โพสต์ถูกสร้างโดย NCSA

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม(ICS) 20 รายการ เมื่อวันที่ 13 มิถุนายน 2567 คำแนะนำเหล่านี้ให้ข้อมูลที่ทันท่วงทีเกี่ยวกับปัญหาด้านความปลอดภัยช่องโหว่ และช่องโหว่ที่อยู่รอบ ๆ ICS ในปัจจุบัน มีดังต่อไปนี้

• ICSA-24-165-01 Siemens Mendix Applications
• ICSA-24-165-02 Siemens SIMATIC S7-200 SMART Devices
• ICSA-24-165-03 Siemens TIA Administrator
• ICSA-24-165-04 Siemens ST7 ScadaConnect
• ICSA-24-165-05 Siemens SITOP UPS1600
• ICSA-24-165-06 Siemens TIM 1531 IRC
• ICSA-24-165-07 Siemens PowerSys
• ICSA-24-165-08 Siemens Teamcenter Visualization and JT2Go
• ICSA-24-165-09 Siemens SICAM AK3/BC/TM
• ICSA-24-165-10 Siemens SIMATIC and SIPLUS
• ICSA-24-165-11 Siemens SCALANCE XM-400, XR-500
• ICSA-24-165-12 Siemens SCALANCE W700
• ICSA-24-165-13 Siemens SINEC Traffic Analyzer
• ICSA-24-165-14 Fuji Electric Tellus Lite V-Simulator
• ICSA-24-165-16 Rockwell Automation FactoryTalk View SE
• ICSA-24-165-17 Rockwell Automation FactoryTalk View SE
• ICSA-24-165-18 Rockwell Automation FactoryTalk View SE
• ICSA-24-165-19 Motorola Solutions Vigilant License Plate Readers
• ICSA-24-074-14 Mitsubishi Electric MELSEC-Q/L Series (Update B)
• ICSA-20-245-01 Mitsubishi Electric Multiple Products (Update G)

ทั้งนี้ CISA สนับสนุนให้ผู้ใช้และผู้ดูแลระบบตรวจสอบคำแนะนำ ICS ที่เผยแพร่ใหม่สำหรับรายละเอียดทางเทคนิคและการบรรเทาผลกระทบ รายละเอียดเพิ่มเติมที่ https://www.cisa.gov/news-events/alerts/2024/06/13/cisa-releases-twenty-industrial-control-systems-advisories

อ้างอิง
https://www.cisa.gov/news-events/alerts/2024/06/13/cisa-releases-twenty-industrial-control-systems-advisories

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Microsoft has unveiled a new cybersecurity program to support hospitals serving more than 60 million people living in rural America. In 2023, the healthcare sector reported more ransomware attacks than any other critical infrastructure sector and attacks involving ransomware against the healthcare sector were up nearly 130%. Cybersecurity attacks disrupt health care operations across the country and pose a direct threat to patient care and essential operations of hospitals. In rural communities these attacks can be devastating, particularly to smaller, independent Critical Access and Rural Emergency hospitals with limited means to prevent and remediate security risks and often the only healthcare option for many miles in the communities they serve. According to the National Rural Health Association, rural health clinics are one of the top targets for cyberattacks. The new Microsoft Cybersecurity Program for Rural Hospitals is designed to support the unique cybersecurity needs of these organizations. It will deliver free and low-cost technology services for these hospitals, along with free training and support. “Healthcare should be available no matter where you call home, and the rise in cyberattacks threatens the viability of rural hospitals and impact communities across the U.S.,” said Justin Spelhaug, corporate VP, Microsoft Philanthropies. “Microsoft is committed to delivering vital technology security and support at a time when these rural hospitals need them most.” For independent Critical Access Hospitals and Rural Emergency Hospitals, Microsoft will provide nonprofit pricing and discounts for its security products optimized for smaller organizations, providing up to a 75% discount. And for some larger rural hospitals already using eligible Microsoft solutions, the company will provide its most advanced security suite at no cost for one year. As part of the new program, the company also provides Windows 10 security updates to participating rural hospitals for at least one year at no additional cost. Microsoft will also provide free cybersecurity assessments through Microsoft and its trusted partners to evaluate risks and gaps and offer free cybersecurity training to staff in rural hospitals to help them better manage the day-to-day security of their systems.

ที่มาแหล่งข่าว
https://www.helpnetsecurity.com/2024/06/12/microsoft-launches-cybersecurity-program-to-tackle-attacks-protect-rural-hospitals/

The City of Cleveland, Ohio, is currently dealing with a cyberattack that has forced it to take citizen-facing services offline, including the public offices and facilities at Erieview and the City Hall. With a metropolitan area population of over 2 million people, Cleveland is a vital healthcare, manufacturing, finance, logistics, education, and technological hub and the most significant economic center in Ohio. The disruption was first disclosed yesterday when the City's authorities warned that public services were reduced to essential operations due to a cyber incident. A status update provided earlier today via a thread on X explains that the incident is still being investigated with the help of third-party experts. At the same time, the City Hall and Erieview will remain closed for a second day. The investigation so far has confirmed that taxpayer information held by the CAA and custom information held by public utility services was not accessed by the hackers. The update also notes that essential services concerning emergency services (911, police, fire), works, utilities, healthcare (EMS), and airport travel (Cleveland Hopkins and Burke Lakefront) have not been impacted by the cyber incident. The City's authorities promised to provide updates as soon as the ongoing investigation produced results, and concerned citizens are advised to call 311 for more information. At the time of writing, no ransomware groups have claimed responsibility for the attack on the City of Cleveland, and it is unclear what exactly has happened. Local media reported that Mayor Justin Bibb referred to the incident as a breach, while the City's IT commissioner, Kim Roy Wilson, stated that they had detected abnormal activity in the City's IT environment. Wilson told the media that it's essential to withhold details at this point so as not to risk hampering the ongoing investigation. The commissioner also stated that citizens needing critical documents or other services from impacted departments must be patient.

ที่มาแหล่งข่าว
https://www.bleepingcomputer.com/news/security/london-hospitals-face-blood-shortage-after-synnovis-ransomware-attack/

Industrial Sector

• ICS Patch Tuesday: Advisories Published By Siemens, Schneider Electric, Aveva, CISA
  "Several ICS vendors released advisories on Tuesday to inform customers about vulnerabilities found in their industrial and OT products."
  https://www.securityweek.com/ics-patch-tuesday-advisories-published-by-siemens-schneider-electric-aveva-cisa/

• NIST Publishes Draft OT Cybersecurity Guide For Water Sector
  "Networked control systems in municipal water systems are inescapable even for the localities that would prefer otherwise. New equipment with default remote access and an over-stretched repair workforce mean cutting off municipal water systems from the internet isn't a real option."
  https://www.bankinfosecurity.com/nist-publishes-draft-ot-cybersecurity-guide-for-water-sector-a-25505
  https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/securing-water-and-wastewater-utilities-project-description-final.pdf

• Rockwell's ICS Directive Comes As Critical Infrastructure Risk Peaks
  "Citing "heightened geopolitical tensions and adversarial cyber activity globally," industrial control systems (ICS) giant Rockwell Automation last month took the unusual step of telling its customers to disconnect their gear from the Internet. The move showcases not just growing cyber risk to critical infrastructure, but the unique challenges that security teams face in the sector, experts say."
  https://www.darkreading.com/ics-ot-security/rockwell-ics-directive-critical-infrastructure-risk-peaks

Vulnerabilities

• Google Warns Of Actively Exploited Pixel Firmware Zero-Day
  "Google has released patches for 50 security vulnerabilities impacting its Pixel devices and warned that one of them had already been exploited in targeted attacks as a zero-day. Tracked as CVE-2024-32896, this elevation of privilege (EoP) flaw in the Pixel firmware has been rated a high-severity security issue. "There are indications that CVE-2024-32896 may be under limited, targeted exploitation," the company warned this Tuesday."
  https://www.bleepingcomputer.com/news/security/google-warns-of-actively-exploited-pixel-firmware-zero-day/
  https://source.android.com/docs/security/bulletin/pixel/2024-06-01
  https://www.securityweek.com/google-warns-of-pixel-firmware-zero-day-under-limited-targeted-exploitation/

• Chrome 126, Firefox 127 Patch High-Severity Vulnerabilities
  "Google and Mozilla on Tuesday announced the release of Chrome 126 and Firefox 127 to the stable channel with patches for multiple high-severity memory safety vulnerabilities. Chrome 126 includes 21 security fixes, including 18 for defects reported by external researchers. The reporting researchers, Google notes in its advisory, received over $160,000 in bug bounty rewards for their findings."
  https://www.securityweek.com/chrome-126-firefox-127-patch-high-severity-vulnerabilities/

• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
  CVE-2024-4610 ARM Mali GPU Kernel Driver Use-After-Free Vulnerability
  CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2024/06/12/cisa-adds-two-known-exploited-vulnerabilities-catalog
  https://securityaffairs.com/164488/hacking/cisa-adds-arm-mali-gpu-kernel-driver-php-bugs-to-its-known-exploited-vulnerabilities-catalog.html

Malware

• Attacks Against Linux SSH Services Detected By AhnLab EDR
  "Secure SHell (SSH) is a standard protocol for secure terminal connections and is generally used for controlling remote Linux systems. Unlike Windows OS that individual users use for desktops, Linux systems mainly fulfill the role of servers providing web, database, FTP, DNS, and other services. Of course, Windows also supports these services as a server."
  https://asec.ahnlab.com/en/66695/

• Bondnet Using Miner Bots As C2
  "Bondnet first became known to the public in an analysis report published by GuardiCore in 20171 and Bondnet’s backdoor was covered in an analysis report on XMRig miner targeting SQL servers released by DFIR Report in 20222. There has not been any information on the Bondnet threat actor’s activities thereon, but it was confirmed that they had continued their attacks until recent times."
  https://asec.ahnlab.com/en/66662/

• Phone Scammers Impersonating CISA Employees
  "Impersonation scams are on the rise and often use the names and titles of government employees. The Cybersecurity and Infrastructure Security Agency (CISA) is aware of recent impersonation scammers claiming to represent the agency. As a reminder, CISA staff will never contact you with a request to wire money, cash, cryptocurrency, or use gift cards and will never instruct you to keep the discussion secret."
  https://www.cisa.gov/news-events/alerts/2024/06/12/phone-scammers-impersonating-cisa-employees
  https://www.bleepingcomputer.com/news/security/cisa-warns-of-criminals-impersonating-its-employees-in-phone-calls/
  https://www.bankinfosecurity.com/fraudsters-impersonate-cisa-in-money-scams-a-25501

• New Phishing Toolkit Uses PWAs To Steal Login Credentials
  "A new phishing kit has been released that allows red teamers and cybercriminals to create progressive web Apps (PWAs) that display convincing corporate login forms to steal credentials. A PWA is a web-based app created using HTML, CSS, and JavaScript that can be installed from a website like a regular desktop application. Once installed, the operating system will create a PWA shortcut and add it to Add or Remove Programs in Windows and under the /Users//Applications/ folder in macOS."
  https://www.bleepingcomputer.com/news/security/new-phishing-toolkit-uses-pwas-to-steal-login-credentials/

• Ransomware Attackers May Have Used Privilege Escalation Vulnerability As Zero-Day
  "The Cardinal cybercrime group (aka Storm-1811, UNC4393), which operates the Black Basta ransomware, may have been exploiting a recently patched Windows privilege escalation vulnerability as a zero-day. The vulnerability (CVE-2024-26169) occurs in the Windows Error Reporting Service. If exploited on affected systems, it can permit an attacker to elevate their privileges. The vulnerability was patched on March 12, 2024, and, at the time, Microsoft said there was no evidence of its exploitation in the wild. However, analysis of an exploit tool deployed in recent attacks revealed evidence that it could have been compiled prior to patching, meaning at least one group may have been exploiting the vulnerability as a zero-day."
  https://symantec-enterprise-blogs.security.com/threat-intelligence/black-basta-ransomware-zero-day
  https://thehackernews.com/2024/06/black-basta-ransomware-may-have.html
  https://therecord.media/black-basta-ransomware-zero-day-windows
  https://www.bleepingcomputer.com/news/security/black-basta-ransomware-gang-linked-to-windows-zero-day-attacks/
  https://www.securityweek.com/ransomware-group-may-have-exploited-windows-vulnerability-as-zero-day/
  https://www.theregister.com/2024/06/12/black_basta_ransomware_windows/

• Search & Spoof: Abuse Of Windows Search To Redirect To Malware
  "Trustwave SpiderLabs has detected a sophisticated malware campaign that leverages the Windows search functionality embedded in HTML code to deploy malware. We found the threat actors utilizing a sophisticated understanding of system vulnerabilities and user behaviors. Let’s break down the HTML and the Windows search code to better understand their roles in the attack chain."
  https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/search-spoof-abuse-of-windows-search-to-redirect-to-malware/
  https://www.bleepingcomputer.com/news/security/phishing-emails-abuse-windows-search-protocol-to-push-malicious-scripts/

• The Evolution Of QR Code Phishing: ASCII-Based QR Codes
  "Quishing—QR code phishing—is a rapidly evolving threat. Starting around August, when we saw the first rapid increase, we’ve also seen a change in the type of QR code attacks. It started with standard MFA authentication requests. It then evolved to conditional routing and custom targeting. Now, we’re seeing another evolution, into the manipulation of QR codes."
  https://blog.checkpoint.com/harmony-email/the-evolution-of-qr-code-phishing-ascii-based-qr-codes/

• STR RAT – Phishing Malware Baseline
  "STR RAT is a remote access trojan (RAT) written in Java that was first seen in 2020. Like other RATs, it gives threat actors full control when it is successfully installed onto a machine. STR RAT is capable of keylogging, stealing credentials, and even delivering additional malicious payloads. The malware receives a version update every year, on average. These updates correlate with the renewed use of STR RAT by threat actors. Currently, 60% of the STR RAT samples that Cofense analyzed from January 2023 to April 2024 are delivered directly to the email as opposed to an embedded link."
  https://cofense.com/blog/str-rat-phishing-malware-baseline/

• Worldwide Web: An Analysis Of Tactics And Techniques Attributed To Scattered Spider
  "In early 2024, we identified a current affiliate of the RansomHub RaaS group as a former Alphv/Black Cat affiliate. We assess with high confidence that the same affiliate is a present or former affiliate of the Scattered Spider threat group, also tracked as UNC3944, Muddled Libra, Octo Tempest, Scatter Swine, and Starfraud. Our high-confidence assessment is based on the following pieces of evidence observed by GuidePoint’s DFIR and GRIT practices:"
  https://www.guidepointsecurity.com/blog/worldwide-web-an-analysis-of-tactics-and-techniques-attributed-to-scattered-spider/
  https://www.darkreading.com/threat-intelligence/ransomhub-brings-scattered-spider-into-its-raas-fold
  https://www.infosecurity-magazine.com/news/scattered-spider-affiliated/

• Self-Replicating Morris II Worm Targets AI Email Assistants
  "The proliferation of generative artificial intelligence (GenAI) email assistants such as OpenAI’s GPT-3 and Google’s Smart Compose has revolutionized communication workflows. Unfortunately, it has also introduced novel attack vectors for cyber criminals. Leveraging recent advancements in AI and natural language processing, malicious actors can exploit vulnerabilities in GenAI systems to orchestrate sophisticated cyberattacks with far-reaching consequences. Recent studies have uncovered the insidious capabilities of self-replicating malware, exemplified by the “Morris II” strain created by researchers."
  https://securityintelligence.com/posts/morris-ii-self-replicating-malware-genai-email-assistants/

• Pause Off My Cluster: DERO Cryptojacking Takes a New Shape
  "We have detected a new variant of an ongoing cryptojacking campaign targeting misconfigured Kubernetes clusters in our customers’ cloud environments. In this incident, the threat actor abused anonymous access to an Internet-facing cluster to launch malicious container images hosted at Docker Hub, some of which have more than 10,000 pulls. These docker images contain a UPX-packed DERO miner named "pause"."
  https://www.wiz.io/blog/dero-cryptojacking-campaign-adapts-to-evade-detection
  https://thehackernews.com/2024/06/cryptojacking-campaign-targets.html

Breaches/Hacks/Leaks

• Life360 Says Hacker Tried To Extort Them After Tile Data Breach
  "Safety and location services company Life360 says it was the target of an extortion attempt after a threat actor breached and stole sensitive information from a Tile customer support platform. Life360 provides real-time location tracking, crash detection, and emergency roadside assistance services to more than 66 million members worldwide. In December 2021, it acquired Bluetooth tracking service provider Tile in a $205 million deal."
  https://www.bleepingcomputer.com/news/security/life360-says-hacker-tried-to-extort-them-after-tile-data-breach/
  https://www.theregister.com/2024/06/13/tile_life360_extortion/

• Toronto School Board Reports Ransomware Attack On Test Environment
  "Hackers attempted to attack a technology testing environment used by the Toronto District School Board (TDSB) with ransomware, officials said Wednesday. The school board is the largest in Canada and manages 582 schools for about 235,000 students."
  https://therecord.media/toronto-school-board-ransomware-attack

General News

• Forced-Labor Camps Fuel Billions Of Dollars In Cyber Scams
  "Greater collaboration between financial and law enforcement officials is needed to dismantle cybercrime scam centers in Cambodia, Laos, and Myanmar, which rake in tens of billions of dollars annually — and affect victims worldwide."
  https://www.darkreading.com/cyber-risk/forced-labor-camps-fuel-billions-of-dollars-in-cyber-scams

• Open-Source Security In AI
  "New AI products are coming onto the market faster than we have seen in any previous technology revolution. Companies’ free access and right to use open source in AI software models has allowed them to prototype an AI product to market cheaper than ever and at hypersonic speed."
  https://www.helpnetsecurity.com/2024/06/12/ai-open-source-security/

• Security And Privacy Strategies For CISOs In a Mobile-First World
  "In this Help Net Security interview, Jim Dolce, CEO at Lookout, discusses securing mobile devices to mitigate escalating cloud threats. He emphasizes that organizations must shift their approach to data security, acknowledging the complexities introduced by mobile access to cloud-based corporate data."
  https://www.helpnetsecurity.com/2024/06/12/jim-dolce-lookout-securing-mobile-devices/

• Police Arrest Conti And LockBit Ransomware Crypter Specialist
  "The Ukraine cyber police have arrested a 28-year-old Russian man in Kyiv for working with Conti and LockBit ransomware operations to make their malware undetectable by antivirus software and conducting at least one attack himself. The investigation was backed by information shared by the Dutch police who responded to a ransomware attack on a Dutch multinational, followed by data-theft extortion."
  https://www.bleepingcomputer.com/news/security/police-arrest-conti-and-lockbit-ransomware-crypter-specialist/
  https://therecord.media/ukraine-suspected-lockbit-conti-affiliate
  https://www.darkreading.com/cyberattacks-data-breaches/lockbit-and-conti-ransomware-hacker-busted-in-ukraine
  https://securityaffairs.com/164475/breaking-news/developer-crypter-conti-lockbit-ransomware.html

• Mass Exploitation: The Vulnerable Edge Of Enterprise Security
  "The cyber threat landscape in 2023 and so far 2024 has been dominated by mass exploitation. Previous WithSecure reporting on the professionalization of cybercrime noted the growing importance of mass exploitation as an infection vector, but the volume and severity of this vector have now truly exploded. Several recent reports indicate that mass exploitation may have overtaken botnets as the primary vector for ransomware incidents, and there has been a rapid tempo of security incidents caused by mass exploitation of vulnerable software including, but not limited to: MOVEit, CitrixBleed, Cisco XE, Fortiguard’s FortiOS, Ivanti ConnectSecure, Palo Alto’s PAN-OS, Juniper’s Junos, and ConnectWise ScreenConnect."
  https://labs.withsecure.com/publications/mass-exploitation-the-vulnerable-edge-of-enterprise-security
  https://www.infosecurity-magazine.com/news/withsecure-exploitation-edge/

• 70% Of Cybersecurity Pros Often Work Weekends, 64% Looking For New Jobs
  "Over 70% of cybersecurity professionals often have to work weekends to address security concerns at their organization, according to a new report by Bitdefender. This intense workload appears to correlate strongly with job dissatisfaction, with around two-thirds (64%) of the 1200 cyber professionals surveyed stating that they are planning on looking for a new job in the next 12 months."
  https://www.infosecurity-magazine.com/news/cyber-pros-weekends-new-jobs/

• Lessons From The Ticketmaster-Snowflake Breach
  "Last week, the notorious hacker gang, ShinyHunters, sent shockwaves across the globe by allegedly plundering 1.3 terabytes of data from 560 million Ticketmaster users. This colossal breach, with a price tag of $500,000, could expose the personal information of a massive swath of the live event company's clientele, igniting a firestorm of concern and outrage."
  https://thehackernews.com/2024/06/lessons-from-ticketmaster-snowflake.html

• White House Report Dishes Deets On All 11 Major Government Breaches From 2023
  "The number of cybersecurity incidents reported by US federal agencies rose 9.9 percent year-on-year (YoY) in 2023 to a total of 32,211, per a new White House report, which also spilled the details on the most serious incidents suffered across the government. Of the total number of incidents, the majority (38 percent) were classed as "improper usage," meaning a system was used in a way that violated the agency's acceptable use policies. The report stated that agencies have the capability to detect when security policies are being violated, but not the ability to prevent it from actually happening."
  https://www.theregister.com/2024/06/12/white_house_report/
  https://www.whitehouse.gov/wp-content/uploads/2024/06/FY23-FISMA-Report.pdf

อ้างอิง
Electronic Transactions Development Agency(ETDA)

Cyber Security Agency of Singapore (CSA)ได้เผยแพร่เกี่ยวกับ Google ที่มีการอัปเดตเพื่อแก้ไขช่องโหว่ที่มีความรุนแรงสูง ที่หมายเลขช่องโหว่ CVE-2024-32896 ที่ส่งผลต่อผลิตภัณฑ์ Pixel มีรายงานว่าช่องโหว่ดังกล่าวถูกนำไปใช้ประโยชน์อย่างแข็งขัน

การใช้ประโยชน์จากช่องโหว่ที่ประสบความสำเร็จอาจทำให้ผู้โจมตีที่ไม่ได้รับอนุญาตสามารถดำเนินการยกระดับสิทธิ์ได้

ช่องโหว่นี้ส่งผลต่อผลิตภัณฑ์ Pixel ที่รองรับทั้งหมด

ผู้ใช้งานผลิตภัณฑ์ที่ได้รับผลกระทบควรอัปเดตเป็นเวอร์ชันล่าสุดทันที
หากต้องการใช้การอัปเดตความปลอดภัย ผู้ใช้งาน Pixel ควรไปที่ การตั้งค่า > ความปลอดภัยและความเป็นส่วนตัว > ระบบและการอัปเดต > การอัปเดตความปลอดภัยแตะ ติดตั้งและรีสตาร์ทอุปกรณ์เพื่อดำเนินการอัปเดตให้เสร็จสิ้น

อ้างอิง
https://www.csa.gov.sg/alerts-advisories/alerts/2024/al-2024-070

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Healthcare Sector

• MicroDicom DICOM Viewer
  "Successful exploitation of these vulnerabilities could allow an attacker to both retrieve and plant medical image files on a victim's system and cause a stack-based buffer overflow, which could result in sensitive information disclosure and arbitrary code execution."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01

Industrial Sector

• Intrado 911 Emergency Gateway
  "Successful exploitation of this vulnerability could allow an attacker to execute malicious code, exfiltrate data, or manipulate the database."
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-04

• Rockwell Automation ControlLogix, GuardLogix, And CompactLogix
  "Successful exploitation of this vulnerability could compromise the availability of the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-01

• AVEVA PI Web API
  "Successful exploitation of this vulnerability could allow an attacker to perform remote code execution."
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-02
  AVEVA PI Asset Framework Client
  "Successful exploitation of this vulnerability could allow malicious code execution."
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03

Vulnerabilities

• Microsoft June 2024 Patch Tuesday Fixes 51 Flaws, 18 RCEs
  "Today is Microsoft's June 2024 Patch Tuesday, which includes security updates for 51 flaws, eighteen remote code execution flaws, and one publicly disclosed zero-day vulnerability. This Patch Tuesday fixed 18 RCE flaws but only one critical vulnerability, a remote code execution vulnerability in Microsoft Message Queuing (MSMQ)."
  https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2024-patch-tuesday-fixes-51-flaws-18-rces/
  https://www.cisa.gov/news-events/alerts/2024/06/11/microsoft-releases-june-2024-security-updates
  https://www.tripwire.com/state-of-security/vert-threat-alert-june-2024-patch-tuesday-analysis
  https://blog.talosintelligence.com/only-one-critical-issue-disclosed-as-part-of-microsoft-patch-tuesday/
  https://www.darkreading.com/vulnerabilities-threats/critical-msmq-rce-bug-microsoft-servers-complete-takeover
  https://www.helpnetsecurity.com/2024/06/11/cve-2024-30080-cve-2024-30103/
  https://www.securityweek.com/patch-tuesday-remote-code-execution-flaw-in-microsoft-message-queuing/
  https://www.theregister.com/2024/06/12/june_patch_tuesday/

• Adobe Plugs Code Execution Holes In After Effects, Illustrator
  "Software maker Adobe on Tuesday rolled out patches to fix security defects in several products and warned of the risk of code execution attacks on Windows and macOS platforms. As part of its scheduled Patch Tuesday updates, Adobe documented six security issues affecting three widely deployed products — Adobe Photoshop, Adobe After Effects and Adobe Illustrator — that could be exploited to take control of unpatched machines."
  https://www.securityweek.com/adobe-plugs-code-execution-holes-in-after-effects-illustrator/

• Fortinet Releases Security Updates For FortiOS
  "Fortinet has released security updates to address a vulnerability in FortiOS. A cyber threat actor could exploit this vulnerability to take control of an affected system."
  https://www.cisa.gov/news-events/alerts/2024/06/11/fortinet-releases-security-updates-fortios
  https://www.fortiguard.com/psirt/FG-IR-23-460

• QR Code SQL Injection And Other Vulnerabilities In a Popular Biometric Terminal
  "Biometric scanners offer a unique way to resolve the conflict between security and usability. They help to identify a person by their unique biological characteristics – a fairly reliable process that does not require the user to exert any extra effort. Yet, biometric scanners, as any other tech, have their weaknesses. This article touches on biometric scanner security from the red team’s perspective and uses the example of a popular hybrid terminal model to demonstrate approaches to scanner analysis. These approaches are admittedly fairly well known and applied to analysis of any type of device."
  https://securelist.com/biometric-terminal-vulnerabilities/112800/
  https://www.bankinfosecurity.com/chinese-made-biometric-access-system-has-24-vulnerabilities-a-25490

• JetBrains Warns Of IntelliJ IDE Bug Exposing GitHub Access Tokens
  "JetBrains warned customers to patch a critical vulnerability that impacts users of its IntelliJ integrated development environment (IDE) apps and exposes GitHub access tokens. Tracked as CVE-2024-37051, this security flaw affects all IntelliJ-based IDEs from 2023.1 onwards, where the JetBrains GitHub plugin is enabled and configured/used."
  https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-intellij-ide-bug-exposing-github-access-tokens/
  https://blog.jetbrains.com/security/2024/06/updates-for-security-issue-affecting-intellij-based-ides-2023-1-and-github-plugin/
  https://www.helpnetsecurity.com/2024/06/11/cve-2024-37051/

• You’ve Got Mail: Critical Microsoft Outlook Vulnerability Executes As Email Is Opened
  "In the ever-evolving landscape of cybersecurity, staying ahead of threats is paramount. At Morphisec, our team of dedicated researchers continuously strives to identify and mitigate emerging vulnerabilities to protect organizations worldwide. Morphisec Threat Labs researchers are disclosing a critical discovery that underscores the importance of timely updates and proactive security measures."
  https://blog.morphisec.com/cve-2024-30103-microsoft-outlook-vulnerability

• SAP Patches High-Severity Vulnerabilities In Financial Consolidation, NetWeaver
  "Enterprise software maker SAP on Tuesday announced the release of ten new and two updated security notes as part of its June 2024 Security Patch Day. SAP’s new set of patches includes two high-priority security notes, the most severe of which addresses a cross-site scripting (XSS) bug in Financial Consolidation. According to application security firm Onapsis, the security note addresses two XSS flaws in SAP’s product, collectively tracked as CVE-2024-37177 (CVSS score of 8.1)."
  https://www.securityweek.com/sap-patches-high-severity-vulnerabilities-in-financial-consolidation-netweaver/

• Apple Patches Vision Pro Vulnerability Used In Possibly ‘First Ever Spatial Computing Hack’
  "Apple on Monday updated visionOS, the operating system powering its Vision Pro virtual reality headset, to version 1.2, which addresses several vulnerabilities, including what may be the first security flaw that is specific to this product. visionOS 1.2 patches nearly two dozen vulnerabilities. However, a vast majority of them are in components that visionOS shares with other Apple products, such as iOS, macOS and tvOS."
  https://www.securityweek.com/apple-patches-vision-pro-vulnerability-used-in-first-ever-spatial-computing-hack/

Malware

• RansomHub. Because Every Abandoned Affiliate Needs a Home.
  "Sometimes life just isn’t fair. One day, you’re an intrepid little ALPHV/BlackCat affiliate going about your business and trying to make a dishonest living. The next, your partner-in-cybercrime scores big and closes shop, leaving you with no brand, no infrastructure, and no dignity. Where do you go from there? No worries, all abandoned affiliates are welcome to join RansomHub, a relatively new ransomware brand that many experienced threat actors now call home."
  https://blog.barracuda.com/2024/06/10/ransomhub--because-every-abandoned-affiliate-needs-a-home-

• Noodle RAT: Reviewing The New Backdoor Used By Chinese-Speaking Groups
  "Since 2022, we have been investigating numerous targeted attacks in the Asia-Pacific region that used the same ELF backdoor. Most vendors identify this backdoor as a variant of existing malware such as Gh0st RAT or Rekoobe. However, we unearthed the truth: this backdoor is not merely a variant of existing malware, but is a new type altogether. We suspect it is being used by Chinese-speaking groups engaged in either espionage or cybercrime. We dubbed this formerly undocumented malware as “Noodle RAT.”"
  https://www.trendmicro.com/en_us/research/24/f/noodle-rat-reviewing-the-new-backdoor-used-by-chinese-speaking-g.html

• Technical Analysis Of The Latest Variant Of ValleyRAT
  "ValleyRAT is a remote access trojan (RAT) that was initially documented in early 2023. Its main objective is to infiltrate and compromise systems, providing remote attackers with unauthorized access and control over infected machines. ValleyRAT is commonly distributed through phishing emails or malicious downloads. In the latest version, ValleyRAT introduced new commands, such as capturing screenshots, process filtering, forced shutdown, and clearing Windows event logs. Zscaler ThreatLabz recently identified a new campaign delivering the latest version of ValleyRAT, which involves multiple stages."
  https://www.zscaler.com/blogs/security-research/technical-analysis-latest-variant-valleyrat
  https://thehackernews.com/2024/06/china-linked-valleyrat-malware.html

• Dipping Into Danger: The WARMCOOKIE Backdoor
  "Elastic Security Labs observed a wave of email campaigns in late April targeting environments by deploying a new backdoor we’re calling WARMCOOKIE based on data sent through the HTTP cookie parameter. During initial triage, our team identified code overlap with a previously publicly reported sample by eSentire. The unnamed sample (resident2.exe) discussed in the post appears to be an older or deviated version of WARMCOOKIE. While some features are similar, such as the implementation of string obfuscation, WARMCOOKIE contains differing functionality. Our team is seeing this threat distributed daily with the use of recruiting and job themes targeting individuals."
  https://www.elastic.co/security-labs/dipping-into-danger
  https://www.bleepingcomputer.com/news/security/new-warmcookie-windows-backdoor-pushed-via-fake-job-offers/
  https://www.darkreading.com/cyberattacks-data-breaches/warmcookie-cyberattackers-backdoor-initial-access

• Update: CVE-2024-4577 Quickly Weaponized To Distribute “TellYouThePass” Ransomware
  "Recently, Imperva Threat Research reported on attacker activity leveraging the new PHP vulnerability, CVE-2024-4577. From as early as June 8th, we have detected attacker activity leveraging this vulnerability to deliver malware, which we have now identified to be a part of the “TellYouThePass” ransomware campaign."

https://www.imperva.com/blog/update-cve-2024-4577-quickly-weaponized-to-distribute-tellyouthepass-ransomware/
https://www.bleepingcomputer.com/news/security/tellyouthepass-ransomware-exploits-recent-php-rce-flaw-to-breach-servers/
https://www.bankinfosecurity.com/ransomware-gang-tellyouthepass-exploits-php-vulnerability-a-25491

• What a Show! An Amplified Internet Scale DNS Probing Operation
  "A global scale domain name system (DNS) probing operation that targets open resolvers has been underway since at least June 2023. We analyzed queries to Infoblox and many other recursive DNS resolvers in January 2024. While there are numerous commercial and academic DNS measurement operations conducted daily on the internet, this one stood out because of its size and the invasive structure of the queries. These probes utilize name servers in the China Education and Research Network (CERNET) to identify open DNS resolvers and measure how they react to different responses."
  https://blogs.infoblox.com/threat-intelligence/what-a-show-an-amplified-internet-scale-dns-probing-operation/
  https://thehackernews.com/2024/06/chinese-actor-secshow-conducts-massive.html

• **##### Breaches/Hacks/Leaks

• Pure Storage Confirms Data Breach After Snowflake Account Hack**
  "Pure Storage, a leading provider of cloud storage systems and services, confirmed on Monday that attackers breached its Snowflake workspace and gained access to what the company describes as telemetry information. While the exposed information also included customer names, usernames, and email addresses, it did not contain credentials for array access or any other data stored on customer systems."
  https://www.bleepingcomputer.com/news/security/pure-storage-confirms-data-breach-after-snowflake-account-hack/
  https://www.theregister.com/2024/06/11/pure_storage_snowflake_breach/

• Crypto Platform UwU Lend Dealing With $20 Million Theft
  "The UwU Lend crypto platform says it has made an offer to a hacker behind the theft of nearly $20 million worth of ETH. Early on Monday, several blockchain security companies reported an issue with the platform, warning that someone appeared to be siphoning what amounted to $19.3 million worth of ETH. UwU Lend is a decentralized finance (DeFi) protocol that allows people to deposit and borrow cryptocurrency."
  https://therecord.media/uwu-lend-reimbursing-crypto-theft-customers

General News

• Cloud Migration Expands The CISO Role Yet Again
  "The CISO role used to be focused primarily on information security — creating and implementing policies to safeguard an organization’s data and IT infrastructure from cybersecurity threats. However, as organizations rapidly migrate to cloud environments, the responsibilities and challenges for CISOs have expanded significantly. The cloud both increases the overall attack surface and introduces new compliance challenges."
  https://www.helpnetsecurity.com/2024/06/11/cisos-grc-frameworks/

• Security Providers View Compliance As a High-Growth Opportunity
  "85% of managed service and security providers face significant challenges maintaining compliance for customers, with lack of resources, expertise, or technology cited as the most common roadblocks to offering managed compliance, according to Apptega."
  https://www.helpnetsecurity.com/2024/06/11/security-compliance-maintaining-challenges/

• The CEO Is Next
  "If CEOs want to avoid being the target of government enforcement actions, they need to take a personal interest in ensuring that their corporation invests in cybersecurity."
  https://www.darkreading.com/cybersecurity-operations/the-ceo-is-next

• Phishing Attacks Targeting US And European Organizations Double
  "Phishing continues to be one of the most favored ways of compromising systems for hacking groups, Abnormal Security has found. In its latest report, Email Security Threats in Europe: Insights into Attack Trends, the email security provider observed that the volume of phishing attacks targeting organizations in Europe increased by 112.4% between April 2023 and April 2024. In the US, they rose by 91.5% over the same period."
  https://www.infosecurity-magazine.com/news/phishing-attacks-us-europe-double/

*** When Things Go Wrong: A Digital Sharing Warning For Couples**
"“When things go wrong” is a troubling prospect for most couples to face, but the internet—and the way that romantic partners engage both with and across it—could require that this worst-case scenario become more of a best practice."
https://www.malwarebytes.com/blog/news/2024/06/when-things-go-wrong-a-digital-sharing-warning-for-couples

• Top 10 Critical Pentest Findings 2024: What You Need To Know
  "One of the most effective ways for information technology (IT) professionals to uncover a company's weaknesses before the bad guys do is penetration testing. By simulating real-world cyberattacks, penetration testing, sometimes called pentests, provides invaluable insights into an organization's security posture, revealing weaknesses that could potentially lead to data breaches or other security incidents."
  https://thehackernews.com/2024/06/top-10-critical-pentest-findings-2024.html
  https://www.vonahi.io/pentest-report-2024

อ้างอิง
Electronic Transactions Development Agency(ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Google has revealed that it took down 1,320 YouTube channels and 1,177 Blogger blogs as part of a coordinated influence operation connected to the People's Republic of China (PRC). "The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs," Google Threat Analysis Group (TAG) researcher Billy Leonard said in the company's quarterly bulletin released last week. The tech giant said it also terminated Ads, AdSense, and Blogger accounts linked to two coordinated influence operations with ties to Indonesia that shared content supportive of the ruling party in the country. Another big cluster dismantled by Google involved a network of 378 YouTube channels that it said originated from a Russian consulting firm and disseminated content that projected Russia in a favorable light and denigrated Ukraine and the West. The company further terminated one AdSense account and blocked 10 domains from showing up in Google News and its Discover feed for mobile devices that spawned content in English and Norwegian about food, sports, and lifestyle topics. The coordinated operation, linked to individuals from the Philippines and India, was financially motivated, according to Google. The development comes as OpenAI and Meta revealed that they disrupted an influence operation orchestrated by a Tel Aviv-based political marketing firm called Stoic to propagate pro-Israel messaging in the U.S. and Canada amid the ongoing conflict in Gaza. The campaign began in October post the outbreak of war between Israel and Hamas.

ที่มาแหล่งข่าว
https://thehackernews.com/2024/06/google-takes-down-influence-campaigns.html

Microsoft is warning about the potential abuse of Azure Service Tags by malicious actors to forge requests from a trusted service and get around firewall rules, thereby allowing them to gain unauthorized access to cloud resources. "This case does highlight an inherent risk in using service tags as a single mechanism for vetting incoming network traffic," the Microsoft Security Response Center (MSRC) said in a guidance issued last week. "Service tags are not to be treated as a security boundary and should only be used as a routing mechanism in conjunction with validation controls. Service tags are not a comprehensive way to secure traffic to a customer's origin and do not replace input validation to prevent vulnerabilities that may be associated with web requests.” The statement comes in response to findings from cybersecurity firm Tenable, which found that Azure customers whose firewall rules rely on Azure Service Tags could be bypassed. There is no evidence that the feature has been exploited in the wild. The problem, at its core, stems from the fact that some of the Azure services allow inbound traffic via a service tag, potentially allowing an attacker in one tenant to send specially crafted web requests to access resources in another, assuming it has been configured to allow traffic from the service tag and does not perform any authentication of its own. At 10 Azure services have been found vulnerable: Azure Application Insights, Azure DevOps, Azure Machine Learning, Azure Logic Apps, Azure Container Registry, Azure Load Testing, Azure API Management, Azure Data Factory, Azure Action Group, Azure AI Video Indexer, and Azure Chaos Studio. "This vulnerability enables an attacker to control server-side requests, thus impersonating trusted Azure services," Tenable researcher Liv Matan said. "This enables the attacker to bypass network controls based on Service Tags, which are often used to prevent public access to Azure customers' internal assets, data, and services." In response to the disclosure in late January 2024, Microsoft has updated the documentation to explicitly note that "Service Tags alone aren't sufficient to secure traffic without considering the nature of the service and the traffic it sends." It's also recommended that customers review their use of service tags and ensure they have adopted adequate security guardrails to authenticate only trusted network traffic for service tags.

ที่มาแหล่งข่าว
https://thehackernews.com/2024/06/azure-service-tags-vulnerability.html

Cyber Security Agency of Singapore (CSA)ได้เผยแพร่เกี่ยวกับ SolarWinds ได้เปิดตัวการอัปเดตความปลอดภัยเพื่อแก้ไขช่องโหว่ที่มีความรุนแรงสูง ที่หมายเลข CVE-2024-28995 ส่งผลต่อผลิตภัณฑ์เซิร์ฟเวอร์ไฟล์ Serv-U การใช้ประโยชน์จากช่องโหว่ Directory Traversal ที่ประสบความสำเร็จอาจทำให้ผู้โจมตีที่ไม่ได้รับการรับรองความถูกต้องสามารถเข้าถึงไฟล์ที่ละเอียดอ่อนบนเครื่องของเหยื่อได้

ช่องโหว่นี้ส่งผลต่อเวอร์ชัน SolarWinds Serv-U เวอร์ชัน 15.4.2 HF 1 และเวอร์ชันก่อนหน้า

แนะนำผู้ใช้งานและผู้ดูแลระบบเวอร์ชันผลิตภัณฑ์ที่ได้รับผลกระทบควรอัปเดตเป็นเวอร์ชันล่าสุดทันที

อ้างอิง
https://www.csa.gov.sg/alerts-advisories/alerts/2024/al-2024-068

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Ransomware remains an ongoing threat for organizations and is the largest single cause of IT outages and downtime as 41% of data is compromised during a cyberattack, according to Veeam. “Ransomware is endemic, impacting 3 out of 4 organizations in 2023. AI is now enabling the creation of smarter, more advanced security, but it’s also facilitating growth in the volume of sophistication of attacks,” said Dave Russell, SVP, Head of Strategy at Veeam. “Our report delivers a clear message: ransomware attacks will continue, be more severe than predicted, and the overall impact will cost organizations more than they expect. Organizations must take action to ensure cyber resiliency and acknowledge that rapid, clean recovery matters most,” added Russell. Cyberattacks naturally affect an organization’s financial stability, but just as significant is the toll it has on teams and individuals. When a cyberattack strikes, 45% of respondents reported heightened pressure on IT and security teams. Additionally, 26% experienced a loss of productivity, while 25% encountered disruptions to internal or customer-related services. The report shows that the human impact of cyberattacks cannot be overstated. 45% of surveyed individuals cited increased workload post-attack, while 40% reported heightened stress levels and other personal challenges that are difficult to mitigate on ‘normal’ days. These challenges, coupled with existing organizational struggles, further underscore the importance of effective cyber defense strategies. Despite increased focus on cyber-preparedness, organizations still face a misalignment between their backup and cyber teams. For the third consecutive year, 63% of organizations find their backup and cyber teams lacking synchronization. Adding to the misalignment challenges in organizations, 61% of security professionals and 75% of backup admins believe that the teams need either ‘significant improvement’ or that a complete system overhaul is required

ที่มาแหล่งข่าว
https://www.helpnetsecurity.com/2024/06/07/ransomware-attacks-impact-cost-on-organizations/

Vulnerabilities

• No Way, PHP Strikes Again! (CVE-2024-4577)
  "Orange Tsai tweeted a few hours ago about “One of [his] PHP vulnerabilities, which affects XAMPP by default”, and we were curious to say the least. XAMPP is a very popular way for administrators and developers to rapidly deploy Apache, PHP, and a bunch of other tools, and any bug that could give us RCE in its default installation sounds pretty tantalizing.Fortunately, for defenders, the bug has only been exploited on Windows-based PHP installations (where PHP is specifically used in CGI mode), under some specific locales: Chinese (both simplified and traditional), and Japanese."
  https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
  https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
  https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
  https://www.bleepingcomputer.com/news/security/php-fixes-critical-rce-flaw-impacting-all-versions-for-windows/
  https://thehackernews.com/2024/06/new-php-vulnerability-exposes-windows.html
  https://www.bankinfosecurity.com/critical-php-vulnerability-threatens-windows-servers-a-25460
  https://securityaffairs.com/164302/breaking-news/php-critical-rce.html

• POC Exploit Code Published For 9.8-Rated Apache HugeGraph RCE Flaw
  "If you haven't yet upgraded to version 1.3.0 of Apache HugeGraph, now's a good time because at least two proof-of-concept exploits for a CVSS 9.8-rated remote command execution bug in the open-source graph database have been made public. Apache HugeGraph lets developers build applications based on graph databases and is commonly used in Java 8 and Java 11 environments. In late April, the Apache Software Foundation disclosed a critical vulnerability, tracked as CVE-2024-27348, in versions of HugeGraph-Server 1.0.0 before April’s 1.3.0 release. Now exploit code to find and crack such systems is on GitHub."
  https://www.theregister.com/2024/06/07/poc_apache_hugegraph/
  https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/
  https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9

• 1/6 | How We Hacked Multi-Billion Dollar Companies In 30 Minutes Using a Fake VSCode Extension
  "30 minutes. 30 minutes is how long it took us to develop, publish, and polish a Visual Studio Code (The most popular IDE on the planet with over 15m monthly users) extension that changes your IDE’s colors while leaking all your source code to a remote server. We wrote the code, designed the assets, registered a domain, published the extension, generated fake reviews, got our first victim, and reached trending status on the VSCode Marketplace (A page that gets 4.5 million views a month), and confirmed to be installed inside multiple multi-billion dollar market cap companies, all within 30 minutes of work."
  https://medium.com/@amitassaraf/the-story-of-extensiontotal-how-we-hacked-the-vscode-marketplace-5c6e66a0e9d7
  https://www.bleepingcomputer.com/news/security/malicious-visual-studio-code-extensions-with-millions-of-installs-discovered/

• SolarWinds Flaw Flagged By NATO Pen Tester
  "SolarWinds has released its version 2024.2, including a variety of new features and upgrades, along with patches for three different security vulnerabilities.Notably, one high-severity SWQL injection bug, tracked under CVE-2024-28996 (CVSS 7.5), was reported to SolarWinds security by Nils Putnins, a penetration tester affiliated with the North Atlantic Treaty Organization (NATO), the company reported along with the new release. The other flaws fixed in the latest SolarWinds update included a high-severity cross-site scripting flaw, tracked under CVE-2024-29004 (CVSS 7.1), and a medium-severity race condition vulnerability affecting the Web console, tracked under CVE-2024-28999 (CVSS 7.1), the company said."
  https://www.darkreading.com/vulnerabilities-threats/solarwinds-flaw-flagged-by-nato-pen-tester
  https://www.helpnetsecurity.com/2024/06/07/cve-2024-28995/
  https://www.securityweek.com/solarwinds-patches-high-severity-vulnerability-reported-by-nato-pentester/
  https://securityaffairs.com/164270/security/solarwinds-flaws-serv-u-platform.html

• Multiple Vulnerabilities In WooCommerce Amazon Affiliates Plugin
  "This blog post is about WooCommerce Amazon Affiliates (WZone) plugin vulnerabilities. If you're a WooCommerce Amazon Affiliates (WZone) user, please deactivate and delete the plugin since there is still no known patched version."
  https://patchstack.com/articles/multiple-vulnerabilities-in-woocommerce-amazon-affiliates-plugin/
  https://www.infosecurity-magazine.com/news/security-flaws-found-woocommerce/

Malware

• New Agent Tesla Campaign Targeting Spanish-Speaking People
  "A new phishing campaign was recently captured by our FortiGuard Labs that spreads a new Agent Tesla variant targeting Spanish-speaking people. Security researchers have detected Agent Tesla campaigns from time to time for years. Agent Tesla is a well-known .Net-based Remote Access Trojan (RAT) designed to stealthily infiltrate victim’s computers and steal their sensitive information, such as their computer’s hardware information, login user information, keystrokes, email contacts, web browser cookies files, system clipboard data, screenshots, and basic information like login user name, computer name, OS information, CPU and RAM information, as well as saved credentials in widely installed software."
  https://www.fortinet.com/blog/threat-research/new-agent-tesla-campaign-targeting-spanish-speaking-people
  https://hackread.com/phishing-campaign-stealthy-jpgs-drop-agent-tesla/

• Decoding Router Vulnerabilities Exploited By Mirai: Insights From SonicWall’s Honeypot Data
  "SonicWall recently identified a significant increase in Mirai honeypot activity. In this deep dive, we explore the evolution of Mirai, who is most at risk and the best ways to mitigate attacks."
  https://blog.sonicwall.com/en-us/2024/06/decoding-router-vulnerabilities-exploited-by-mirai-insights-from-sonicwalls-honeypot-data/

• Dutch Political Websites Hit By Cyber Attacks As EU Voting Starts
  "The 2024 European Parliament election started in the Netherlands today, June 6, 2024, and will continue through June 9 in the other 26 countries that are part of the European Union. Cloudflare observed DDoS attacks targeting multiple election or politically-related Internet properties on election day in the Netherlands, as well as the preceding day. These elections are highly anticipated. It’s also the first European election without the UK after Brexit."
  https://blog.cloudflare.com/dutch-political-websites-hit-by-cyber-attacks-as-eu-voting-starts
  https://www.bleepingcomputer.com/news/security/ddos-attacks-target-eu-political-parties-as-elections-begin/

Breaches/Hacks/Leaks

• Christie's Starts Notifying Clients Of RansomHub Data Breach
  "British auction house Christie's is notifying individuals whose data was stolen by the RansomHub ransomware gang in a recent network breach. Christie's discovered that it was the victim of a security breach that affected some of its systems on May 9, 2024. After becoming aware of the event, Christie's took measures to secure its network and hired external cybersecurity experts to help investigate the incident's impact."
  https://www.bleepingcomputer.com/news/security/christies-starts-notifying-clients-of-ransomhub-data-breach/

• 'New York Times Source Code' Leaks Online Via 4chan
  "A 4chan user claims to have leaked 270GB of internal New York Times data, including source code, via the notorious image board. According to the unnamed netizen, the information includes "basically all source code belonging to The New York Time Company," amounting to roughly 5,000 repositories and 3.6 million files now available for download from peer-to-peer networks. Details on how to get the files were shared by the poster on 4chan."
  https://www.theregister.com/2024/06/07/4chan_nyt_code/
  https://www.bleepingcomputer.com/news/security/new-york-times-source-code-stolen-using-exposed-github-token/
  https://securityaffairs.com/164280/data-breach/new-york-times-source-code-leaked.html

• Hackers Claim They Breached Telecom Firm In Singapore
  "A financially motivated hacker claims to have stolen over 34 gigabytes of data belonging to Singapore-based Telecom company Absolute Telecom PTE Ltd. Information Security Media Group could not immediately verify the legitimacy of the data. The sample data appear to include internal data such as login details, passwords and subscribers information."
  https://www.bankinfosecurity.com/hackers-claim-they-breached-telecom-firm-in-singapore-a-25461

General News

• Microsoft Reverses Course, Makes Recall Feature Opt-In Only After Security Backlash
  "Microsoft announced changes on Friday to its controversial Recall feature that will allow users to proactively opt in to the tool before it is activated on devices. Recall allows the company’s new line of Windows 11 Copilot+ devices to screenshot every action a person takes on their PC. Microsoft CEO Satya Nadella hailed the tool as a way to “recreate moments from the past” — allowing customers to look back on their previous actions and search for things they may have forgotten."
  https://therecord.media/microsoft-reverses-course-recall-opt-in
  https://cyberscoop.com/microsoft-rolls-back-dumbest-cybersecurity-move-in-a-decade/
  https://www.securityweek.com/microsoft-bows-to-public-pressure-disables-controversial-windows-recall-by-default/
  https://www.helpnetsecurity.com/2024/06/07/windows-recall-changes/
  https://www.zdnet.com/article/after-brutal-critiques-microsoft-recall-will-get-these-major-privacy-and-security-changes/
  https://www.theregister.com/2024/06/07/microsoft_recall_changes/
  https://thehackernews.com/2024/06/microsoft-revamps-controversial-ai.html

• Developing a Plan To Respond To Critical CVEs In Open Source Software
  "In 2020, the SolarWinds incident served as a wake-up call for the tech industry, highlighting the urgent need for organizations to refine their response strategies to critical CVEs (common vulnerabilities and exposures) and security incidents. It prompted many companies to scrutinize their operational frameworks, particularly the transparency and security of their open source supply chain. Organizations recognized the critical need to bridge gaps in their processes and to empower developers with the knowledge of secure development practices, and began figuring out how to guide developers to using secure open source components."
  https://www.darkreading.com/vulnerabilities-threats/developing-plan-to-respond-to-critical-cves-open-source-software

• Cyber Insurance Isn’t The Answer For Ransom Payments
  "Ransomware remains an ongoing threat for organizations and is the largest single cause of IT outages and downtime as 41% of data is compromised during a cyberattack, according to Veeam. “Ransomware is endemic, impacting 3 out of 4 organizations in 2023. AI is now enabling the creation of smarter, more advanced security, but it’s also facilitating growth in the volume of sophistication of attacks,” said Dave Russell, SVP, Head of Strategy at Veeam."
  https://www.helpnetsecurity.com/2024/06/07/ransomware-attacks-impact-cost-on-organizations/

• 26% Of Organizations Lack Any Form Of IT Security Training
  "26% of organizations don’t provide IT security training to end-users, according to Hornetsecurity. The Hornetsecurity survey, which compiled feedback from industry professionals worldwide, also reveals that 8% of organizations offer adaptive training that evolves based on the results of regular security tests."
  https://www.helpnetsecurity.com/2024/06/07/organizations-it-security-training-effectiveness/

• #Infosec2024: Cyber Resilience Means Being Willing To Learn From a Crisis
  "Most CISOs now plan on the basis that a cyber-attack or data breach will happen, but there is still work to do to if organizations are to survive a crisis and recover, warned industry experts. Effective cyber crisis management is a key part of resilience. According to a panel of CISOs and cyber experts at Infosecurity Europe, security leaders need to develop, update and above all rehearse their crisis management plans."
  https://www.infosecurity-magazine.com/news/infosec2024-cyber-resilience-learn/

• #Infosec2024: Collaboration Is Key To An Effective Security Culture
  "Security leaders need to foster a culture where their colleagues do more than just follow the rules, according to a CISO panel at Infosecurity Europe. Creating a security culture is about more than just encouraging people in the business to report incidents, although this remains important. CISOs should also aim to create environments where the business actively looks to work with security teams. This, in turn, means explaining how security helps everyone in the business meet their goals."
  https://www.infosecurity-magazine.com/news/infosec2024-collaboration-security/

อ้างอิง
Electronic Transactions Development Agency(ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cyber Security Agency of Singapore (CSA)ได้เผยแพร่เกี่ยวกับ PHP ได้เปิดตัวการอัปเดตความปลอดภัยเพื่อแก้ไขช่องโหว่ร้ายแรง ที่หมายเลข CVE-2024-4577 ซึ่งส่งผลต่อการติดตั้งที่ใช้ PHP ในโหมด CGI ช่องโหว่ดังกล่าวมีคะแนน Common Vulnerability Scoring System (CVSSv3 9.8) รหัสการหาประโยชน์แบบพิสูจน์แนวคิดที่กำหนดเป้าหมายไปที่ช่องโหว่นี้ได้รับการรายงานต่อสาธารณะแล้ว

การใช้ประโยชน์จากช่องโหว่การแทรก CGI argument ที่ประสบความสำเร็จอาจทำให้ผู้โจมตีที่ไม่ได้รับการรับรองความถูกต้องสามารถดำเนินการโค้ดจากระยะไกลโดยอำเภอใจบนเซิร์ฟเวอร์ PHP และช่องโหว่ดังกล่าวส่งผลกระทบต่อ PHP เวอร์ชันทั้งหมดที่ทำงานบน Windows OS

ผู้ใช้งานและผู้ดูแลระบบของเวอร์ชัน PHP ที่ได้รับผลกระทบควรอัปเดตเป็นเวอร์ชันล่าสุดทันที

อ้างอิง
https://www.csa.gov.sg/alerts-advisories/alerts/2024/al-2024-067

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand