Texas Cybersecurity Weekly
|
|
Security Alert: Watch out for password stealing malware says FBI
May 30, 2018 - ZD Net
US authorities have provided more details of two pieces of malware which, they said, are used by North Korean hackers to infiltrate computer systems and steal passwords and other data. The Department of Homeland Security and the FBI said that Northern Korean hackers have been using both Joanap, a remote access tool (RAT), and Brambul, a Server Message Blockworm, since at least 2009 to target companies working in the media, aerospace, financial, and critical infrastructure sectors.
|
|
Loose .zips sink chips: How poisoned archives can hack your computer
June 5, 2018 - The Register
Booby-trapped archive files can exploit vulnerabilities in a swath of software to overwrite documents and data elsewhere on a computer's file system – and potentially execute malicious code. Specifically, the flaws, dubbed "Zip Slip" by its discoverers at security outfit Snyk, is a path traversal flaw that can potentially be exploited to perform arbitrary code execution attacks. It affects certain tools that handle .zip, .tar, .war, .cpio, and .7z formats.
|
|
Multiple Vulnerabilities in Google Android OS Could Allow for Arbitrary Code Execution
MS-ISAC ADVISORY NUMBER: 2018-061
DATE(S) ISSUED: June 6, 2018
OVERVIEW:
Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for arbitrary code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.
THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.
|
|
Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
MS-ISAC ADVISORY NUMBER: 2018-060
DATE(S) ISSUED: June 4, 2018
OVERVIEW:
Multiple vulnerabilities have been discovered in iCloud for Windows, Safari, macOS High Sierra, Sierra, and El Capitan, iOS, watchOS, tvOS and iTunes. The most severe of these vulnerabilities could allow for arbitrary code execution.
• iCloud is a cloud storage service.
• Safari is a web browser available for macOS.
• macOS High Sierra is a desktop and server operating system for Macintosh computers.
• macOS Sierra is a desktop and server operating system for Macintosh computers.
• macOS El Capitan is a desktop and server operating system for Macintosh computers.
• iOS is a mobile operating system for mobile devices, including the iPhone, iPad, and iPod touch.
• watchOS is the mobile operating system for the Apple Watch and is based on the iOS operating system.
• tvOS is an operating system for the fourth-generation Apple TV digital media player.
• iTunes is a media player, media library, online radio broadcaster, and mobile device management application developed by Apple.
Successful exploitation of the most severe of these vulnerabilities could result in arbitrary code execution within the context of the application, an attacker gaining the same privileges as the logged-on user, or the bypassing of security restrictions. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.
|
|
My Heritage Says Over 92 Million User Accounts Have Been Compromised
June 5, 2018 – The Hacker News
MyHeritage, the Israel-based DNA testing service designed to investigate family history, has disclosed that the company website was breached last year by unknown attackers, who stole login credentials of its more than 92 million customers. The company learned about the breach on June 4, 2018, after an unnamed security researcher discovered a database file named "myheritage" on a private server located outside of the company, and shared it with MyHeritage Team
|
|
Verge (XVG) Loses Over $1 Million in a Recent Hack
May 28, 2018 – GlobalCoin Report
As per the latest updates, Verge (XVG) has succumbed to a similar attack for the second time in less than two months. Going by the report published on BitcoinTalk, the attacker has forked the blockchain through a striking 51% DDoS attack. It seems that the attacker exploited a bug in the XVG code by setting a false timestamp on blocks and mining new blocks in the meantime. The following segments explain the details of the hack that has alarmed many users across the community.
|
|
Ticketfly Hacked: Ticketing Service Taken Offline Following 'Cyber Incident'
May 31, 2018 - Billboard
Ticketfly, the indie-focused ticketing service that last year was purchased by Eventbrite, has fallen victim to what it describes as a "cyber incident" and has temporarily shut itself down. The company, which handles ticketing for events like Celebrate Brooklyn, Riot Fest and Music Tastes Good, confirmed the hack to Billboard on Thursday morning.
|
|
Webroot: 2018 Threat Report
Webroot, 2018
If there’s one thing that came through loud and clear in our analysis of malware and other threats in 2017, it’s that, when it comes to cybersecurity, change is the only constant. While analysts, researchers, and security companies worked quickly to identify and block emerging threats, attackers were just as quick in finding new ways to evade defenses. Phishing attacks became more targeted and successful, and most phishing sites were only online for 4-8 hours.
|
|
Rapid 7 Quarterly Threat Report
Rapid 7, Q1 2018
This quarter’s report covers three main areas of concern for the modern IT defender: First, credential theft, reuse, and subsequent suspicious logins are—today—the most commonly reported significant incident we’re seeing across both small (<1,000 endpoints) and large organizations (≥1,000 endpoints).
Second, the DDoS landscape just got a lot more interesting with the debut of a new technique using misconfigured—and plentiful—memcached servers. Finally, we take a look at the increasing levels of SMB and Cisco SMI attacker probes and attacks, where the former continues to define the “new normal” level of background malicious behavior around Windows networking, and the latter begins to bring shape to this relatively new attack vector targeting core router infrastructure.
|
|
Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
U.S. Department of Energy
Electricity is critical to every aspect of modern life. The United States’ national security, economy, and public health and safety rely on the North American electric gridi every second of the day. These, and many other functions powered by the grid have likely experienced local outages caused by weather, accidents, or sometimes from tree branches falling on power lines. Larger power outages, however, are infrequent occurrences, due in part to an array of organizations that work tirelessly to ensure the grid remains reliable, resilient, and secure. Nonetheless, it is neither practical nor possible to prevent all disruptive events.1 Grid owners and operators balance risk, investment, and cost to customers when making investments in their systems.
|
|
Purdue warns patients that their information might be compromised
May 30, 2018 – Journal & Courier
Patients of the Purdue University Pharmacy and the Family Health Clinic of Carroll County are receiving notices this week that their information might be compromised because of a security breach. Letters informing patients were mailed out Friday, according to a Purdue news release.
|
|
Three City of Greenville email accounts compromised, sent spam messages
June 1, 2018 – Dayton Daily News
Three City of Greenville email accounts were compromised and sent multiple spam emails, according to a technology manager with the city. Thursday morning, the affected email accounts sent emails of various subject matter with a Microsoft Word document attached, the spokesperson said in a media release Friday.
|
|
Why Are We So Bad At Cybersecurity? It's Mostly Neglect
May 31, 2018 – Forbes
Today’s tech world is primarily infatuated with one thing -- security. That is for good reason. With the number of breaches and data privacy violations, it is evident that a focus on security is long overdue in the technology space. The main issue with this, though, is that what most people and organizations think is security isn’t security at all. A lot of it boils down to policy, maintenance and scheduling, and it all has very little to do with actual security for most organizations.
|
|
DOE cybersecurity report reveals 7 'gaps' in power sector defense capabilities
June 1, 2018 – Utility Dive
The U.S. Department of Energy on Wednesday made public an August 2017 report that concluded there are more than a half dozen "capability gaps" in the power sector's ability to respond to a cyberattack on the electric grid. A power outage due to a cyberattack has never happened in this country, but hacking attempts are on the rise and a recent focus on industrial control systems (ICS) by would-be intruders has upped the ante.
|
|
Tips for Presenting Proposals to Your Executives
Tips for Presenting Business Proposals to Your Executives
When presenting to executives, one must remember that they are often not thinking in day-to-day terms, rather they are looking at the organization from 30,000 feet, using a long-term perspective. They were hired to lead their organization over the long-term and often leave the day-to-day or even week-to-week decisions and management to be handled by lower and mid-level managers. The first thing to remember when communicating with executives is to lead with your headline (or goal/ask), share the process you took to get to your conclusions, include time for interruptions and questions, and try not to drag out the meeting longer than is necessary.
Executives tend to focus on organizations from a broader perspective and many do not come from a highly technical background. Their degrees and experience are usually in business or their organization’s focus, and while they know information technology enables their organizations to succeed, it is often not their primary background and may require an adjustment in your normal technical language. Avoid jargon and present in terms they will be able to use to communicate with their business executive peers.
When presenting to an executive, or anyone that might not share your area of expertise, you want your presentation to be understandable without losing your audience in technical jargon. Give a high-level overview of your project and only deep dive when necessary; often the deep dives should come through the questions and not be included in the actual presentation materials. There is no need to “show your work” as executives rarely want to see the raw data, although it should be ready in case it is requested. This data should be in an easily consumed format, such as easy to consume dashboards, eye-catching graphs and charts.
Major points of focus for executive management are time and money. Time can be expressed in the length of the project you are proposing, lifespan of the resulting product, and labor-hours. For labor-hours, remember to express not only how many are needed for the project, but how many are needed to maintain the resulting product. If your proposal results in saving time, be sure to mention it. Money can be divided into one-time expenses (sunk costs), fixed costs (re-occurring costs that do not change), and variable costs (costs that change, such as usage-based charges). Remember that these costs can be both expenses and savings or avoidances. For example, if two separate systems can be consolidated into a single system then the labor it takes to consolidate those systems would be a sunk cost. If the effort streamlines the future maintenance of the two functions, then the reduced maintenance would represent a cost savings (the expense still exists but is lower than it would have been). Since the two systems are now one and only one set of hardware is required to run it, there is a cost avoidance since there is a whole set of hardware that is no longer required.
If you need assistance with calculating the time and money effects of your proposal, don’t be afraid to ask a project manager or business analyst for help. Project managers frequently present to management and are used to conveying ideas in terms of dollars and time and may even be familiar with your executive audience allowing for insight on what types of information to include in your proposal. Business analysts frequently translate technical requirements into business language and vice versa and are invaluable resources in helping to calculate costs and effort.
Lastly, be transparent. Your executives got to their position by being able to identify opportunities and issues. If there is a flaw in your numbers, logic, or content, they will find it and as a result, possibly less likely to approve your proposal.
|
|
Become an MS-ISAC Member:
If you are not currently a part of MS-ISAC
click here
to learn about becoming a member.
|
|
Workforce Development and Events
|
|
|
|
NCCIC and MS-ISAC Ransomware Awareness Briefings
See dates and times below
|
Over the next three weeks, the National Cybersecurity and Communications Integration Center (NCCIC) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) will host four webinars on the current ransomware threat environment. The webinars are TLP: WHITE and open to all audiences. The MS-ISAC encourages sharing this information with partners and organizations throughout your community.
The MS-ISAC
Ransomware Security Primer
, with basic information and detailed recommendations is available via the CIS website.
Dates and Times:
1:00 PM –2:30 PM ET
(content is the same for each session):
|
|
|
|
Texas Government Data Forum 2018
Thursday, June 21, 2018 | 8:00 am - 4:30 pm | Austin, TX
|
Annual conference hosted by the Texas Department of Information Resources. Any government/public sector employees may attend.
|
|
Texas Cybersecurity Weekly
Collected news & information for Texas’ cybersecurity community
The periodical aggregates information about cybersecurity and information technology to promote shared awareness, cyber hygiene, and information sharing amongst government, the private sector, and all Texans.
|
|
Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction
|
|
Assistance/Feedback/Questions?
Email the Office of the CISO at
|
|
|
|
|
|
|
