The holiday season is a time when people are shopping, looking for bargains, and rushed. Cybercriminals know this and have scams to fit the season. But still steal your money, credit cards, and more. This Insights looks at the scams and offers ways to be safer.
A vulnerability that has existed for over 10 years in an older version of Cisco Adaptive Security Appliance is under attack. The vulnerability cannot be patched so Cisco is advising customers to upgrade to a version of the ASA not affected by this vulnerability.
CISA, the official cybersecurity agency has identified serious vulnerabilities in a number of products and services. One of them is rated at 10.0, the highest possible score meaning it is very dangerous. This article provides more information and suggestions to be safer.
In yet another use of legitimate cyber services and tools to deliver malware, a Russian Advanced Persistent Threat, APT, group is using Cloudflare encrypted tunnels to deliver its malware.
The flaws found in these frameworks are serious. Flaws discovered earlier were on the server side. These flaws are on the client side and can result in attackers being able to execute code on your systems. With the ability to execute code, nothing on your systems is safe.
In a type of attack called malware free, cybercriminals gain access through social engineering of the help desk. It is surprisingly successful and can cause permanent loss of an account to the attackers.
Attackers claim to have breached Ford and stolen large quantities of data. But what really happened is the information is from a 3rd party and is already publicly available. The attackers’ hopes were to get Ford to pay them to not release it. This isn’t the first time attackers have claimed to have breached a large company and stolen sensitive data. But it turns out to be false or at least not nearly as serious as the attackers claimed.
Oracle has issued a patch for serious zero-day vulnerability in their Agile Product Lifecycle Management. Be sure to install the patch if your use this product.
A few weeks ago, it was reported that North Koreans have created an elaborate network to gain legal employment in the United States. This is used to steal information from legitimate companies and to use the earnings as a way to circumvent sanctions. Now the scheme gets more elaborate by impersonating real US firms to provide fake employment histories and references. All to fund the North Korean missile programs.
Two vulnerabilities in Palo Alto Networks devices are being exploited. One has a CVSS score of 9.3 which is very serious and the other a score of 6.9, lower but still serious. When the two are combined they give hackers authentication bypass and privilege escalation.