Security daily (27-04-2020)

IAM Access Analyzer flags unintended access to S3 buckets shared through access points

Customers use Amazon Simple Storage Service (S3) buckets to store critical data and manage access to data at scale. With Amazon S3 Access Points, customers can easily manage shared data sets by creating separate access points for individual applications. Access points are unique hostnames attached to a bucket and customers can set distinct permissions using […] (AWS Security Blog)

Hackers spoof SBA to try to compromise companies' computers

With the U.S. Small Business Administration continuing to play a high-profile role in getting cash to companies that are struggling because of the coronavirus pandemic, cybercriminals are stepping up their efforts to steal money from those very firms. Research published Monday by IBM’s incident response team shows that attackers are spoofing the SBA in emails to try to install a remote hacking tool capable of stealing passwords and accessing webcams. They are exploiting attention on a nascent SBA program that offers up to $10 million in lending per business. If an unsuspecting recipient opens the emails found by IBM, a data-stealing remote access trojan (RAT) known as Remcos can take control of the person’s computer. It is another example of how, as U.S. agencies have opened their spigots to provide hundreds of billion of dollars in relief to American businesses during the pandemic, cybercriminals have looked to pounce. The hackers are “exploiting the […] The post Hackers spoof SBA to try to compromise companies' computers appeared first on CyberScoop. (CyberScoop)

Researchers used a GIF to prove they could access Microsoft Teams user data

Zoom isn’t the only video conferencing service attracting scrutiny from security researchers. Microsoft Teams, the technology giant’s professional collaboration tool, included a software bug that could have made it possible for hackers to steal data. Hackers could have used a malicious GIF to scrape user data from Microsoft Teams user accounts, spreading through an organization’s entire roster of employees who use the service, researchers from CyberArk announced Monday. The issue existed for three weeks between the end of February through mid-March, when much of the U.S. started to telework in response to the coronavirus pandemic. “The amount of data that goes into these applications is enormous and often includes confidential information from user names and passwords to top-secret business information – making them prime targets for attackers,” Omer Tsarfati, a CyberArk researcher, said in a blog post. CyberArk did not point to any evidence the issue had been exploited in […] The post Researchers used a GIF to prove they could access Microsoft Teams user data appeared first on CyberScoop. (CyberScoop)

A GIF image could have let hackers hijack Microsoft Teams at your firm

A critical vulnerability has been patched in the Microsoft Teams work collaboration platform after security researchers discovered a way in which hackers could compromise accounts and steal data with a seemingly harmless .GIF image. Read more in my article on the Bitdefender Business Insights blog. (Graham Cluley)

Don’t vote for me and Smashing Security in the EU Security awards

The seventh annual European Cybersecurity Blogger Awards are now open to the public vote. Let them know what your favourite security blogs, podcasts, Twitter accounts etc are… Here’s my explanation of why you shouldn’t vote for me in various categories. (Graham Cluley)

5 common mistakes that lead to ransomware

Here are five simple tips that will help you keep ransomware out and your precious data in (Naked Security)

Web shell warning issued by US and Australia

The US NSA and its Australian counterpart the ASD have published a set of guidelines to help companies avoid a common kind of attack: web shell exploits. (Naked Security)

Monday review – the hot 16 stories of the week

It's weekly roundup time! (Naked Security)

UK Spies Will Need Artificial Intelligence

(News ≈ Packet Storm)

Israel Government Tells Water Treatment Companies To Change Passwords

(News ≈ Packet Storm)

Microsoft Teams Could Be Pwned With A Gif

(News ≈ Packet Storm)

New iOS Text Bomb Bug Can Crash Your iPhone

(News ≈ Packet Storm)

How An Image Could've Let Attackers Hack Microsoft Teams Accounts

Microsoft has patched a worm-like vulnerability in its Teams workplace video chat and collaboration platform that could have allowed attackers to take over an organization's entire roster of Teams accounts just by sending participants a malicious link to an innocent-looking image.

The flaw, impacting both desktop and web versions of the app, was discovered by cybersecurity researchers at (The Hacker News)

GDPR Compliance Site Leaks Git Data, Passwords

Researchers discovered a .git folder exposing passwords and more for a website that gives advice to organizations about complying with the General Data Protection Regulation (GDPR) rules. (Threatpost)

Hackers Mount Zero-Day Attacks on Sophos Firewalls

A pre-auth SQL injection bug leading to remote code execution is at the heart of a data-stealing campaign against XG firewalls, using the Asnarok trojan. (Threatpost)

U.S. Universities Hit With ‘Adult Dating’ Spear-Phishing Attack

More than 150,000 emails spreading the Hupigon RAT that use adult dating as a lure have been uncovered, with almost half being sent to U.S. university and college email addresses. (Threatpost)


/security-daily/ 28-04-2020 23:44:24