In today’s cybersecurity news…
Microsoft warns it lost some customers’ security logs for a month
This warning comes as a result of a bug that prevented critical logs for some enterprise customers from being consistently collected during the first three weeks of September. This data is used to detect suspicious traffic, behavior, and login attempts on a network, thus its absence increases the chances for attacks to go undetected. For some clients, this problem continued until October 3. Even though they fixed the bug using safe deployment practices, the company failed to identify the new problem, and it took a few days to detect it. Researcher Kevin Beaumont says he knows of at least two companies who did not receive a notification about the issue. A list of the Microsoft services impacted is available in the show notes to this episode.
Omni Family Health data breach impacts almost half a million individuals
Omni Family Health is a nonprofit healthcare organization that focuses on underserved populations in California, providing primary care, dental care, behavioral health, and preventative services. The organization discovered a security breach on August 7, after claims about stolen information had been leaked on the dark web. The data stolen include standard PII along with health insurance details and medical information. The Hunters group is claiming responsibility.
Internet Archive breached again through stolen access tokens
The Internet Archive has been breached again, this time on their Zendesk email support platform. This follows two previous attacks this month, a data breach which saw the theft of user data for 33 million users, as well as a DDoS attack by the pro-Palestinian group BlackMeta. According to BleepingComputer, for this Zendesk breach, people who had submitted removal requests received warnings that the organization had been breached as “they did not correctly rotate their stolen authentication tokens.”
Egress shows how spammers are getting around phishing defenses
In the cat and mouse game of sending spam to clients, both attackers and defenders are using natural language processors (NLPs) to write better emails or detect spam patterns respectively. The threat intelligence unit of Egress is now showing how email services that use NLPs to calculate whether an email is safe are now getting manipulated through the increased use of random text, legitimate links, or whitespace. This is based on the premise that if enough “safe” elements are detected in an email, the email security application will be delivered to the victim, despite the possible presence of malicious attachments. According to a report from Egress, this is due in part to time pressure, specifically, “for some email security tools, if an email takes too long to scan, it will be released before the scan is complete.”
Thanks to today’s episode sponsor, SpyCloud
CISA adds Veeam flaws to its Known Exploited Vulnerabilities catalog
The addition of the Veeam Backup and Replication flaw, with a CVSS score of 9.8 to the KEV catalog follows a report from Sophos researchers that states ransomware operators are exploiting the vulnerability to create rogue accounts and deploy malware. Veeam did release security updates last month to address multiple vulnerabilities including this one. Inclusion into the KEV catalog means federal agencies must fix the vulnerability promptly. In this case, by November 7.
Hackers reportedly impersonate cyber firm ESET to target organizations in Israel
A group of as-yet unidentified hackers is attempting to infect some Israeli organizations with wiper malware delivered via phishing emails that appear to come from the cybersecurity organization ESET. According to researcher Kevin Beaumont, the hackers “appear to have hosted malicious files on ESET servers, he said, indicating they were able to breach the company’s defenses.” ESET has confirmed that a security incident that affected its partner company in Israel last week did occur, but denies Beaumont’s claim that its Israeli branch’s infrastructure was compromised in the attack.
Severe flaws in five E2EE cloud storage platforms used by millions
According to analysis from researchers at ETH Zurich, the platforms Sync, pCloud, Icedrive, Seafile, and Tresorit, collectively used by more than 22 million people, have weaknesses including implementations that allow a malicious actor to inject files, tamper with data, or gain access to user files. BleepingComputer reached out to all five providers for comment on the researchers’ threat model. Sync said they are addressing the issues, Tresorit’s said their system would be unaffected by such attacks, Seafile had no comment, and Icedrive and pCloud did not respond.
North Korean IT workers land jobs then demand ransoms
A new twist on the North Korean information technology (IT) workers looking for western work scam, many who do who obtain employment under false identities in Western companies are now not just stealing intellectual property, but are also demanding ransoms in order to not leak it. This is part of the overall revenue generation strategy typical of North Korean cybercrime. In some cases the North Korean workers are sent to countries like China and Russia, where they pretend to be freelancers looking for potential job opportunities. They have been caught stealing the identities of legitimate individuals residing in the U.S. to achieve the same goals. They have also been found to steal the identities of legitimate individuals residing in the U.S. to achieve the same goals. Another technique is “making requests for changes to delivery addresses for company-issued laptops, often re-routing them to intermediaries at laptop farms, who are responsible for installing remote desktop software that allow the North Korean actors to connect to victims’ networks.”(The Hacker News)