CERT-SE:s veckobrev v.40

Oktober månad är cybersäkerhetens månad och CERT-SE har i år släppt en challenge. Vi har redan fått in ett gäng svar, skoj tycker vi! Vi vill också passa på att påminna om sårbarheten i Microsoft Exchange-servrar (CVE-2020-0688) som vi varnade för i våras. Många servrar kan fortfarande vara utsatta.Trevlig helg önskar CERT-SE!

Nyheter i veckan

MFA bypass allows hackers to infiltrate Microsoft 365 (15 sep) https://www.itpro.co.uk/cloud/cloud-security/357111/mfa-bypass-allows-hackers-to-infiltrate-microsoft-365Iransk spionapp har stulit information om svenskar – under Trafikverkets täckmantel (25 sep) https://www.svt.se/nyheter/inrikes/iransk-spionapp-har-stulit-information-om-svenskar-under-trafikverkets-tackmantelIntroducing “YAYA”, a New Threat Hunting Tool From EFF Threat Lab (25 sep) https://www.eff.org/deeplinks/2020/09/introducing-yaya-new-threat-hunting-tool-eff-threat-labGerman-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed (25 sep) https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/Over $150M Drained in KuCoin Crypto Exchange Hack (26 sep) https://www.coindesk.com/hackers-drain-kucoin-crypto-exchanges-fundsPastebin adds ‘Burn After Read’ and ‘Password Protected Pastes’ to the dismay of the infosec community (26 sep) https://www.zdnet.com/article/pastebin-adds-burn-after-read-and-password-protected-pastes-to-the-dismay-of-the-infosec-community/“Joker”—the malware that signs you up for pricey services—floods Android markets (28 sep) https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/All four of the world’s largest shipping companies have now been hit by cyber-attacks (28 sep) https://www.zdnet.com/article/all-four-of-the-worlds-largest-shipping-companies-have-now-been-hit-by-cyber-attacks/ – Cyber Pirates Hit Global Shipping Industry Nearing Peak Season (1 okt) https://www.bloomberg.com/news/articles/2020-10-01/global-shipping-industry-hit-with-second-cyber-attack-in-a-week?srnd=technology-vpMicrosoft Digital Defense Report 2020: Cyber Threat Sophistication on the Rise (29 sep) https://www.microsoft.com/security/blog/2020/09/29/microsoft-digital-defense-report-2020-cyber-threat-sophistication-rise/Fortsatta IT-problem på Göteborgs universitet (29 sep) https://www.svt.se/nyheter/lokalt/vast/fortsatta-it-problem-pa-goteborgs-universitetDDoS attacks are getting more powerful as attackers change tactics (29 sep) https://www.zdnet.com/article/ddos-attacks-are-getting-more-powerful-as-attackers-change-tactics/It-haveri i region Skåne – går inte att komma åt sjukvårdsjournaler (29 sep) https://computersweden.idg.se/2.2683/1.740266/it-haveri-region-skaneDuckDuckGo cries fowl after being expunged from Google’s Android search preferences menu for most of Europe (29 sep) https://www.theregister.com/2020/09/29/googles_android_search_duckduckgo/Over 247K Exchange servers unpatched for actively exploited flaw (29 sep) https://www.bleepingcomputer.com/news/security/over-247k-exchange-servers-unpatched-for-actively-exploited-flaw/Phishing pages leverage CAPTCHAs to fool users, evade detection (1 okt) https://www.scmagazine.com/home/security-news/phishing/phishing-pages-leverage-captchas-to-fool-users-evade-detection/title: Infosäk och blandat —

CISA: Ransomeware Guide September 2020 https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdfNIST: Data Integrity Recovering from Ransomware and Other Destructive Events https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-11.pdfSIPRI och MSB: Ny rapport om krishantering inom cybersäkerhet (28 sep) https://www.msb.se/sv/aktuellt/nyheter/2020/september/ny-rapport-om-krishantering-inom-cybersakerhet/Cybersäkerhetsutredningen överlämnade delbetänkande till regeringen (29 sep) https://www.regeringen.se/pressmeddelanden/2020/09/cybersakerhetsutredningen-overlamnade-delbetankande-till-regeringen/Debatt: ”Sverige behöver en cybersäkerhet i världsklass” (1 okt) https://www.nyteknik.se/opinion/sverige-behover-en-cybersakerhet-i-varldsklass-7002118Datainspektionen blir Integritetsskyddsmyndigheten, IMY (2 okt) https://www.datainspektionen.se/nyheter/datainspektionen-blir-integritetsskyddsmyndigheten-imy/Försenat skydd mot it-angrepp kritiseras (2 okt) https://www.dn.se/sverige/forsenat-skydd-mot-it-angrepp-kritiseras/

CERT-SE i veckan

Sårbarheter i HP Device Manager varav en kritiskCERT-SE Challenge 2020