FreshRSS

🔒
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

QwixxRAT: New Remote Access Trojan Emerges via Telegram and Discord

By THN
A new remote access trojan (RAT) called QwixxRAT is being advertised for sale by its threat actor through Telegram and Discord platforms. "Once installed on the victim's Windows platform machines, the RAT stealthily collects sensitive data, which is then sent to the attacker's Telegram bot, providing them with unauthorized access to the victim's sensitive information," Uptycs said in a new

Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities

By THN
A four-year-old critical security flaw impacting Fortinet FortiOS SSL has emerged as one of the most routinely and frequently exploited vulnerabilities in 2022. "In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and targeted unpatched, internet-facing systems," cybersecurity and intelligence agencies from the Five

Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan

By THN
Cybersecurity researchers have discovered a new post-exploitation technique in Amazon Web Services (AWS) that allows the AWS Systems Manager Agent (SSM Agent) to be run as a remote access trojan on Windows and Linux environments "The SSM agent, a legitimate tool used by admins to manage their instances, can be re-purposed by an attacker who has achieved high privilege access on an endpoint with

Iranian Company Cloudzy Accused of Aiding Cybercriminals and Nation-State Hackers

By THN
Services offered by an obscure Iranian company known as Cloudzy are being leveraged by multiple threat actors, including cybercrime groups and nation-state crews. "Although Cloudzy is incorporated in the United States, it almost certainly operates out of Tehran, Iran – in possible violation of U.S. sanctions – under the direction of someone going by the name Hassan Nozari," Halcyon said in a new

European Bank Customers Targeted in SpyNote Android Trojan Campaign

By THN
Various European customers of different banks are being targeted by an Android banking trojan called SpyNote as part of an aggressive campaign detected in June and July 2023. "The spyware is distributed through email phishing or smishing campaigns and the fraudulent activities are executed with a combination of remote access trojan (RAT) capabilities and vishing attack," Italian cybersecurity

Fruity Trojan Uses Deceptive Software Installers to Spread Remcos RAT

By THN
Threat actors are creating fake websites hosting trojanized software installers to trick unsuspecting users into downloading a downloader malware called Fruity with the goal of installing remote trojans tools like Remcos RAT. "Among the software in question are various instruments for fine-tuning CPUs, graphic cards, and BIOS; PC hardware-monitoring tools; and some other apps," cybersecurity

Hackers Abusing Windows Search Feature to Install Remote Access Trojans

By THN
A legitimate Windows search feature is being exploited by unknown malicious actors to download arbitrary payloads from remote servers and compromise targeted systems with remote access trojans such as AsyncRAT and Remcos RAT. The novel attack technique, per Trellix, takes advantage of the "search-ms:" URI protocol handler, which offers the ability for applications and HTML links to launch custom

Decoy Dog: New Breed of Malware Posing Serious Threats to Enterprise Networks

By THN
A deeper analysis of a recently discovered malware called Decoy Dog has revealed that it's a significant upgrade over the Pupy RAT, an open-source remote access trojan it's modeled on. "Decoy Dog has a full suite of powerful, previously unknown capabilities – including the ability to move victims to another controller, allowing them to maintain communication with compromised machines and remain

New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection

By THN
Details have emerged about a now-patched flaw in OpenSSH that could be potentially exploited to run arbitrary commands remotely on compromised hosts under specific conditions. "This vulnerability allows a remote attacker to potentially execute arbitrary commands on vulnerable OpenSSH's forwarded ssh-agent," Saeed Abbasi, manager of vulnerability research at Qualys, said in an analysis last week.

A Few More Reasons Why RDP is Insecure (Surprise!)

By The Hacker News
If it seems like Remote Desktop Protocol (RDP) has been around forever, it's because it has (at least compared to the many technologies that rise and fall within just a few years.) The initial version, known as "Remote Desktop Protocol 4.0," was released in 1996 as part of the Windows NT 4.0 Terminal Server edition and allowed users to remotely access and control Windows-based computers over a

RomCom RAT Targeting NATO and Ukraine Support Groups

By THN
The threat actors behind the RomCom RAT have been suspected of phishing attacks targeting the upcoming NATO Summit in Vilnius as well as an identified organization supporting Ukraine abroad. The findings come from the BlackBerry Threat Research and Intelligence team, which found two malicious documents submitted from a Hungarian IP address on July 4, 2023. RomCom, also tracked under the names

Chinese Hackers Use HTML Smuggling to Infiltrate European Ministries with PlugX

By Ravie Lakshmanan
A Chinese nation-state group has been observed targeting Foreign Affairs ministries and embassies in Europe using HTML smuggling techniques to deliver the PlugX remote access trojan on compromised systems. Cybersecurity firm Check Point said the activity, dubbed SmugX, has been ongoing since at least December 2022, adding it's part of a broader trend of Chinese adversaries shifting their focus

Chinese Hackers Using Never-Before-Seen Tactics for Critical Infrastructure Attacks

By Ravie Lakshmanan
The newly discovered Chinese nation-state actor known as Volt Typhoon has been observed to be active in the wild since at least mid-2020, with the hacking crew linked to never-before-seen tradecraft to retain remote access to targets of interest. The findings come from CrowdStrike, which is tracking the adversary under the name Vanguard Panda. "The adversary consistently employed ManageEngine

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans

By Ravie Lakshmanan
A new phishing campaign codenamed MULTI#STORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems. "The attack chain ends with the victim machine infected with multiple unique RAT (remote access trojan) malware instances, such as Warzone RAT and Quasar RAT," Securonix researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov

Critical RCE Flaw Discovered in Fortinet FortiGate Firewalls - Patch Now!

By Ravie Lakshmanan
Fortinet has released patches to address a critical security flaw in its FortiGate firewalls that could be abused by a threat actor to achieve remote code execution. The vulnerability, tracked as CVE-2023-27997, is "reachable pre-authentication, on every SSL VPN appliance," Lexfo Security researcher Charles Fol, who discovered and reported the flaw alongside Dany Bach, said in a tweet over the

Sneaky DogeRAT Trojan Poses as Popular Apps, Targets Indian Android Users

By Ravie Lakshmanan
A new open source remote access trojan (RAT) called DogeRAT targets Android users primarily located in India as part of a sophisticated malware campaign. The malware is distributed via social media and messaging platforms under the guise of legitimate applications like Opera Mini, OpenAI ChatGPT, and Premium versions of YouTube, Netflix, and Instagram. "Once installed on a victim's device, the

New GobRAT Remote Access Trojan Targeting Linux Routers in Japan

By Ravie Lakshmanan
Linux routers in Japan are the target of a new Golang remote access trojan (RAT) called GobRAT. "Initially, the attacker targets a router whose WEBUI is open to the public, executes scripts possibly by using vulnerabilities, and finally infects the GobRAT," the JPCERT Coordination Center (JPCERT/CC) said in a report published today. The compromise of an internet-exposed router is followed by the

Industrial Cellular Routers at Risk: 11 New Vulnerabilities Expose OT Networks

By Ravie Lakshmanan
Several security vulnerabilities have been disclosed in cloud management platforms associated with three industrial cellular router vendors that could expose operational technology (OT) networks to external attacks. The findings were presented by Israeli industrial cybersecurity firm OTORIO at the Black Hat Asia 2023 conference last week. "Industrial cellular routers and gateways are essential

Andoryu Botnet Exploits Critical Ruckus Wireless Flaw for Widespread Attack

By Ravie Lakshmanan
A nascent botnet called Andoryu has been found to exploit a now-patched critical security flaw in the Ruckus Wireless Admin panel to break into vulnerable devices. The flaw, tracked as CVE-2023-25717 (CVSS score: 9.8), stems from improper handling of HTTP requests, leading to unauthenticated remote code execution and a complete compromise of wireless Access Point (AP) equipment. Andoryu was 

Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now

By Ravie Lakshmanan
Networking equipment maker Zyxel has released patches for a critical security flaw in its firewall devices that could be exploited to achieve remote code execution on affected systems. The issue, tracked as CVE-2023-28771, is rated 9.8 on the CVSS scoring system. Researchers from TRAPA Security have been credited with reporting the flaw. "Improper error message handling in some firewall versions

Fortra Sheds Light on GoAnywhere MFT Zero-Day Exploit Used in Ransomware Attacks

By Ravie Lakshmanan
Fortra, the company behind Cobalt Strike, shed light on a zero-day remote code execution (RCE) vulnerability in its GoAnywhere MFT tool that has come under active exploitation by ransomware actors to steal sensitive data. The high-severity flaw, tracked as CVE-2023-0669 (CVSS score: 7.2), concerns a case of pre-authenticated command injection that could be abused to achieve code execution. The

Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered

By Ravie Lakshmanan
The cyber espionage actor tracked as Blind Eagle has been linked to a new multi-stage attack chain that leads to the deployment of the NjRAT remote access trojan on compromised systems. "The group is known for using a variety of sophisticated attack techniques, including custom malware, social engineering tactics, and spear-phishing attacks," ThreatMon said in a Tuesday report. Blind Eagle, also

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

By Ravie Lakshmanan
The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB has revealed the adversary's use of the SimpleHelp remote support software in June 2022. MuddyWater,

Researchers Discover Critical Remote Code Execution Flaw in vm2 Sandbox Library

By Ravie Lakshmanan
The maintainers of the vm2 JavaScript sandbox module have shipped a patch to address a critical flaw that could be abused to break out of security boundaries and execute arbitrary shellcode. The flaw, which affects all versions, including and prior to 3.9.14, was reported by researchers from South Korea-based KAIST WSP Lab on April 6, 2023, prompting vm2 to release a fix with version 3.9.15 on

Stealthy DBatLoader Malware Loader Spreading Remcos RAT and Formbook in Europe

By Ravie Lakshmanan
A new phishing campaign has set its sights on European entities to distribute Remcos RAT and Formbook via a malware loader dubbed DBatLoader. "The malware payload is distributed through WordPress websites that have authorized SSL certificates, which is a common tactic used by threat actors to evade detection engines," Zscaler researchers Meghraj Nandanwar and Satyam Singh said in a report

International Law Enforcement Takes Down Infamous NetWire Cross-Platform RAT

By Ravie Lakshmanan
A coordinated international law enforcement exercise has taken down the online infrastructure associated with a cross-platform remote access trojan (RAT) known as NetWire. Coinciding with the seizure of the sales website www.worldwiredlabs[.]com, a Croatian national who is suspected to be the website's administrator has been arrested. While the suspect's name was not released, investigative

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

By Ravie Lakshmanan
Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center (ASEC), in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on compromised systems. This includes the Sliver post-exploitation framework, XMRig cryptocurrency

Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs

By Ravie Lakshmanan
Security researchers have disclosed two new vulnerabilities affecting Schneider Electric Modicon programmable logic controllers (PLCs) that could allow for authentication bypass and remote code execution. The flaws, tracked as CVE-2022-45788 (CVSS score: 7.5) and CVE-2022-45789 (CVSS score: 8.1), are part of a broader collection of security defects tracked by Forescout as OT:ICEFALL. Successful

CERT-UA Alerts Ukrainian State Authorities of Remcos Software-Fueled Cyber Attacks

By Ravie Lakshmanan
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of cyber attacks against state authorities in the country that deploy a legitimate remote access software named Remcos. The mass phishing campaign has been attributed to a threat actor it tracks as UAC-0050, with the agency describing the activity as likely motivated by espionage given the toolset employed. The

10 Surprises of Remote Work from Security Engineers

By Mary Kate Schmermund

For Cisco engineers working on Duo, having a remote-first workplace has helped them reach life goals, connect with colleagues around the world, and be intentional communicators. We understand that working remotely can be an adjustment — that’s why we’ve compiled the 10 parts of remote work that surprised our team members most and their advice for navigating the nuances. If you’re interested in being part of a remote-first workplace, check out our open positions.

1. More perspectives make a positive impact on the product

Senior Engineering Leader David Rines has worked remotely for the past seven years. He’s found that Cisco’s approach to distributed teams has “enabled us to pick up the right talent, and not necessarily local talent. We are moving towards a global, follow the sun environment,” he said.

One of the aspects Rines appreciates most of this structure is getting “a widely varied set of perspectives and experiences that help build a more reliable, more robust product, which is why we’re here.”

Another benefit to having colleagues across the globe is the sharing of recipes, a perk Senior Site Reliability Engineer Bernard Ting particularly enjoys. Proactively communicating with colleagues virtually “helps you to form bonds with people from other teams. You can always learn something new about cultures elsewhere. I talk to people about food and so I’m always gathering recipes from people from all over the world,” Ting shared.

2. Gathering virtually inspires collaborative problem-solving

While some may fear that working remotely could lead to feelings of isolation and loneliness, a different camaraderie can flourish in the structure of our distributed teams. With colleagues across time zones, “there’s always someone there who you can reach out to help solve your problem,” Rines said.

Collaboration hours are another way Site Reliability Engineering Manager Jaya Sistla has cultivated virtual community and problem-solving. These hours are blocked off for team members to talk about what they’re working on. “The main thing is being able to ask for help so you don’t go into the rabbit hole debugging things,” Sistla said.

Ting points out that working in a distributed model allows you to really engage in virtual events and conversations. Given that the team mainly communicates through online chat, Ting has found that “forces you to see everyone as equally approachable, which has made me more comfortable reaching out to people from anywhere in the world.”

3. Intentional online socializing strengthens teams working remotely

For folks sharing an office, collaboration can happen through casual chats over coffee. When facing a challenge, you can ask your neighbor for support. While ideally virtual communication could have a similar cadence and spontaneity, the logistics of remote and distributed work require intentionality and being proactive in connecting with colleagues as people and as co-workers.

When Ting first started working remotely, he felt that every meeting needed to be formal and have a business objective. By sharing his feelings with his manager, he was reassured that “socializing is a very important part of teamwork, because if you don’t have a good relationship with your colleagues you’re not going to be able to have healthy discussions, healthy conflict or be able to critique each other when the situation arises.”

Since that conversation, Ting has been more proactive about catching up with colleagues, which can include sharing a coffee over video chat. Duo’s “coffee roulette” formalizes the process as every month, employees who opt in can be randomly paired up for a quick half-hour chat focused exclusively on socializing. Ting has found being proactive about socializing virtually helpful. “It’s made me more intentional with my time and really treasure the social experience you can get,” he said.

4. Remote management + training can be effective

Some folks may be concerned that without a manager observing their efforts and work ethic day in and day out, it may be harder to recognize accomplishments and challenges. Ting found that within his team “when you work on projects and in your one-on-ones with your managers, they’re always very intentional about learning what you’ve been doing and seeing what your progress is like on certain projects. I’ve been asked, ‘How do you think you can improve? What are some of the things you’ve been doing outside of the team work?’”

To cultivate cross-team collaboration and education, there are thoughtfully planned virtual lunch and learns. “We schedule training sessions and common meetings at times that are flexible for everyone. If it has to be repeated, we do it so people can comfortably attend rather than stretching themselves and attending at odd hours,” Sistla said.

5. Informal communication = hugely important [bonus points for individualized emojis]

For Software Engineer Nick Aspinall, an important and fun part of working remotely is keeping in touch with virtual messaging. One unique perk has been getting to create and customize emojis with team members including a few of himself in “various ridiculous states,” he said.

Connecting with colleagues on themed channels focused on personal and professional interests from coffee to pets “makes it really cool because you can meet people across different teams and still get some of the feeling of rubbing elbows that you get when you’re in the office,” Aspinall said. Participating in these virtual conversations boosts morale while also providing an endless supply of cute animal pics.

6. Conveying different information requires different formats

Given the multi-faceted nature of our work and the importance of consistent information sharing, having different communication channels and formats to communicate data with varying degrees of complexity is vital. Having information readily accessible, accurate and updated is particularly necessary in a field like cybersecurity.

Senior Software Engineer Mario Lopez finds that the variety of information sources contributes to an easeful remote working experience. For instance, for complex architecture decisions or detailing, Duo’s Wiki is the best source.

Software Engineer Hanna Fernandez has benefited from chat channels dedicated to design and engineering topics to “see what everyone’s up to and what thoughts people have,” she said. Sista pointed out these are great places to ask questions and open up dialogue to solve problems.

7. Video-on culture increases empathy and smiles

Our culture is “video-on,” meaning that it is preferred that during video meetings, as much as possible, attendees have their cameras on. Lopez loves this because “you get a bit of that personal human element.”

“We’re all people behind these screens. You definitely get some of people’s personality through text, but you get it more when you actually see them. It’s infectious when you see someone smiling. You’ve got to smile back,” he shared (while we both smiled).

8. Small talk matters

When Fernandez started at Cisco, she was advised to schedule individual meetings with everyone she would be working with on every team that she joined. That suggestion is one she’s applied even virtually.

“It’s a great strategy because I already know that my team is super talented and very smart, but this way I also get to know them as humans beyond their roles,” Fernandez said. Fernandez also finds it important to check in with co-workers and ask how they’re feeling and how their time off was. “I know a lot of people hate small talk, but it’s not just small talk. I’m genuinely interested in how my co-workers are doing.”

9. Life goals can more easily become reality

One of Ting’s biggest goals was buying his first house in the countryside outside of London. By working remotely, Ting has flexibility in his location which allowed him to achieve his goal of buying a house and settling down with his partner, while giving their dogs the space they need to be dogs.

remote

10. Take time to transition as an engineer working remotely

When transitioning from fully remote to hybrid, it’s important to recognize that there will be some shifts to get accustomed to. As the structures of remote, distributed and hybrid work evolve, it’s important to stay flexible and notice what’s possible through multiple modalities of team building. Many teams have enjoyed in-person gatherings and connecting through virtual lunches and team games when remote.

Fernandez has had multiple roles with multiple structures at Cisco. As an intern, she was fully in person and shared desk space with other interns who collaborated on full stack engineering. While working in finance IT, Fernandez was hybrid and many of her colleagues were distributed among multiple offices. The pandemic began while she was in a DevOps role, forcing her to maintain boundaries around her work time while working fully remotely. In her current role working on Duo, Fernandez is completely remote but advocates for in-person events if possible, because “humans are social creatures who want to see each other’s faces in real life once in a while.”

For Aspinall, “when we did come back to the office, there was a bit of an adjustment period where you were overstimulated from the office.” He also wanted to ensure team members who were 100% remote were fully included. Now he sees that while half his team is fully remote and the other half is hybrid, “that doesn’t stop anyone from doing anything. All of our meetings feel the same. They’re all seamless.”

If you’re interested in joining our team from wherever you are in the world, check out our open roles.

 


We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

VMware Releases Patches for Critical vRealize Log Insight Software Vulnerabilities

By Ravie Lakshmanan
VMware on Tuesday released software to remediate four security vulnerabilities affecting vRealize Log Insight (aka Aria Operations for Logs) that could expose users to remote code execution attacks. Two of the flaws are critical, carrying a severity rating of 9.8 out of a maximum of 10, the virtualization services provider noted in its first security bulletin for 2023. Tracked as CVE-2022-31706

Android Users Beware: New Hook Malware with RAT Capabilities Emerges

By Ravie Lakshmanan
The threat actor behind the BlackRock and ERMAC Android banking trojans has unleashed yet another malware for rent called Hook that introduces new capabilities to access files stored in the devices and create a remote interactive session. ThreatFabric, in a report shared with The Hacker News, characterized Hook as a novel ERMAC fork that's advertised for sale for $7,000 per month while featuring

Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

By Ravie Lakshmanan
An ongoing campaign dubbed Earth Bogle is leveraging geopolitical-themed lures to deliver the NjRAT remote access trojan to victims across the Middle East and North Africa. "The threat actor uses public cloud storage services such as files[.]fm and failiem[.]lv to host malware, while compromised web servers distribute NjRAT," Trend Micro said in a report published Wednesday. Phishing emails,

Git Users Urged to Update Software to Prevent Remote Code Execution Attacks

By Ravie Lakshmanan
The maintainers of the Git source code version control system have released updates to remediate two critical vulnerabilities that could be exploited by a malicious actor to achieve remote code execution. The flaws, tracked as CVE-2022-23521 and CVE-2022-41903, impacts the following versions of Git: v2.30.6, v2.31.5, v2.32.4, v2.33.5, v2.34.5, v2.35.5, v2.36.3, v2.37.4, v2.38.2, and v2.39.0. <!-

Cybercriminals Using Polyglot Files in Malware Distribution to Fly Under the Radar

By Ravie Lakshmanan
Remote access trojans such as StrRAT and Ratty are being distributed as a combination of polyglot and malicious Java archive (JAR) files, once again highlighting how threat actors are continuously finding new ways to fly under the radar. "Attackers now use the polyglot technique to confuse security solutions that don't properly validate the JAR file format," Deep Instinct security researcher

Alert: Hackers Actively Exploiting Critical "Control Web Panel" RCE Vulnerability

By Ravie Lakshmanan
Malicious actors are actively attempting to exploit a recently patched critical vulnerability in Control Web Panel (CWP) that enables elevated privileges and unauthenticated remote code execution (RCE) on susceptible servers. Tracked as CVE-2022-44877 (CVSS score: 9.8), the bug impacts all versions of the software before 0.9.8.1147 and was patched by its maintainers on October 25, 2022. Control

Severe Security Flaw Found in "jsonwebtoken" Library Used by 22,000+ Projects

By Ravie Lakshmanan
A high-severity security flaw has been disclosed in the open source jsonwebtoken (JWT) library that, if successfully exploited, could lead to remote code execution on a target server. "By exploiting this vulnerability, attackers could achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token (JWT) request," Palo Alto Networks Unit 42 researcher Artur Oleyarsh

Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations

By Ravie Lakshmanan
Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution (RCE) through Outlook Web Access (OWA). "The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint," CrowdStrike researchers Brian Pitchford,

Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems

By Ravie Lakshmanan
The maintainers of the FreeBSD operating system have released updates to remediate a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution. The issue, assigned the identifier CVE-2022-23093, impacts all supported versions of FreeBSD and concerns a stack-based buffer overflow vulnerability in the ping service. "

Watch Out! These Android Keyboard Apps With 2 Million Installs Can be Hacked Remotely

By Ravie Lakshmanan
Multiple unpatched vulnerabilities have been discovered in three Android apps that allow a smartphone to be used as a remote keyboard and mouse. The apps in question are Lazy Mouse, PC Keyboard, and Telepad, which have been cumulatively downloaded over two million times from the Google Play Store. Telepad is no longer available through the app marketplace but can be downloaded from its website.

Telehealth Sites Put Addiction Patient Data at Risk

By Lindsey Ellefson
New research found pervasive use of tracking tech on substance-abuse-focused health care websites, potentially endangering users in a post-Roe world.

VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform

By Ravie Lakshmanan
VMware on Tuesday shipped security updates to address a critical security flaw in its VMware Cloud Foundation product. Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring system, and relates to a remote code execution vulnerability via XStream open source library. "Due to an unauthenticated endpoint that leverages XStream for input serialization in

Critical RCE Vulnerability Discovered in Popular Cobalt Strike Hacking Software

By Ravie Lakshmanan
HelpSystems, the company behind the Cobalt Strike software platform, has released an out-of-band security update to address a remote code execution vulnerability that could allow an attacker to take control of targeted systems. Cobalt Strike is a commercial red-team framework that's mainly used for adversary simulation, but cracked versions of the software have been actively abused by ransomware

Microsoft Confirms 2 New Exchange Zero-Day Flaws Being Used in the Wild

By Ravie Lakshmanan
Microsoft officially disclosed it investigating two zero-day security vulnerabilities impacting Exchange Server 2013, 2016, and 2019 following reports of in-the-wild exploitation. "The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is

Cyber Criminals Using Quantum Builder Sold on Dark Web to Deliver Agent Tesla Malware

By Ravie Lakshmanan
A recently discovered malware builder called Quantum Builder is being used to deliver the Agent Tesla remote access trojan (RAT). "This campaign features enhancements and a shift toward LNK (Windows shortcut) files when compared to similar attacks in the past," Zscaler ThreatLabz researchers Niraj Shivtarkar and Avinash Kumar said in a Tuesday write-up. <!--adsense--> Sold on the dark web for

Researchers Detail OriginLogger RAT — Successor to Agent Tesla Malware

By Ravie Lakshmanan
Palo Alto Networks Unit 42 has detailed the inner workings of a malware called OriginLogger, which has been touted as a successor to the widely used information stealer and remote access trojan (RAT) known as Agent Tesla. A .NET based keylogger and remote access, Agent Tesla has had a long-standing presence in the threat landscape, allowing malicious actors to gain remote access to targeted

Chinese Hackers Target Government Officials in Europe, South America, and Middle East

By Ravie Lakshmanan
A Chinese hacking group has been attributed to a new campaign aimed at infecting government officials in Europe, the Middle East, and South America with a modular malware known as PlugX. Cybersecurity firm Secureworks said it identified the intrusions in June and July 2022, once again demonstrating the adversary's continued focus on espionage against governments around the world. "PlugX is

Meet Borat RAT, a New Unique Triple Threat

By The Hacker News
Atlanta-based cyber risk intelligence company, Cyble discovered a new Remote Access Trojan (RAT) malware. What makes this particular RAT malware distinct enough to be named after the comic creation of Sacha Baron Cohen? RAT malware typically helps cybercriminals gain complete control of a victim's system, permitting them to access network resources, files, and power to toggle the mouse and

Australian Hacker Charged with Creating, Selling Spyware to Cyber Criminals

By Ravie Lakshmanan
A 24-year-old Australian national has been charged for his purported role in the creation and sale of spyware for use by domestic violence perpetrators and child sex offenders. Jacob Wayne John Keen, who currently resides at Frankston, Melbourne, is said to have created the remote access trojan (RAT) when he was 15, while also administering the tool from 2013 until its shutdown in 2019 as part

Microsoft Adds Default Protection Against RDP Brute-Force Attacks in Windows 11

By Ravie Lakshmanan
Microsoft is now taking steps to prevent Remote Desktop Protocol (RDP) brute-force attacks as part of the latest builds for the Windows 11 operating system in an attempt to raise the security baseline to meet the evolving threat landscape. To that end, the default policy for Windows 11 builds – particularly, Insider Preview builds 22528.1000 and newer – will automatically lock accounts for 10

Over a Dozen Flaws Found in Siemens' Industrial Network Management System

By Ravie Lakshmanan
Cybersecurity researchers have disclosed details about 15 security flaws in Siemens SINEC network management system (NMS), some of which could be chained by an attacker to achieve remote code execution on affected systems. "The vulnerabilities, if exploited, pose a number of risks to Siemens devices on the network including denial-of-service attacks, credential leaks, and remote code execution

High-Severity RCE Vulnerability Reported in Popular Fastjson Library

By Ravie Lakshmanan
Cybersecurity researchers have detailed a recently patched high-severity security vulnerability in the popular Fastjson library that could be potentially exploited to achieve remote code execution. Tracked as CVE-2022-25845 (CVSS score: 8.1), the issue relates to a case of deserialization of untrusted data in a supported feature called "AutoType." It was patched by the project maintainers in 

Hackers Exploiting Unpatched Critical Atlassian Confluence Zero-Day Vulnerability

By Ravie Lakshmanan
Atlassian has warned of a critical unpatched remote code execution vulnerability impacting Confluence Server and Data Center products that it said is being actively exploited in the wild. The Australian software company credited cybersecurity firm Volexity for identifying the flaw, which is being tracked as CVE-2022-26134. "Atlassian has been made aware of current active exploitation of a

Researchers Find New Malware Attacks Targeting Russian Government Entities

By Ravie Lakshmanan
An unknown advanced persistent threat (APT) group has been linked to a series of spear-phishing attacks targeting Russian government entities since the onset of the Russo-Ukrainian war in late February 2022. "The campaigns [...] are designed to implant a Remote Access Trojan (RAT) that can be used to surveil the computers it infects, and run commands on them remotely," Malwarebytes said in a

Watch Out! Hackers Begin Exploiting Recent Zyxel Firewalls RCE Vulnerability

By Ravie Lakshmanan
Image source: z3r00t The U.S. Cybersecurity and Infrastructure Security Agency on Monday added two security flaws, including the recently disclosed remote code execution bug affecting Zyxel firewalls, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Tracked as CVE-2022-30525, the vulnerability is rated 9.8 for severity and relates to a command injection flaw

Researchers Warn of Nerbian RAT Targeting Entities in Italy, Spain, and the U.K.

By Ravie Lakshmanan
A previously undocumented remote access trojan (RAT) written in the Go programming language has been spotted disproportionately targeting entities in Italy, Spain, and the U.K. Called Nerbian RAT by enterprise security firm Proofpoint, the novel malware leverages COVID-19-themed lures to propagate as part of a low volume email-borne phishing campaign that started on April 26, 2022. "The newly

Researchers Develop RCE Exploit for the Latest F5 BIG-IP Vulnerability

By Ravie Lakshmanan
Days after F5 released patches for a critical remote code execution vulnerability affecting its BIG-IP family of products, security researchers are warning that they were able to create an exploit for the shortcoming. Tracked CVE-2022-1388 (CVSS score: 9.8), the flaw relates to an iControl REST authentication bypass that, if successfully exploited, could lead to remote code execution, allowing

Back-to-School: Privacy Worries in a Remote Learning World

By Toni Birdsong

As the new school year gets underway, many students will be returning to the classroom in-person, while others will opt to continue hybrid or remote learning indefinitely. Unfortunately, for families choosing the latter, remote learning could come at the expense of their online privacy. 

According to the RAND Corporation’s 2020 research report, one in five U.S. school districts plan to offer online learning even after the pandemic ends. Many school districts are waiting to review the Centers for Disease Control (CDC) latest recommendations. Either way, there’s no better time for a data privacy refresh.  

Privacy-forward policies

Protecting your child’s privacy while remote learning requires a three-part investment of parents, students, and schools. One of the first steps in that direction is to understand your district’s privacy practices. To do that, ask to take a closer look at its approach to data consent, secondary data use, as well as its data collection and retention practices. 

Common privacy gaps

According to The Center for Democracy and Technology, there are five areas where schools may put a child’s privacy at risk. 

1. Digital assessments

Using student data to assess needs and launch connectivity and device programs can pose a privacy risk.  

Ask: To assess overall digital access, the school collected my child’s data. How will that data be used? 

2. Data sharing

Sharing student data with third parties, such as broadband and device providers, is a common practice that can pose a privacy risk.  

Ask: To connect my remote learner, the school shared my child’s data with the provider. Can the school ensure that data will be used by the third-party responsibly? May I view the data use policy?  

3. Monitoring protocols  

Schools now have apps that allow teachers to monitor student progress.   

Ask: With more teacher access to student devices and desktops, how can the school ensure that my child’s other data is secure?  

4. Loaner device security

Ongoing security and device management requirements should be established to avoid viruses and malicious activity.  

Ask: What security measures are in place on school-owned devices to protect my child’s content or personal information? Will my child’s activity be tracked?  

5. Low digital literacy IQ 

A lack of digital literacy and security knowledge on the part of students, families and even schools can put a child’s privacy at risk.  

Ask: What digital literacy resources or training do you offer teachers, staff, students and families?

Got Governance?

One sign your child’s privacy is in good hands is if your school has a solid Data Governance Policy (DGP) that staff, teachers, and students follow. A DGP establishes schools processes and structures for overseeing the school’s approach to management, usability, availability, quality and security of data and technology. 

Going a step further, a privacy-aware school will engage students, families, teachers, and administrators (and even third-party providers) about the importance of data use and closing privacy gaps. 

4 ways to get proactive with data privacy

1. Discuss, define privacy 

Rather than make assumptions, discuss what privacy is with your child. For example, with more time online, consider parental controls to filter risky content. Likewise, talk to your child about how to identify phishing scams and consider investing in security software that scans for malware and untrusted sites. 

2. Protect personal info

If your child uses video apps such as Zoom to connect remotely, be sure that personal information—such as birthdate, address, photographs, or a nickname—isn’t accidently visible in the background.  

3. Optimize privacy settings  

Whether your child uses Zoom, a chat app, website or another EdTech platform for learning, set privacy settings to provide maximum protection. Following the directions under “settings” of any new app are fast and easy.  

4. School directory opt-out

Under FERPA, the Family Educational Rights and Privacy Act, schools must notify you of your right to opt out of Directory Information at the start of the school year. Don’t opt-out? Schools can share Directory Information about their child with third parties without parental or student consent. 

If we could point to a positive consequence of the pandemic, it would be that with the sudden spike in connectivity during quarantine, data privacy concerns became more prevalent than ever—that shift deserves an A+. Moving forward, it’s critical for parents and schools to work together to create practices that protect online privacy for all students—on-site or remote.   

 

The post Back-to-School: Privacy Worries in a Remote Learning World appeared first on McAfee Blog.

7 Safety Tips to Schooling in a Digital World

By McAfee

This fall, many students are headed back-to-school full time. However, just as workplaces now accommodate for remote work, schools are accommodating hybrid learning environments. While this may signal the end of things like snow days, it’s also created a new, more flexible style of learning that relies on computers, online connectivity, and apps to connect students with teachers and learning resources. It’s also a trend that’s not without risk, as evidenced by the more than 900 cybersecurity incidents, including personal data breaches, since 2016, according to the K-12 Cybersecurity Resource Center. This new style of learning comes with many implications for cybersecurity that we’ll discuss below, along with ways to protect learners and students of all ages.

Digital School Safety Tips 

1. Set camera guidelines 

Cameras and video conferencing software have become an integral part of the online learning experience. In the early days of 2020, we saw growing pains in the form of Zoom bombing, unintended sharing, and, on the lighter side, people learning to use fake backgrounds with hilarious consequences. And while many of these wrinkles have been smoothed out, for online learners, the fact remains that privacy is at risk anytime they use a camera.  

Younger students:  

  • Work with your child and their instructors to figure out the most appropriate times to use the camera. When not using the camera on their device, teach your child how to cover it to ensure privacy. Many new laptops come with a manual switch that allows the camera to be blocked. 

Older students:  

  • Teens have more autonomy, and apps are probably a major part of their social and learning life. That’s why it’s a great idea to remind teens to never accept video chats, screen shares, instant messages, phone calls or files from strangers, even if it’s in an app they’re familiar with.

2. Use tools that protect your child while they’re learning online

The good news is that while we’re all navigating the new world of learning online, there are more tools than ever to help you do so safely. A comprehensive security suite, like one of McAfee’s products, contains many of these security tools in one package, including tools for:  

Younger students: 

  • Parental controls – A good parental controls suite allows you to not only restrict web site access, but also set limits on screen time and track activity on your child’s devices. McAfee offers parental controls in the form of McAfee Safe Family. 
  • Parent versions of learning apps – The app being used to teach an online classroom may offer a version for parents. It’s often a simpler version of the one your child is using, but it will allow you to become familiar with the software and may even offer some privacy settings. 

Older students: 

  • VPN – This is a powerful tool for protecting your privacy online. Teach your teens how to create a secure connection to the internet anytime they log in by using a VPN (virtual private network) to hide their activity and connection details from prying eyes. McAfee’s VPN uses bank-grade encryption to keep their private information secure. 

3. Invest wisely in your child’s learning tools 

Your child or teen’s portal to their online classroom is an important investment. After all, you’ll want them to be able to connect securely, communicate easily, and be able to handle any kind of online work they may need to do. Depending on the age of your child, this device may also have to be bomb-proof. Don’t worry some experts have already done the thinking for you with this list of computers for online learners. 

4. Recognize that some information should always stay private 

There are many apps being used to facilitate online learning. And chances are, students will have to register, log-in, and provide identification. Regardless of age, here’s what NOT to provide. 

  • Don’t sign up with a personal email address. Schools should provide an email address or a username and password. 
  • Don’t put too much personal information in the app profile. Keep location, phone number and dates of birth private if possible. 
  • Make sure your student always keeps their login info to education apps private and that they don’t share their account with anyone, including classmates. 

5. Online learning can be a family affair

Younger students: 

  • Create an online workspace that’s sufficiently quiet for your child to get their homework done, but also someplace that can be easily checked in on by you and other adults in your child’s life.  

Older students: 

  • Teens should expect that adults will be around and looking in on their activity online, whether they’re learning or talking to friends. You can model this with your own behavior by using devices openly and practicing good security habits. 

6. Introduce the concept of digital citizenship 

When students are learning in-person, the concept of being a good citizen is one that’s reinforced in the classroom and on the playground. Online, as students use forums, chats, and even social media to communicate, the concept of digital citizenship is just as important. 

  • Talk to your child and teen about what you expect from their conduct online. Monitor the apps they use for school and make sure they understand what is appropriate to write on them. After all, these messages may be visible to the school administrators, or even college admissions officials. Help them understand that creating a safe space to learn takes everyone’s effort, not just the teachers. 

7. In the brave new world of online learning, offline breaks are more important than ever. 

There’s a reason elementary schools have recess and high schools have lunch breaks. It gives kids time to step away from the books, stretch their legs, and refresh their minds. The same concept applies with online learning.  

Younger students:  

  •  Take a break at least every 30 minutes to stretch and walk around. 

Older students: 

  • A teen may have a longer attention span, but breaks are still important and, crucially, it’s important they don’t spend their break in front of another screen. 

More resources for improving digital wellness while learning online 

For more extensive information about any of the recommendations above, please visit these resources. 

Resources for parents 

Resources for all ages

The post 7 Safety Tips to Schooling in a Digital World appeared first on McAfee Blogs.

Prioritizing Security in a Remote Learning Environment 

By Jean Treadwell
Remote Learning

Prioritizing Security in a Remote Learning Environment 

Learning environments are not what they used to be, and as educational institutions deploy new technology to facilitate a safe and effective remote learning environment, their cyber vulnerabilities also increase. Canadian schools especially have seen a rise in ransomware attacks with the transition to online learning, opening the door for hackers to exploit student data and sabotage academic research. To combat the rising cybersecurity concerns, educators need to implement new measures to uphold secure and efficient distance learning environments without allowing student data and privacy to hang in the balance.

Why Education Has a Target on Its Back

Limiting disruptions remains a high priority for educators as they discover how to manage their remote classrooms. Although many teachers are familiar with supplemental technologies such as tablets and online programs, it’s another matter entirely to be completely dependent on them to support a fully virtual classroom.  When investing in online learning tools, educational institutions should not allow their concern for efficiency to overshadow an equally important requirement: safety.

The education sector has seen its fair share of cybersecurity attacks since the widespread shift to remote classrooms. According to Microsoft, the global education industry has the most malware attacks, even more than prominent industries such as business, finance, and healthcare. K-12 schools especially have experienced an uptick in ransomware and Distributed Denial of Service (DDoS).  Many Canadian schools are experiencing cyber security incidents, damaging the integrity of their student data and privacy. With hackers consistently seeking to take advantage of the vulnerabilities in new technology, this prompts further discussion into why education is such a highly targeted industry.

The rapid shift to remote learning is an obvious culprit for the increasing threat level, but higher education institutions were already vulnerable before the pandemic. Many students simply lack the proper security awareness when using their online devices. In Morphisec’s CyberSecurity Threat Index, more than 30% of higher education breaches were caused by students falling victim to email scams, misusing social media, or other careless online activities. Budgetary constraints are also to blame for increasing online attacks, as many schools lack adequate funding to support a robust cybersecurity infrastructure. Cybercriminals recognize the vast amount of student data that schools have on record, and this incentivizes them further to infiltrate their systems.

Many of the new remote learning technologies introduced during the pandemic have exposed the risks associated with a lack of stringent security measures. For example, until recently, Agora’s video conferencing software exhibited a vulnerability that would have allowed hackers to spy on video and audio calls. With a growing number of students accessing remote learning technologies through their schools’ networks, it’s especially critical for schools to re-evaluate their security protocols to safeguard their students.

Safeguarding the Virtual Classroom

Schools at all levels need to proactively secure their digital technologies and safeguard their students’ data integrity. With the right approach, students and educators can mitigate the risks of cyber threats. Here are four critical cybersecurity steps that schools should take immediately:

1.Enforce User Awareness Training

It only takes one person to allow a hacker to infiltrate a school system. Digital security training is a must to ensure that students and faculty can recognize and take the appropriate action for suspicious activities like phishing emails. For example, a common cyber threat is when hackers pose as school officials asking for important information such as tax information or identification information.

Since many of the learning technologies on the market are new to students and staff, it’s especially critical to understand the implications of a security breach and the necessary steps to mitigate risks.

2.User Access Control

The principle of “least privilege” can also help avoid a  cyber attack. This principle only allows users access to data and systems on a need-to-know basis and can mitigate data breaches that occur via unauthorized or unnecessary access. Hackers often try to infiltrate lower-level devices and accounts as a way to gain access to higher-value accounts and systems. Schools can take action by optimizing a list of what users have access to, which functions they have access to, and why. Ensuring that users have access to only what they need will limit attacks to smaller areas of the system and help protect the security ecosystem as a whole.

3.Update Security and Password Management Policies

An often overlooked but critical cybersecurity protocol is having a robust password management policy. These policies must also be in accordance with provincial and territorial legislation, which set guidelines and rules that govern how students and faculty use their devices and online learning technologies. Password management policies that encourage strong passwords and multi-factor authentication are essential to prevent password sharing and unrestricted access.

4.Third Party Vendor Management

Third-party technology vendors have become an integral component of distance learning, but they are also a vulnerability. Educational institutions need to ensure that they are properly managing their technology vendors so their students’ safety is prioritized above all else. Undergoing a thorough vetting process to evaluate third-party technology, as well as vendors’ terms and conditions, will help identify any security gaps that can create greater issues down the road.

Make Distance Learning Safe Learning

The ascendance of distance learning during the pandemic has given educators, students, and parents new insights into both the opportunities and challenges of not being in a physical classroom. One of the most critical is the importance of creating safe and secure virtual environments to ensure that students are safe. Despite the benefits that education technology provides, without proper training or technical safeguards in place, schools and students are left vulnerable to the dangers of external threats. By enhancing awareness of cyber threats and implementing a strong security strategy, educators and parents can start creating safer learning environments for students to thrive.

To stay updated on all things McAfee and on top of the latest consumer and mobile security threats, follow @McAfee_Home  on Twitter, subscribe to our email, listen to our podcast Hackable?, and ‘Like’ us on Facebook.

The post Prioritizing Security in a Remote Learning Environment  appeared first on McAfee Blogs.

❌