campus Resilience (CR) Program.
The CR Program Exercise Starter Kits are self-conducted tabletop exercises (TTX) designed for institutions of higher education (IHE). The Exercise Starter Kits provide IHEs with a set of scalable tools and documents to develop a TTX that can be tailored to match pressing threats and hazards while validating specific emergency plans, protocols, and procedures.
The Exercise Starter Kits are complementary to the CR Program’s TTX series, which offers the
NTTX,
RTTX, and
LTTX events annually. The kits allow an IHE’s campus law enforcement, emergency management staff, and leadership to continually test and strengthen current emergency preparedness plans outside of an in-person TTX Series event.
Exercise Starter Kits scenarios released this week focus on cyber breaches, hurricanes, and active shooter incidents. Each kit includes a set of planning documents that contain pre-populated exercise content. Kit tools and documents include:
• An Exercise Conduct Briefing for presentation during the TTX
• A Situation Manual to provide background information on the TTX, scenario content, as well as discussion questions for participants
• A Facilitator Guide for assisting facilitators in delivering the TTX
• A Participant Feedback Form Template for players to provide candid feedback on the TTX
• An After-Action Report Template for summarizing key strength and areas for improvement following the TTX
For more information on the CR Program’s Exercise Starter Kits, read the Exercise Starter Kit
one-pager and
press release. To obtain an Exercise Starter Kit, please fill out this
survey.
|
|
Windows 2008 R2 is end of life January 14, 2020.
Organizations around the state still on Windows 2008 should start planning and implementing their upgrade strategies to avoid being in a position where their systems are not longer receiving security updates.
|
|
Become an MS-ISAC Member:
If you are not currently a part of MS-ISAC
click here
to learn about becoming a member.
|
|
Workforce Development and Events
|
|
Save the Date: MS-ISAC Webinar
Cryptocurrencies: The Current Landscape
June 21, 2018 3:00 p.m. EST
|
Cryptocurrencies are all the rage. Everyone is watching the price of bitcoins. Those in-the-know are talking about Litecoin, Monero, Ethereum, Ripple, and Dash, to name a few of the coins that are available if you know where to look. For the rest of us, it’s a bewildering array of new concepts from what a coin, wallet, and blockchain are, to how it compares to fiat currency, and why this even matters.
In this webinar, we will discuss the history of cryptocurrencies, how they operate and what differentiates them from traditional currencies, explain some of the concepts behind the technology, and take a peek into the criminal activity they facilitate. You know that cryptocurrencies are changing the cyber threat landscape, so here’s your chance to understand the basics.
Please register using the below link to attend this event on Thursday, June 21, 2018 at 3:00 p.m. EST.
|
|
Texas Government Data Forum 2018
Thursday, June 21, 2018 | 8:00 am - 4:30 pm | Austin, TX
|
Annual conference hosted by the Texas Department of Information Resources. Any government/public sector employees may attend.
|
|
CyberTexas: Developing the Cyber Generation | Protecting Critical Resources
August 14-15, 2018 Henry B. Gonzalez Convention Center, San Antonio, TX
|
The 2018 CyberTexas Conference will bring members of the CyberUSA community together with industry and government members of Texas to create long-term values for the cybersecurity ecosystem in San Antonio and the state of Texas. This conference is brought to you by the CyberTexas Foundation and the Federal Business Council (FBC), in conjunction with CyberUSA, and leaders from federal and local government agencies, industry, and academia.
Key features of this conference include building on the four pillars of CyberUSA: Communication, Education, Innovation, and Workforce Development. Each topic will feature prominent speakers and panels from Texas and beyond to strengthen the cybersecurity ecosystem.
|
|
Texas Cybersecurity Weekly
Collected news & information for Texas’ cybersecurity community
The periodical aggregates information about cybersecurity and information technology to promote shared awareness, cyber hygiene, and information sharing amongst government, the private sector, and all Texans.
|
|
Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction
|
|
Assistance/Feedback/Questions?
Email the Office of the CISO at
|
|
|
|
|
|
|
