← Cybersecurity Headlines
Cybersecurity Headlines
EPA warns of critical risks, Four million WordPress sites exposed, Sextortion scams bypass filters
00:08:21
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Tuesday, November 19, 2024. I'm Lauren Verno. EPA Warns of Critical Risk in Drinking Water Infrastructure A report from the EPA's Office of Inspector General reveals vulnerabilities in over 300 US drinking water systems potentially affecting service for 110 million people now. Among the thousand and sixty two systems assessed, 97 systems serving 27 million individuals had critical or high severity issues. Exploitable flaws could lead to denial of service attacks, physical infrastructure damage, or compromised customer information. The OIG went on to say that if a threat actor were to exploit any of the vulnerabilities they discovered, not only would service be disrupted, but it could cause irreparable physical damage to the drinking water infrastructure. Four million WordPress sites exposed described as, quote, one of the most serious vulnerabilities ever discovered in their 12 year history. End quote Researchers warn of a critical flaw in the really simple security plugin for WordPress sites. With a CVSS score of 9.8, the vulnerability affects over 4 million sites, allowing attackers to gain full administrative access to those with two factor authentication enabled by exploiting improper error handling in the plugin's REST API. Users are strongly urged to upgrade to version 9.1.2, where the issue has been patched Sextortion Scams Bypass Microsoft Security Filters Sextortion scams are getting more sophisticated. Threat actors are exploiting the Microsoft 365 admin portal to send those emails using legitimate O365MC and Microsoft.com address, which is able to bypass spam filters and reach users focused inboxes by manipulating browser tools to bypass character limits in the Message Centers Share feature. Scammers send detailed extortion claiming to have caught your spouse cheating or include pictures of your home demanding Bitcoin payments. Microsoft is aware of the issue and investigating, but server side restrictions have not yet been implemented. Foreign Attack on Library of Congress the Library of Congress has confirmed a cyber breach involving an alleged foreign actor into the unauthorized access of emails between Congressional offices and Library staff, including those from the Congressional Research Service. Now that happened between January and September of this year. While the breach did not impact the House or Senate IT networks or the US Copyright Office systems, the Library is working to determine which specific communications were compromised. Thanks to today's episode sponsor Threat Locker do zero day exploits and supply chain attacks keep you up at night? Worry no more. You can harden your security with Threat Locker. Threat Locker helps you take a proactive default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US Based support team. To learn more about how Threat Locker can keep your organization running efficiently and protected from ransomware, visit threatlocker.com that's T H R E A T L O C K E R AI Company out Quarter of a million in cyberattack AI company I Learning Engines reported a cyber attack that resulted in the theft of a 250,000 doll wire payment. Now, in an SEC filing, the company explained the hacker accessed its network, misdirected the payment and then deleted several email messages. The company says the wire payment has not been recovered. I Learning Engines provides automation tools to more than a thousand companies in various sectors including healthcare, education and retail. Phobos ransomware operator extradited to US A Russian national linked to the Phobos ransomware operation was extradited from South Korea to face cybercrime charges in the U.S. the Phobos ransomware as a service gang, which has been active since 2020, is responsible for breaches of over 1,000 entities globally, including schools, hospitals and nonprofits, resulting in over 16 million in ransomware payments. The accused was identified by the Justice Department as a key administrator and is accused of facilitating the distribution of ransomware, extorting victims and profiting from the attacks. He faces a 13 count indictment with a potential of 20 years in prison per wire fraud charge if convicted. Palo Alto responds to fourth exploited Flaw Palo Alto Networks issued an advisory about a critical, unauthenticated remote code execution vulnerability and its Expedition firewall management tool, which is under active exploitation. This marks the fourth vulnerability in Expedition to be exploited in just a week, following two additional critical flaws added to CISA's known exploited vulnerabilities catalog. Palo Alto has released patches to address the issue, which affects exposed firewall management interfaces, and the company says it is actively working to mitigate the threats. Oklahoma Medical center hit by Ransomware Great Plains Regional Medical center in Oklahoma is notifying over 133,000 individuals about a ransomware attack that compromised personal data in early September. The attackers access and encrypted files exfiltrating sensitive information including names, Social Security numbers, health insurance details and medical records, according to Security Week. No threat actor has taken credit for the attack to be successful. In working in cybersecurity, you need an inquisitive mind with an eye for problem solving. Yet so many organizations are turning a blind eye to talent who lack technical degrees. How do we move past this kind of criteria to find the talent we need for our security programs. That's one of the segments we'll be digging into on this week's episode of the CISO Series podcast. Look for the episode Once you show me your diploma, I'll explain why we don't gatekeep and your favorite podcast app. I'm Lauren Verno reporting for the CISO series.
- [08:06]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.