CERT-SE:s veckobrev v.34
En grekisk leverantör av naturgas, ett franskt sjukhus och en leverantör till flygbolag har den senaste tiden utsatts för utpressningsvirus. Ytterligare organisationer berättar om både försök till och genomförda angrepp och ett felaktigt meddelande om “Luftangrepp, fara” har gått ut i Blekinge. Dessutom blir det som vanligt ett antal fördjupningar och mer tekniska analyser.
Trevlig helg önskar CERT-SE!
Nyheter i veckan
Software developer cracks Hyundai car security with Google search (17 aug)
https://www.theregister.com/2022/08/17/software_developer_cracks_hyundai_encryption/
PayPal Phishing Scam Uses Invoices Sent Via PayPal (18 aug)
https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent-via-paypal/
iOS Privacy: Announcing InAppBrowser.com (18 aug)
https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
Personuppgiftsincident anmäld (19 aug)
https://www.regionkalmar.se/nyhetslista/personuppgiftsincident-anmald28/
LockBit ransomware blames Entrust for DDoS attacks on leak sites (22 aug)
https://www.bleepingcomputer.com/news/security/lockbit-ransomware-blames-entrust-for-ddos-attacks-on-leak-sites/
Norska Oljefonden: Vi utsätts för allvarliga cyberangrepp varje dag (22 aug)
https://sverigesradio.se/artikel/norska-oljefonden-vi-utsatts-for-allvarliga-cyberangrepp-varje-dag
Hiding a phishing attack behind the AWS cloud (22 aug)
https://www.theregister.com/2022/08/22/aws_cloud_phishing/
Greek natural gas operator suffers ransomware-related data breach (22 aug)
https://www.bleepingcomputer.com/news/security/greek-natural-gas-operator-suffers-ransomware-related-data-breach/
Hackers demand $10 million from Paris hospital after ransomware attack (23 aug)
https://www.bitdefender.com/blog/hotforsecurity/hackers-demand-10-million-from-paris-hospital-after-ransomware-attack/
Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies (23 aug)
https://edition.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html
Linus Larsson: Därför kommer du inte få rösta via mobilen (23 aug)
https://www.dn.se/sverige/linus-larsson-darfor-kommer-du-inte-fa-rosta-via-mobilen/
Major airline technology provider Accelya attacked by ransomware group (23 aug)
https://therecord.media/major-airline-technology-provider-accelya-attacked-by-ransomware-group/
ETHERLED: Air-gapped systems leak data via network card LEDs (23 aug)
https://www.bleepingcomputer.com/news/security/etherled-air-gapped-systems-leak-data-via-network-card-leds/
ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDs
https://arxiv.org/pdf/2208.09975.pdf
Plex discloses data breach and urges password reset (24 aug)
https://securityaffairs.co/wordpress/134814/data-breach/plex-data-breach.html
5G Networks Are Worryingly Hackable (24 aug)
https://spectrum.ieee.org/5g-virtualization-increased-hackability
Notice of Recent Security Incident (25 aug)
https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/
Felaktigt meddelande om ”Luftangrepp, fara” gick ut i Blekinge (25 aug)
https://www.dn.se/sverige/felaktigt-meddelande-om-luftangrepp-fara-gick-ut-i-blekinge/
Informationssäkerhet och blandat
Reservations Requested: TA558 Targets Hospitality and Travel (18 aug)
https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel
Grandoreiro Banking Trojan with New TTPs Targeting Various Industry Verticals (18 aug)
https://www.zscaler.com/blogs/security-research/grandoreiro-banking-trojan-new-ttps-targeting-various-industry-verticals
You Can’t Audit Me: APT29 Continues Targeting Microsoft 365 (18 aug)
https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
Back in Black: Unlocking a LockBit 3.0 Ransomware Attack (19 aug)
https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Cyber Signals: Defend against the new ransomware landscape (22 aug)
https://www.microsoft.com/security/blog/2022/08/22/cyber-signals-defend-against-the-new-ransomware-landscape/
Cyber security experts team up to protect UK construction projects (23 aug)
https://www.ncsc.gov.uk/news/joint-ventures-construction-guidance
Legitimate SaaS Platforms Being Used to Host Phishing Attacks (23 aug)
https://unit42.paloaltonetworks.com/platform-abuse-phishing/
MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone (24 aug)
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
CERT-SE i veckan
Kritisk sårbarhet i Zimbra Collaboration Suite (uppdaterad 2022-08-25)