SBS CyberSecurity - In The Wild 176

 

 

In The Wild - CyberSecurity Newsletter Welcome to the 176th issue of In The Wild, SBS' weekly CyberSecurity newsletter. The objective of this newsletter is to share threat intelligence, news articles that are relevant, new and updated guidance, and other information to help you make better cybersecurity decisions. Follow SBS CyberSecurity on Social Media for more articles, stories, news, and resources!           Below, you will find some of the latest-and-greatest news stories, articles, videos, and links from the past week in cybersecurity. Some of the following stories have been shared by consultants, others by the SBS Institute, and others yet simply been found in the far corners of the Internet. We hope you find the following stories relevant, interesting, and – most of all – useful. Enjoy. [Hacker Hour] Common Questions about Business Continuity Planning SBS Educational Resources A business continuity plan is a strategic collection of documents, procedures, and other information that prepares a business for interruptions that arise from unexpected events or situations. Join SBS on June 30, 2020, at 3:00PM (Central) as we address the most common questions/issues that arise when creating and maintaining a strong business continuity plan. Read Here »     Turn on MFA Before Crooks Do It For You Krebs on Security Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don't take advantage of these added safeguards may find it far more difficult to regain access when their account gets hacked, because increasingly thieves will enable multi-factor options and tie the account to a device they control. Here's the story of one such incident. Read Here »   Popular Mobile Banking Apps Are Riddled With Security Flaws TechRepublic A study of banking apps for iOS and Android has led researchers to conclude that "none of the tested mobile banking applications has an acceptable level of security." Performed by IT security vendor Positive Technologies, the study tested 14 banking apps available on both iOS and Android that had more than 500,000 downloads each. Despite the small sample size, there are reasons to pay attention to the results.  Every single app contained vulnerabilities, and three were common to all of them: A lack of obfuscation, no protection against code injection and repackaging, and code that contained names of classes and methods. Read Here »   No, The U.S. Has Not Suffered The Biggest Cyber-Attack In History Forbes As hundreds of thousands of people reported mobile carriers and internet services down, and 'DDoS' started trending on Twitter, Anonymous laid the blame on China and suggested a major cyber-attack was underway. Here's what actually happened. Early in the afternoon of June 15, people across the U.S. started noticing that they were unable to make calls or send text messages. Customer complaints soon popped up on social media, suggesting multiple mobile carriers were all experiencing outages. Internet service providers, the social media platforms themselves, and online services from gaming to banking were all apparently going down like dominoes. Read Here »     Do you know which SBS Institute Certification Programs are coming up? Check out the Certification Calendar and share with your clients. Find Out Here! »   AWS Mitigated a 2.3 TBPS DDoS Attack, the Largest Ever ZDNet Amazon said its AWS Shield service mitigated the largest DDoS attack ever recorded, stopping a 2.3 Tbps attack in mid-February this year. The incident was disclosed in the company's AWS Shield Threat Landscape [PDF], a report detailing web attacks mitigated by Amazon's AWS Shield protection service. The report didn't identify the targeted AWS customer but said the attack was carried out using hijacked CLDAP web servers and caused three days of "elevated threat" for its AWS Shield staff. Read Here »   Ransomware Operators Lurk On Your Network After Their Attack Bleeping Computer When a company suffers a ransomware attack, many victims feel that the attackers quickly deploy the ransomware and leave so they won't get caught. Unfortunately, the reality is much different as threat actors are not so quick to give up a resource that they worked so hard to control. Instead, ransomware attacks are conducted over time, ranging from a day to even a month, starting with a ransomware operator breaching a network. Read Here »   Maze Ransomware Adds Ragnar Locker To Its Extortion Cartel Bleeping Computer A second ransomware gang has partnered with Maze Ransomware to use their data leak platform to extort victims whose unencrypted files were stolen. Before encrypting a victim's network, most network-targeting ransomware operations will steal a victim's unencrypted files. These files are then used as leverage by threatening to release them publicly on data leak sites if a ransom is not paid. Last week, we reported that the LockBit ransomware had teamed up with Maze Ransomware to use their data leak platform and share intelligence to drive successful extortions. Read Here »   The Law Of Momentum: How To Become Unstoppable Darius Foroux On May 30, 2020, Space X and NASA launched a rocket into space. It was the first time NASA worked with a private company—an important milestone in the history of space travel. It takes an unimaginable amount of energy to launch a rocket into space. The Falcon 9 rocket from Space X weighs 1.2 million pounds (549 thousand kilograms). The key to everything in life that requires motion is this question: How much force do you need to get an object moving? Read Here » 10 Other Interesting Links From This Week There were too many fantastic reads from this past weeks' worth of cybersecurity and technology news, so here are a few additional quick-hit links for your reading pleasure:       Krebs on Security: When Security Takes a Backseat to Productivity       Krebs on Security: FEMA IT Specialist Charged in ID Theft, Tax Refund Fraud Conspiracy       Bleeping Computer: 79 Netgear router models risk full takeover due to unpatched bug       Bleeping Computer: Hacker arrested for stealing, selling PII of 65K hospital employees       The Hacker News: New Ripple20 Flaws Put Billions of Internet-Connected Devices at Risk of Hacking       ZDNet: Adobe wants users to uninstall Flash Player by the end of the year       ZDNet: Security surprise - Four zero-days spotted in attacks on researchers' fake networks       Forbes: Goodbye SMS - Google Confirms Powerful New Update For Millions Of Users       Infosecurity Magazine: COVID19 Attacks Still Less Than 2% of Total Threats       CRN: ConnectWise Partners Hit By Ransomware Via Automated Flaw