Tag Archive for: Urged

Organizations urged to patch critical ransomware vulnerability 

/in


The Cybersecurity and Infrastructure Security Agency June 15 urged organizations to apply Progress Software updates  to the MOVEit Transfer web application to prevent ransomware attackers from exploiting a critical vulnerability used to steal data. The FBI and CISA alerted (https://www.aha.org/news/headline/2023-06-09-agencies-take-steps-protect-against-latest-clop-ransomware-tactics) organizations to the vulnerability last week.
 
“The notorious Russia-linked ransomware gang CLOP is exploiting previously unknown software flaws in MOVEit Transfer to target hospitals, health systems, corporations and government agencies, resulting in a serious ransomware threat against critical infrastructure,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Due to the scope and scale of organizations targeted, this strategic cyberthreat may be related to ongoing geopolitical tensions with Russia. The fact that the Russian security services do not cooperate with the U.S. and allied law enforcement agencies, provides a permissive environment for these Russia-based groups to operate from, with or without the explicit approval of the Russian government. It is strongly recommended that any instance of the MOVEit application be identified and that it be immediately disconnected from all networks and the internet until this threat is fully resolved. This is also a good opportunity to review all file transfer systems within your environments for necessity, security and patching.” 
 
For more information, see AHA’s Cybersecurity Advisory or contact Riggi at [email protected]. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity. 

Source…

Android users urged to delete these 19 Google Play Store apps infected with money-sucking malware

/in


Millions of Android users are being warned to check their phone for a string of apps which have been hijacked my malicious viruses.

There are three main viruses currently using 19 apps to steal sensitive information and secretly sign up users to premium services, monetising the infection.

One of the malware strains has already been downloaded more than three million times.

Watch the latest News on Channel 7 or stream for free on 7plus >>

Because Android is an open source operating system, it can run any third-party app, unlike iOS.

While this makes devices more customisable, it also leaves them open to harmful cyber attacks, with malware commonly hidden in the coding of seemingly harmless apps.

According to the experts at MalwareFox, cyber criminals download real apps from the Google Play Store, and inject malicious viruses into the backend coding of those programs, before re-uploading them to the store under a new name.

Malware is always adapting and finding new ways to invade devices, but cybersecurity experts are always on the hunt for them.

Here are the viruses currently doing the rounds, and the apps they are hiding in, according to MalwareFox.

Joker Spyware

This spyware gathers sensitive data like contact lists and SMS messages, and can register the device for premium services without consent.

It is hiding in the following apps:

  • Simple Note Scanner – com.wuwan.pdfscan
  • Universal PDF Scanner – com.unpdf.scan.read.docscanuniver
  • Private Messenger – com.recollect.linkus
  • Premium SMS – com.premium.put.trustsms
  • Blood Pressure Checker – com.bloodpressurechecker.tangjiang
  • Cool Keyboard – com.colate.gthemekeyboard
  • Paint Art
  • Color Message.

Harly Trojan

This Trojan uses China Telecom’s code — 46011, according to Malware experts at Kaspersky, which say it gives clues to suggest the malware developers are located in China.

It can also subscribe users to premium services in an invisible window to monetise the infection.

It is hiding in the following apps:

  • Fare Gamehub and Box
  • Hope Camera-Picture Record
  • Same Launcher and Live Wallpaper
  • Amazing Wallpaper
  • Cool Emoji Editor and Sticker

Autolycos Malware

This malware has already been downloaded more than three million times, according to PCrisk.

It also…

Source…

Billions of Android and iPhone owners urged to check signs a criminal is hiding in your device – don’t lose everything

/in


SECURITY experts have warned smartphone users about major signs that criminals are hoping to hack their device.

Androids and iPhones are pretty safe gadgets but no device is fully hackproof, according to cybersecurity experts at Trend Micro.

Hackers have several techniques when it comes to infiltrating smartphonesCredit: Getty

They wrote in a recent blog post: “Unfortunately, no device can ever be 100% hackproof, and the iPhone is no exception.”

The blog lists three potential ways that a hacker can infiltrate your phone.

They’re all pretty common and you may have some of the red flags on your device right now.

EVIL APPS

The first hacking route the experts pointed out was “malicious apps.”

It’s normal to download apps onto your smartphone, but cybercriminals rely on you not checking what you’re downloading.

You have to be wary of all apps you download onto your device and make sure you’ve double checked the permissions that they want to access.

Try reading the apps reviews and only downloading from the Google Play Store or Apple App Store.

DANGEROUS WI-FI

The Trend Micro experts also warned against using insecure Wi-Fi networks, especially public Wi-Fi.

Most read in Phones & Gadgets

Cybercriminals can take advantage of your need to be online and steal data from your device.

Even the FBI has warned to be wary of public Wi-Fi.

“Preventing internet-enabled crimes and cyber intrusions requires each of us to be aware and on guard,” the FBI wrote in a recent announcement.

“Be careful when connecting to a public Wi-Fi network and do not conduct any sensitive transactions, including purchases, when on a public network.”

PHISHING MESSAGES

The third threat on the list could be lurking in your email app or text message inbox.

Phishing emails and texts sit waiting on devices, often containing dangerous links, and attachments.

Delete any suspicious messages without clicking on links or revealing any private information.

Source…

Ethical hackers urged to respond to Computer Misuse Act reform proposals

/in


Ethical hackers, security researchers and consultants, and the community at large are being urged to step up and make their voices heard as the government explores a series of proposed changes to the Computer Misuse Act (CMA) of 1990.

The long-awaited consultation, which has been running since February, is seeking views on a number of legislative changes, including giving new powers to law enforcement agencies and closing existing loopholes that make it easier for malicious actors to get away with misusing purloined data.

However, when the consultation was launched, campaigners who want to see the law reformed to better protect cyber security professionals from prosecution under outdated sections of the 33-year-old CMA were left disappointed because rather than lay out concrete proposals for the community to consider, the government merely said more work was needed on this point.

Among other things, Westminster wants to consider questions such as how to safeguard the UK’s ability to act against cyber criminals if legal defences for hacking are implemented; how to ensure any defences do not provide cover for offensive actions; and what levels of training, standards and certifications need to be in place for security professionals.

Nevertheless, Casey Ellis, founder and CEO of crowdsourced security platform Bugcrowd, is calling on the community to have its say on the basis that interested parties need to contribute to ensure the government is as well-informed as possible.

“It’s still important that as many as possible individuals and organisations have their say on this,” he said. “The UK needs a revised act that not only better defines the difference between the activities of malicious attackers who have no intent to obey the law in the first place, and those who hack in good faith, discovering and disclosing vulnerabilities so they can be addressed before they are exploited.

Bugcrowd, which is contributing to the consultation through the Cybersecurity Policy Working Group (CPWG) and the Hacker Policy Coalition, said that the most significant way in which community members could help would be to comment on the potential of a statutory legal defence for hacking if…

Source…