Threat Intelligence Bulletin: 02/05/2021

Patch Tuesday 02/11/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday, and highlights the notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Microsoft's Patch Tuesday update for February 2021 contained 57 vulnerabilities in total, with:

4 vulnerabilities rated as Critical
33 vulnerabilities rated as High
20 vulnerabilities rated as Medium

Microsoft has identified proofs-of-concept for the above-stated high severity vulnerabilities along with CVE-2021-1721, CVE-2021-24101, CVE-2021-1724, CVE-2021-24100, CVE-2021-1730, CVE-2021-24071, CVE-2021-24076, and CVE-2021-24073.

At the time of writing, no publicly available exploits have been identified.

Zero-day Vulnerability CVE-2021-1732 is an elevation of privilege bug in Win32k, a core component of the Windows Operating System. The bug could allow a locally authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges. Reportedly, the bug has been exploited after attackers gained access to a Windows system in order to obtain SYSTEM-level access.

Critical Vulnerabilities

The most notable critical-rated vulnerabilities are tracked as CVE-2021-24078, CVE-2021-24077, CVE-2021-24074, and CVE-2021-24094.

CVE-2021-24078 CVE-2021-24078 is a Remote Code Execution Vulnerability impacting Windows DNS Server. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the DNS Server. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24078:

Windows Server version 1909 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2012 R2 Windows Server 2016 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server version 20H2 (Server Core Installation) Windows Server 2012 R2 (Server Core installation) Windows Server version 2004 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2016

CVE-2021-24077 CVE-2021-24077 is a Remote Code Execution Vulnerability impacting Windows Fax Service. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Fax Service. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24077:

Windows Server version 1909 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1607 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 8.1 for 32-bit systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 10 Version 20H2 for x64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows Server 2019 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 8.1 for x64-based systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows 10 Version 2004 for x64-based Systems Windows Server 2016 (Server Core installation) Windows Server 2012 R2 Windows 10 Version 2004 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2012

CVE-2021-24074 CVE-2021-24074 is a Remote Code Execution Vulnerability impacting Windows TCP/IP. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the TCP/IP. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24074:

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server version 1909 (Server Core installation) Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1607 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 8.1 for 32-bit systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows 10 Version 20H2 for x64-based Systems Windows Server 2019 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 8.1 for x64-based systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2012 R2 Windows Server 2016 (Server Core installation) Windows 10 Version 2004 for x64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2012

CVE-2021-24094 CVE-2021-24094 is a Remote Code Execution Vulnerability impacting Windows TCP/IP. According to Microsoft, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the TCP/IP. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim. The following products are affected by CVE-2021-24094:

High-severity Vulnerabilities

The most notable high-severity vulnerabilities are tracked as CVE-2021-24112, CVE-2021-24105, CVE-2021-24081, CVE-2021-1733, and CVE-2021-1727.

CVE-2021-24112 CVE-2021-24112 is a Remote Code Execution Vulnerability in .NET Core. Microsoft .NET Core could allow a remote attacker to execute arbitrary code on the system, caused by an error when a .NET application utilizing libgdiplus on a non-Windows system accepts input. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. This vulnerability impacts the following Microsoft products:

.NET Core 2.1 .NET 5.0 .NET Core 3.1

CVE-2021-24105 CVE-2021-24105 is a Remote Code Execution Vulnerability impacting Package Managers Configurations. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Package Manager Configurations. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim.

CVE-2021-24081 CVE-2021-24081 is a Remote Code Execution Vulnerability impacting Microsoft Windows Codecs Library. Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Codecs Library. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim. This vulnerability impacts the following Microsoft products:

Windows Server version 1909 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2019 Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 2004 for x64-based Systems Windows Server 2016 (Server Core installation) Windows 10 Version 2004 for 32-bit Systems Windows 10 for 32-bit Systems

CVE-2021-1733 CVE-2021-1733 is an Elevation of Privilege Vulnerability impacting Sysinternals PsExec. Microsoft PsExec could allow a local authenticated attacker to gain elevated privileges on the system. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2021-1727 CVE-2021-1727 is an Elevation of Privilege Vulnerability impacting Windows Installer. Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Installer component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges. This vulnerability impacts the following Microsoft products: Windows Server version 1909 (Server Core installation) Windows 10 Version 1809 for 32-bit Systems Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2019 (Server Core installation) Windows 10 Version 1607 for x64-based Systems Windows RT 8.1 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows 10 Version 1607 for 32-bit Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows 8.1 for 32-bit systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 for x64-based Systems Windows 10 Version 1809 for x64-based Systems Windows Server version 2004 (Server Core installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 7 for 32-bit Systems Service Pack 1 Windows 10 Version 20H2 for x64-based Systems Windows 7 for x64-based Systems Service Pack 1 Windows Server 2019 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 Version 1803 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows Server version 20H2 (Server Core Installation) Windows Server 2016 Windows 8.1 for x64-based systems Windows 10 Version 1803 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows Server 2012 R2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1803 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows 10 Version 2004 for x64-based Systems Windows Server 2016 (Server Core installation) Windows Server 2012 R2 Windows 10 Version 2004 for 32-bit Systems Windows Server 2012 (Server Core installation) Windows 10 for 32-bit Systems Windows Server 2012

Users are advised to apply the latest security patches specified in Microsoft's Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.

Breaking News: 2021-02-05 - 2021-02-11

Webdev tutorials site SitePoint discloses data breach

SitePoint, a website that provides access to a wealth of web development tutorials and books, has disclosed a security breach after a hacker put up for sale a collection of one million SitePoint user details on a cybercrime forum in December 2020. SitePoint stated that the accessed information mainly includes names, email addresses, hashed passwords, usernames, and IP addresses. SitePoint also stated that the breach occurred after the attackers gained access to a third party tool [they] used to monitor [their] GitHub account. SitePoint has since removed the tool, rotated all of its API keys, and changed passwords.

See the full report here: https://www.zdnet.com/article/webdev-tutorials-site-sitepoint-discloses-data-breach/

Spotify Hit With Another Credential-Stuffing Attack

Security researcher Bob Diachenko has identified a database containing more than 100,000 Spotify account details. This is the second credential-stuffing attack to hit Spotify in the last few months. The attack was reported to Spotify, which issued a password reset to affected users that rendered the public credentials invalid. The company says in a statement it also worked to have the fraudulent database taken down by its Internet service provider, and notes this attack was not linked to a breach in Spotify's security. Users are advised to choose unique passwords for online services.

See the full report here: https://www.darkreading.com/attacks-breaches/spotify-hit-with-another-credential-stuffing-attack/d/d-id/1340083

Unpatched WordPress Plugin Code-Injection Bug Afflicts 50K Sites

Contact Form 7 Style, a WordPress plugin installed on over 50,000 sites, contains a cross-site request forgery that could allow for malicious JavaScript injection on a victim's website. The latest WordPress plugin security vulnerability is a cross-site request forgery (CSRF) to stored cross-site scripting (XSS) problem in Contact Form 7 Style, which is an add-on to the well-known Contact Form 7 umbrella plugin. To exploit the flaw, cyberattackers would need to convince a logged-in administrator to click on a malicious link, which can be done using common social-engineering approaches. WordPress site admins are urged to be cautious while visiting any suspicious links.

See the full report here: https://threatpost.com/unpatched-wordpress-plugin-code-injection/163706/

Microsoft warns of increasing OAuth Office 365 phishing attacks - BleepingComputer

Microsoft has warned of an increasing number of consent phishing (aka OAuth phishing) attacks targeting remote workers during recent months. These attacks were part of two campaigns that ran between September and December 2020, targeting victims in multiple recurring waves. Threat actors behind these attacks abused cloud service providers or used previously compromised domains to deliver their phishing emails. The OAuth URLs redirected the potential victims to attacker-owned domains for displaying the authentication request.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-increasing-oauth-office-365-phishing-attacks/

Google Chrome sync feature can be abused for C&C and data exfiltration

A security researcher has discovered that a malicious Chrome extension was abusing the Chrome sync feature as a way to communicate with a remote command and control (C&C) server and as a way to exfiltrate data from infected browsers. The attackers gained access to a victim's computer, but because the data they wanted to steal was inside an employee's portal, they downloaded a Chrome extension on the user's computer and loaded it via the browser's Developer Mode. The extension, which posed as a security add-on from security firm Forcepoint, contained malicious code that abused the Chrome sync feature as a way to allow attackers to control the infected browser.

See the full report here: https://www.zdnet.com/article/google-chrome-syncing-features-can-be-abused-for-c-c-and-data-exfiltration/

The Great Suspender Chrome extension's fall from grace - BleepingComputer

Google has forcibly uninstalled the immensely popular 'The Great Suspender' extension from Google Chrome and classified it as malware. This extension was popular with over 2,000,000 users and has consistently been a recommended extension due to its ability to reduce Chrome's memory usage.

See the full report here: https://www.bleepingcomputer.com/news/security/the-great-suspender-chrome-extensions-fall-from-grace/

Mozilla fixes Windows 10 NTFS corruption bug in Firefox - BleepingComputer

Mozilla has released Firefox 85.0.1 and includes a fix that prevents a Windows 10 NTFS corruption bug from being triggered from the browser. With the release of Firefox 85.0.1, instead of trying to access the path, Firefox will ignore the path and not attempt to access it.

See the full report here: https://www.bleepingcomputer.com/news/software/mozilla-fixes-windows-10-ntfs-corruption-bug-in-firefox/

COMB breach: 3.2B email and password pairs leaked online

More than 3.2 billion unique pairs of cleartext emails and passwords have been leaked on a popular hacking forum. This collection aggregates data from past leaks, such as Netflix, LinkedIn, Exploit[.]in, Bitcoin, and more. The breach was dubbed “Compilation of Many Breaches” (COMB) wherein the data is archived in an encrypted, password-protected container.

See the full report here: https://securityaffairs.co/wordpress/114329/data-breach/comb-breach-3-2b-credentials.html?utm_source=rss&utm_medium=rss&utm_campaign=comb-breach-3-2b-credentials

Instagram disables hundreds of accounts tied to hacking of 'OG' usernames - Reuters

Facebook Inc on Thursday took down hundreds of Instagram accounts that were hacked and sold for their high-value usernames, including the accounts of people behind this activity. The people engaged in this rule-breaking practice were well-known figures in a community known as the OGUsers, who trade desirable usernames for popular websites from Twitter Inc to Netflix for money and clout.

See the full report here: https://www.reuters.com/article/facebook-instagram-cyber-idUSL1N2K93CK

Fortinet fixes critical vulnerabilities in SSL VPN and web firewall - BleepingComputer

Fortinet has fixed multiple severe vulnerabilities impacting its products. The security bugs range from Remote Code Execution (RCE) to SQL Injection, to Denial of Service (DoS) and affect the FortiProxy SSL VPN and FortiWeb Web Application Firewall (WAF) products.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-vulnerabilities-in-ssl-vpn-and-web-firewall/

Ziggy ransomware group shuts down amid concern over law enforcement actions - SiliconANGLE News

The Ziggy ransomware operation has shut down and released the victims' decryption keys after concerns about recent law enforcement activity and guilt for encrypting victims. The Ziggy Ransomware admin announced on Telegram that they were shutting down their operation and would be releasing all of the decryption keys.

See the full report here: https://siliconangle.com/2021/02/07/ziggy-ransomware-group-shuts-amid-concern-law-enforcement-actions/

Hacktivists deface multiple Sri Lankan domains, including Google.lk

A mysterious group of hacktivists has poisoned the DNS records of several Sri Lankans (.lk) websites on Saturday and redirected users to a web page detailing various social issues impacting the local population. While most of the affected domains were websites for local businesses and news sites, two high-profile domains for Google.lk and Oracle.lk, were also impacted.

See the full report here: https://www.zdnet.com/article/hacktivists-deface-multiple-sri-lankan-domains-including-google-lk/

New phishing attack uses Morse code to hide malicious URLs - BleepingComputer

Starting last week, a threat actor began utilizing Morse code to hide malicious URLs in their phishing form to bypass secure mail gateways and mail filters. Samuel Morse and Alfred Vail invented morse code as a way of transmitting messages across telegraph wire.

See the full report here: https://www.bleepingcomputer.com/news/security/new-phishing-attack-uses-morse-code-to-hide-malicious-urls/

Signal ignores proxy censorship vulnerability, bans researchers - BleepingComputer

Signal, an end-to-end encrypted messaging platform, was recently blocked by the Iranian government. To help its users bypass censorship in Iran, the company suggested a TLS proxy workaround. However, multiple researchers have discovered flaws in the workaround that can let a censor or government authority probe into Signal TLS proxies, rendering these protections moot and potentially bringing repercussions for Signal users located in repressive regimes. The researchers who reported these flaws via Signal's GitHub repository have been banned by the company, with their reported issues removed.

See the full report here: https://www.bleepingcomputer.com/news/security/signal-ignores-proxy-censorship-vulnerability-bans-researchers/

Microsoft to add 'nation-state activity alerts' to Defender for Office 365

Microsoft is working on adding a new nation-state hacking activity warning to Microsoft 365. The new feature will alert users to any potential threats stemming from a nation-state attacker, giving users time to react to it.

See the full report here: https://www.zdnet.com/article/microsoft-to-add-nation-state-activity-alerts-to-defender-for-office-365/

Billions of Passwords Offered for $2 in Cyber-Underground

A so-called "compilation of many breaches" has been leaked on the cyber-underground, according to researchers. The so-called COMB contains a staggering 3.27 billion unique combinations of cleartext email addresses and passwords.

See the full report here: https://threatpost.com/billions-passwords-cyber-underground/163738/

Extortionists Publish Data Stolen from Two Healthcare Service Providers - Security Boulevard

An attacker group published information stolen from two healthcare service providers in a reported attempt to extort them for money. According to the reports, a well-known ransomware group had published tens of thousands of files to a data leaks website on the dark web. Among those files were scanned diagnostic results, letters to health insurers, and a folder containing background checks on employees.

See the full report here: https://securityboulevard.com/2021/02/extortionists-publish-data-stolen-from-two-healthcare-service-providers/

A Hacker Tried to Poison a Florida City's Water Supply

A hacker gained access to the water treatment system for the city of Oldsmar, Florida, and attempted to increase the concentration of sodium hydroxide (NaOH), also known as lye and caustic soda, to extremely dangerous levels. The attack on the computer system at Oldsmar water treatment system happened on Friday at 1:30 PM, through a remote desktop software that allowed authorized users to troubleshoot system problems remotely. The operator quickly spotted the intrusion and returned the sodium hydroxide to normal levels.

See the full report here: https://www.wired.com/story/oldsmar-florida-water-utility-hack/

Critical WordPress Plugin Flaw Allows Site Takeover

Researchers are urging WordPress websites that utilize the NextGen Gallery plugin to apply a patch addressing critical and high-severity flaws. The NextGen Gallery plugin is installed on 800,000 WordPress websites, allowing sites to upload photos in batch quantities, import metadata, and edit image thumbnails. Researchers discovered two cross-site request forgery (CSRF) flaws, one critical and one high-severity in the plugin.

See the full report here: https://threatpost.com/critical-wordpress-plugin-flaw-site-takeover/163734/

PyPI, GitLab dealing with spam attacks

Spammers have flooded the Python Package Index (PyPI) portal and the GitLab source code hosting website with garbage content, flooding both with ads for shady sites and services. Spammers have been abusing the fact that anyone can create entries on the PyPI website to generate pages for non-existent Python libraries that served as giant SEO ads for various shady sites. A new spam attack was also detected at GitLab, wherein an unknown threat actor appears to have spammed the Issues Tracker for thousands of GitLab projects that triggered an email to account holders. Just like the spam on PyPI, these comments also redirected users to shady sites.

See the full report here: https://www.zdnet.com/article/pypi-gitlab-dealing-with-spam-attacks/

Android app joins the dark side, sends malware update to millions - BleepingComputer

Google has removed a popular Android barcode scanner app from the Play Store after researchers found that it turned malicious following a December 2020 update. The malicious behavior experienced by its millions of users included seeing their default browser launching without any user interaction and displaying ads that promoted other, potentially malicious, Android apps. While Google has removed Barcode Scanner from its app store, it is not gone from affected devices. Users of the app will still have to manually uninstall it from their phones.

See the full report here: https://www.bleepingcomputer.com/news/security/android-app-joins-the-dark-side-sends-malware-update-to-millions/

Nespresso Smart Cards Brewed with Weak Security

A researcher hacked Nespresso Pro smart cards to dispense free, unlimited coffee. Nespresso produces a range of coffees and machines for personal and professional use. Some of the commercial machines accept Mifare Classic stored-value smart cards, which allow users to load money onto the cards to use in the machines. The cards however have been widely panned as lacking in security.

See the full report here: https://threatpost.com/nespresso-smart-cards-weak-security/163675/

Web hosting provider shuts down after cyberattack

A web hosting company named No Support Linux Hosting announced today it was shutting down after a hacker breached its internal systems and compromised its entire operation. According to a message posted on its official site, the company said it was breached on Monday, February 8. The hacker appears to have compromised the company's entire operation, including its official website, admin section, and customer database. They requested all the customers to immediately download backups of their websites and databases through cPanel.

See the full report here: https://www.zdnet.com/article/web-hosting-provider-shuts-down-after-cyber-attack/

Microsoft warns enterprises of new 'dependency confusion' attack technique

Microsoft has published a white paper about a new type of attack technique called a "dependency confusion" or a "substitution attack" that can be used to poison the app-building process inside corporate environments. If an attacker learns the names of private libraries used inside a company's app-building process, they could register these names on public package repositories and upload public libraries that contain malicious code. The attack takes place when developers build their apps inside enterprise environments, and their package manager prioritizes the (malicious) library hosted on the public repository instead of the internal library with the same name.

See the full report here: https://www.zdnet.com/article/microsoft-warns-enterprises-of-new-dependency-confusion-attack-technique/

New BendyBear APT malware gets linked to Chinese hacking group - BleepingComputer

Unit 42 researchers have shared info on a new polymorphic and "highly sophisticated" malware dubbed BendyBear, linked to a hacking group with known ties to the Chinese government. BendyBear is also one of the most sophisticated and difficult-to-detect samples of shellcode employed by an Advanced Persistent Threat (APT). This shellcode's only function is to be used to download other malicious payloads from attacker-controlled C2 servers. Cyberspies who use BendyBear in their operations will load it onto compromised devices immediately after gaining access to the machine following exploitation.

See the full report here: https://www.bleepingcomputer.com/news/security/new-bendybear-apt-malware-gets-linked-to-chinese-hacking-group/

HelloKitty ransomware behind CD Projekt Red cyberattack, data theft - BleepingComputer

CD Projekt Red stated that they have been hacked by attackers who were able to access their internal network. The hackers were also able to encrypt some of their devices and collect data from them. According to the reports, the ransomware responsible for this cyberattack is called 'HelloKitty.'

See the full report here: https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-behind-cd-projekt-red-cyberattack-data-theft/

Android Devices Hunted by LodaRAT Windows Malware

A newly discovered variant of the LodaRAT malware, which has historically targeted Windows devices, is being distributed in an ongoing campaign that now also hunts down Android devices and spies on victims. According to security researchers, an updated version of LodaRAT for Windows has also been identified and both versions were seen in a recent campaign targeting Bangladesh.

See the full report here: https://threatpost.com/android-devices-lodarat-windows/163769/

Adobe fixes critical Reader vulnerability exploited in the wild - BleepingComputer

Adobe has released security updates that address an actively exploited vulnerability in Adobe Reader and other critical bugs in Adobe Acrobat, Magento, Photoshop, Animate, Illustrator, and Dreamweaver. The company addressed fifty security vulnerabilities affecting seven products, with many of them rated as critical.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-reader-vulnerability-exploited-in-the-wild/

Apple fixes SUDO root privilege escalation flaw in macOS - BleepingComputer

Apple has fixed a Sudo vulnerability in macOS Big Sur, Catalina, and Mojave, allowing any local user to gain root-level privileges. Last month, security researchers at Qualys disclosed the Sudo vulnerability tracked as CVE-2021-3156, which allowed them to gain root privileges on multiple Linux distributions, including Debian, Ubuntu, and Fedora 33.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-sudo-root-privilege-escalation-flaw-in-macos/

SAP Commerce Critical Security Bug Allows RCE

SAP is warning of a critical vulnerability in its Commerce platform for e-commerce businesses. If exploited, the flaw could allow for remote code execution (RCE) that ultimately could compromise or disrupt the application. The vulnerability is tracked as CVE-2021-21477 and affects SAP Commerce versions 1808, 1811, 1905, 2005, and 2011. It is scored 9.9 out of 10 on the CVSS scale, making it critical in severity. Users are strongly recommended to apply the patch to mitigate the vulnerability.

See the full report here: https://threatpost.com/sap-commerce-critical-security-bug/163822/

French MNH health insurance company hit by RansomExx ransomware - BleepingComputer

French health insurance company Mutuelle Nationale des Hospitaliers (MNH) has suffered a ransomware attack that has severely disrupted the company's operations. Since the attack, the mnh.fr website displays a notice stating that it has been affected by a cyberattack that started on February 5th. An independent security researcher shared a Tor web page that acts as a ransom negotiation page for the MNH attack. This Tor site belongs to a ransomware operation called RansomExx, which is believed to be behind the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/french-mnh-health-insurance-company-hit-by-ransomexx-ransomware/

Following Oldsmar attack, FBI warns about using TeamViewer and Windows 7

In the aftermath of the Oldsmar incident, where an unidentified attacker gained access to a water treatment plant's network and modified chemical dosages to dangerous levels, the FBI has sent out an alert on Tuesday, raising attention to three security issues that have been seen on the plant's network following last week's hack. The alert warns about the use of out-of-date Windows 7 systems, poor passwords, and desktop sharing software TeamViewer, urging private companies and federal and government organizations to review internal networks and access policies accordingly. The FBI PIN specifically names TeamViewer as the app was used by the attacker to intrude into the Oldsmar water treatment plant's network. Additionally, the FBI recommends a series of basic security best practices as an intermediary way to mitigate threats.

See the full report here: https://www.zdnet.com/article/following-oldsmar-attack-fbi-warns-about-using-teamviewer-and-windows-7/

Hackers auction alleged stolen Cyberpunk 2077, Witcher source code - BleepingComputer

Threat actors are auctioning the alleged source code for CD Projekt Red games, including Witcher 3, Thronebreaker, and Cyberpunk 2077, that they state were stolen in a ransomware attack. This attack was later confirmed to be conducted by the HelloKity ransomware group. The starting price for this auction is $1 million with bid increments of $500,000 and a 'blitz' or buy now price of $7 million. To prove the stolen data's validity, the group shared a text file containing a directory listing from the alleged Witcher 3 source code. They further released a 21 GB archive for free on hacker forums that allegedly contains the source code for the Gwent card game.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-auction-alleged-stolen-cyberpunk-2077-witcher-source-code/