RESEARCHERS WARN OF 100,000 INDUSTRIAL CONTROL SYSTEMS EXPOSED ONLINE BY BILL TOULAS
Approximately 100,000 industrial control systems (ICS) were found on the public web--vulnerable to attackers--including critical infrastructure like power grids and water systems. The recently discovered threat, found using mass-scale scans to identify exposed devices and monitor over 40 million organizations worldwide, is said to affect many Fortune 1000 companies in 96 countries. While the situation improved since 2019, the United States, Canada, Italy, and the UK reportedly have the most exposed ICSs, with those in the Education, Technology, and Government sectors being among the least secure. In order to prevent potential state-sponsored attacks, organizations are encouraged to prioritize security measures like VPN access and multi-factor authentication for remote ICS access.
NEW CISA, NSA GUIDANCE HIGHLIGHTS PAIN POINTS IN IDENTITY AND SECURITY MANAGEMENT BY CHRIS RIOTTA
Federal agencies and the private sector struggle with implementing key security measures like multifactor authentication (MFA) and single sign-on (SSO), per guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA). Despite prior efforts, these practices aren't universally adopted due to issues like unclear terminology and security properties for MFA. The report highlights the vulnerabilities of SMS-based MFA and the complexity of deploying SSO, along with the need for "clarity, interoperability, and standardization" among MFA variations for more successful adoption. CISA and NSA call on vendors to invest in more secure MFA services and phishing-resistant authenticators.
MICROSOFT: STATE-BACKED HACKERS GROW IN SOPHISTICATION, AGGRESSIVENESS BY AJ VICENS
Microsoft researchers have noted in their most recent Digital Defense Report that Iranian cyber operations targeting Western entities are becoming more sophisticated and effective. According to the report, Iranian cyber operators have enhanced offensive capabilities and are conducting multi-pronged influence campaigns, especially in the Global South. Furthermore, Microsoft's report highlights the global cybersecurity landscape, emphasizing the rise of government-sponsored spying and influence operations, noting a shift away from high-profile cyberattacks to covert espionage with a focus on stealing information, monitoring communication, and manipulating content. The report also mentions a significant increase in human-operated ransomware incidents and the proliferation of private contractors supplying spyware and offensive cyber capabilities to governments.
'LOONEY TUNABLES' BUG OPENS MILLIONS OF LINUX SYSTEMS TO ROOT TAKEOVER BY ELIZABETH MONTALBANO
A critical buffer overflow flaw dubbed "Looney Tunables" in the GNU C Library (glibc) on Linux systems poses severe risks, allowing attackers to gain root privileges. This vulnerability affects Fedora, Ubuntu, and Debian systems and impacts IoT devices running Linux, making smart factories and connected equipment vulnerable. Researchers discovered the flaw and successfully exploited it, potentially leading to unauthorized data access and system alterations. A patch has been released for various Linux distributions, but organizations must act swiftly to protect their systems and data from potential compromise. Immediate patching is crucial due to the high-security sensitivity of the dynamic loader in glibc.
FBI WARNS OF SURGE IN 'PHANTOM HACKER' SCAMS IMPACTING THE ELDERLY BY SERGIU GATLAN
The FBI has issued a warning about a surge in "phantom hacker" scams targeting senior citizens in the U.S. These scams involve fraudsters posing as bank representatives, alleging hacking attempts on victims' accounts. They manipulate victims into granting access to their accounts and, if deemed valuable, instruct them to transfer funds to a supposed "secure" account controlled by the scammers. In some cases, impersonators claiming to be government representatives are used to convince victims further. Between January and June 2023, there were 19,000 complaints related to such scams, resulting in estimated losses of over $542 million. The FBI advises caution and never engaging with unsolicited pop-ups or sharing personal information. They emphasize that the government will not demand cryptocurrency or gift cards as payment. Victims are urged to report incidents to the FBI's Internet Crime Complaint Center (IC3).
