Texas Cybersecurity Weekly
|
|
Multiple Vulnerabilities in Mozilla Thunderbird Could Allow for Arbitrary Code Execution
MS-ISAC Advisory Number – 2018-058
Date Issued: May 21, 2018
OVERVIEW:
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the most severe of which could allow for arbitrary code execution. Mozilla Thunderbird is an email client. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.
|
|
Efail: Your email app could be exposing your encrypted messages
May 14, 2018 - The Washington Post
Security researchers said Monday they have discovered a critical flaw in the way certain email programs handle a popular encryption technology that safeguards emails from prying eyes.
The flaw, known as Efail, affects applications such as Mozilla Thunderbird, Apple Mail and some versions of Outlook, said the team of European researchers. Efail targets the encryption standard known as PGP, or Pretty Good Privacy, and S/MIME, a similar protocol commonly used by businesses and other enterprises. A full list of affected email programs is available from the researchers' report.
|
|
New DDoS Attack Method Leverages UPnP
May 15, 2018 - Dark Reading
A new DDoS technique is adding a new twist to this common threat and upping the chance that an attack will have an impact on business operations. The new attack leverages a known vulnerability in Universal Plug and Play (UPnP) to get around many of the current defense techniques and swamp a target's network and servers.
|
|
Adobe Updates
May 14, 2018
This update includes patches for vulnerabilities affecting Adobe Acrobat and Reader for Windows and MacOS, alongside Adobe Photoshop CC for Windows and macOS.
|
|
Cisco Advisories
May 16, 2018
Cisco released 18 security advisories between May 16-18, including alerts for four vulnerabilities rated "Critical" and which received a maximum of 10 out of 10 on the CVSSv3 severity score. Three of the critical vulnerabilities include a backdoor account and two bypasses of the authentication system for Cisco Digital Network Architecture (DNA) Center. The fourth critical vulnerability is associated with Cisco’s Adaptive Security Appliance and can be exploited to allow for remote code execution and denial of service.
|
|
Cyber attacks may not be what you expect
May 14, 2018
– Electric Light&Power
We’ve all seen the headlines: “A major cyber attack on the U.S. electric grid could cause over $1 trillion in economic impact.” And, as attacks on power stations in Ukraine have demonstrated, such attacks could have disruptive potential. Nevertheless, to date, there have been no recorded cyber attacks on power facilities that have caused a major physical catastrophe or long blackout. The reason for this is that power stations are physically secured, are generally not connected to outside networks, and use industrial protocols. In recent times, power stations have also enjoyed large security upgrades that will continue to make hacking into them harder than it seems.
|
|
Get Ready for 'WannaCry 2.0'
May 17, 2018
– Dark Reading
They're still out there, pinging away for vulnerable Sever Message Block (SMB) services in order to find a way in. One year after the historic and massive WannaCry ransomware attack unleashed by nation-state hackers from North Korea, an unknown number of WannaCry-infected Windows machines in their zombie state around the globe continue to attack other devices.
|
|
Rail Europe North America hit by payment card data breach
May 17, 2018 - Cyber Defense Magazine
Rail Europe North America Inc. (RENA) recently sent a
Notice of Data Breach informing their customers that unauthorized persons had gained access to their eCommerce websites' IT platform from November 29, 2017 to February 16, 2018. The notification goes on to say what information may have been involved, what RENA is doing, and what customers can do in response.
|
|
Hacker Breaches Securus, the Company That Helps Cops Track Phones Across the US
May 16, 2018 - Motherboard
A hacker has broken into the servers of Securus, a company that allows law enforcement to easily track nearly any phone across the country, and which a US Senator has exhorted federal authorities to investigate. The hacker has provided some of the stolen data to Motherboard, including usernames and poorly secured passwords for thousands of Securus’ law enforcement customers.
|
|
State of Cybersecurity Report 2018
WIPRO
The year 2017 was witness to some of the most dangerous and blistering attacks across the spectrum of industries, ever recorded in the history of cybersecurity. The WannaCry ransomware attack was a bolt from the blue and many organizations were exposed for their lack of sound threat response controls. Per our estimates based on the study of public disclosures, approximately 2.7 billion data records were stolen in 2017, more than twice the total number of records stolen in 2016.
|
|
A Simple Tool Released to Protect Dasan GPON Routers from Remote Hacking
May 08, 2018 – The Hacker News
Since hackers have started exploiting two recently disclosed unpatched critical vulnerabilities found in GPON home routers, security researchers have now released an unofficial patch to help millions of affected users left vulnerable by their device manufacturer.
|
|
DHS Unveils long-stalled cyber strategy
May 15, 2018 – Cyberscoop
The Department of Homeland Security on Tuesday released a long-awaited cybersecurity strategy that looks to more proactively tackle the agency's mandate to protect critical infrastructure from cyberattacks. The department's cycersecurity support for critical infrastructure operators must "focus on systemic risk or address risk at individual entities that have the greatest potential impact on national security, public health and safety, and economic security," the strategy states.
|
|
Voice Squatting Attacks Impact Amazon Alexa and Google Home Assistants
May 17, 2018 – Bleeping Computer
A team of Chinese and US researchers has discovered a new method of attacking smart assistants like Amazon Alexa and Google Home, which they have named "voice squatting." The academics described their technique in a recently published research paper, together with another attack method named voice masquerading.
|
|
Rash of Italian Cyberattacks Target State Governments
May 16, 2018 – Government Technology
Three websites operated by New Mexico’s Workers' Compensation Administration were taken down Wednesday after hacktivist group AnonPlus claimed to have defaced them, Government Technology has learned.
|
|
Industrial systems need to prepare for the ‘big one’—but they’re not
May 16, 2018 – The Paralla
If hacks are like earthquakes—something you can prepare for but can’t avoid—the organizations that oversee the industrial-control systems that monitor and manage electricity, water, oil, transportation, and other essential daily services aren’t taking enough steps to prepare them. That’s the conclusion of an annual security report based on a survey of 579 security experts, 85 percent of whom said they expect their country to suffer a major critical-infrastructure hack in the next five years.
|
|
Website flaw exposed most U.S. cellphones’ real-time locations
May 18, 2018 – The Mercury News
A website flaw at a California company that gathers real-time data on cellular wireless devices could have allowed anyone to pinpoint the location of any AT&T, Verizon, Sprint or T-Mobile cellphone in the United States to within hundreds of yards, a security researcher said.
|
|
THANK YOU!
The OCISO would like to extend its' thanks to all of our Information Security Forum attendees and participants. We were thrilled to see so may individuals supporting the furthering of the security posture for the state of Texas. We look forward to seeing you all next year.
|
|
Five Tips for Better Incident Response
1.
Establish responsibilities.
When an incident starts, everyone jumps in to help, but prior to many incidents, roles are not clearly defined. Identify who is responsible for coordinating the response, and who is responsible for each aspect of the response, including tracking down any missing parties. If there is interaction with a client, determine if they have the appropriate level of authority to make any decisions that may need client approval, and if they do not, if they have a communications channel to someone who does.
2.
Set expectations.
These can include:
·
What time updates will be sent out
·
When meetings will be held
·
What kind of documentation will be required as part of the incident response
·
That technical teams promptly report what actions are being performed
3.
Keep your audience in mind.
A technical call full of clients who may not understand the jargon is just going to frustrate everyone. If necessary, have a call where the technicians can speak freely, and hold update meetings to relay summarized information to clients in a terminology they understand.
4.
Perform a trial run.
Experience helps everyone get better when a true incident hits, and a trial run can be the difference between a successful incident call, and one that could be considered a failure. Consider working trial runs into your incident response plan and hold tabletop exercises when appropriate.
5.
Don’t skip out on post-incident activities.
Conducting a root cause analysis (RCA) can help identify additional areas of improvement to prevent similar incidents in the future. Post-incident reviews where opinions are shared and considered can help improve incident response processes. Neither need to be long, complex processes, but spending a little time to conduct both can save your organization a lot of productivity later.
|
|
Workforce Development and Events
|
|
|
|
Texas-Israel Cyber Security Conference
May 31, 2018
|
The Texas-Israel Chamber of Commerce will hold the watershed Texas-Israel Cyber Security Conference on Thursday, May 31, 2018 at the Martha Proctor Mack Ballroom, on the SMU Campus. For more information on the conference please visit
www.texasisrael.org
.
Registration can be found
here.
|
|
|
|
Texas Digital Government Summit
May 30-31, 2018
|
Government Technology’s passion is helping spread best practices and spurring innovation in the public sector. The Texas Digital Government Summit is designed to do just that. The summit has an advisory board that gathers public and private sector leaders to create an agenda designed to make that passion relevant and actionable to the state and local government organizations attending the summit.
|
|
|
|
DFIR Summit & Training
Summit Dates: June 7-8, 2018
Training Course Dates: June 9-14, 2018
|
The annual SANS Digital Forensics & Incident Response (DFIR) Summit is the most comprehensive DFIR event of the year, bringing together an influential group of experts, immersion-style training, and industry networking opportunities in one place.
|
|
|
|
Texas Government Data Forum 2018
Thursday, June 21, 2018 | 8:00 am - 4:30 pm | Austin, TX
|
Annual conference hosted by the Texas Department of Information Resources. Any government/public sector employees may attend.
|
|
Texas Cybersecurity Weekly
Collected news & information for Texas’ cybersecurity community
The periodical aggregates information about cybersecurity and information technology to promote shared awareness, cyber hygiene, and information sharing amongst government, the private sector, and all Texans.
|
|
Assistance/Feedback/Questions?
Email the Office of the CISO at
|
|
|
|
|
|
|
