Tag Archive for: library

Bellingham, Wash., Library Says 735 Patrons Affected by Hack

/in


(TNS) — Bellingham Public Library has reported a data breach affecting “a limited number” of patrons, part of a recent attack on the Whatcom County Library System, city officials said Thursday, July 21.

“A recent data breach affecting Whatcom County Library System’s computer networks also resulted in the unauthorized downloading of some Bellingham Public Library patron data. No data was downloaded directly from Bellingham Public Library or city of Bellingham computer systems,” said Janice Keller, the city’s communications director.

A total of 735 Bellingham Public Library patrons are affected, Keller said in the emailed statement.


“Our library and city teams, in collaboration with Whatcom County Library System, are working swiftly to address this incident and take all necessary and required steps to address it. The investigation into this incident is ongoing,” she said.

Bellingham Public Library has some 89,898 total accounts, Keller said. There are about 60,000 active card holders, according to the library website.

Both the Bellingham and the Whatcom County libraries share a catalog and an electronic management system, and patrons can borrow materials from either library.

In June, an apparent malware attack crippled some Whatcom County library systems, including its phones, email and some digital services..

Affected Bellingham library patrons were informed of the breach, which included their name, birth date, library account number, and library password or PIN.

“Although the investigation is ongoing, we have no reason to believe any additional patron data has been exposed,” Library Director Rebecca Judd said in a letter to affected patrons that was shared with The Bellingham Herald.

©2022 The Bellingham Herald, Distributed by Tribune Content Agency, LLC.

Source…

RCE Vulnerability In UnRAR Library Affected Zimbra Platform

/in


A severe remote code execution vulnerability affected the Zimbra email client. The bug typically existed in the UnRAR library that could trigger RCE on the Zimbra platform. Thankfully, the bug received a fix before malicious exploitation.

Zimbra UnRAR Library Vulnerability

Researchers from Sonar recently shared insights about a severe security flaw affecting the Zimbra email platform.

Specifically, the researchers found a zero-day vulnerability in a third-party UnRAR utility used in Zimbra that could trigger RCE. Exploiting the bug didn’t even require authentication. Describing the bug, CVE-2022-30333, the file write vulnerability in the RarLab’s unrar binary, the researchers stated,

An attacker is able to create files outside of the target extraction directory when an application or victim user extracts an untrusted archive. If they can write to a known location, they are likely to be able to leverage it in a way leading to the execution of arbitrary commands on the system.

Although, the bug didn’t directly affect Zimbra. Nonetheless, exploiting it could let an attacker access the sent and received emails on the compromised email server. An adversary could also deploy backdoors on compromised servers, steal credentials and other data, and gain access to other unauthorized areas on the network. Such explicit access became possible due to the unhindered permissions to UnRar utility for Zimbra.

The researchers have shared the technical details of the vulnerability in their post.

Patch Deployed

Following this discovery, Sonar researchers reported the matter to RarLab, and “gave a heads-up” to Zimbra for an upcoming fix.

Eventually, RarLab patched the vulnerability with UnRar binary version 6.12. Hence, all UnRar utility users should get this patched version or later to receive the fix.

Besides, Zimbra also addressed the glitch by configuring 7z as default for extracting RAR archives by Amavis instead of UnRar.

Let us know your thoughts in the comments.

Source…

Hackers breached library system earlier than initially known

/in


Source…

Picus Threat Library Is Updated for Trojans Targeting Banks in Latin America

/in


Picus Threat Library Is Updated for Trojans Targeting Banks in Latin America

Picus Labs has updated the Picus Threat Library with new attack methods for Krachulka, Lokorrito, Zumanek Trojans that are targeting banks in Brazil, Mexico, and Spain. In this blog, techniques used by these malware families will be explored.

Banking trojans have a significant role in the cybercrime scene in Latin America. According to Eset, 11 different malware families that target banks in Spanish and Portuguese-speaking countries share TTPs, indicating that threat actors are cooperating on some level. For example, the same or similar custom encryption schemes are used by these malware families. In this blog, we will be focusing on 3 malware families called Krachulka, Lokorrito, and Zumanek.

Let’s start with Krachulka. As a spyware, it gathers classified information from infected systems without the consent of the user and sends gathered information to remote threat actors.

Lokkorito and Zumanek act like a classic Remote Access Trojan (RAT). They go one step further than Krachulka and not only collect information from infected systems but also perform malicious operations such as infecting the target with other malware and performing denial-of-service (DoS) attacks.

Test your security controls now: Prevent Log4Shell Exploits with Picus

Techniques used by Krachulka, Lokkorito and Zumanek

Krachulka, Lokkorito, and Zumanek malware families utilize 26 techniques and sub-techniques under 10 tactics in the MITRE ATT&CK framework. This section lists malicious behaviors of these malware families by categorizing them using the MITRE ATT&CK v10.0 framework.

1. Initial Access

  • T1566.01 Phishing: Spearphishing Attachment
  • T1566.02 Phishing: Spearphishing Link

2. Execution

  • T1059 Command and Scripting Interpreter
  • T1059.003 Command and Scripting Interpreter: Windows Command Shell  
  • T1059.005 Command and Scripting Interpreter: Visual Basic 
  • T1059.007 Command and Scripting Interpreter: JavaScript/JScript

3. Persistence

  • T1547.001 Boot or Logon Autostart execution: Registry Run Keys/Startup Folder
  • T1574.002 Hijack Execution Flow: DLL Side-Loading

4.Defense Evasion

  • T1140 Deobfuscate/Decode Files or Information
  • T1220 XSL Script Processing
  • T1497.001 Virtualization/Sandbox Evasion: System…

Source…