Som du ser är vår webbplats inte anpassad för äldre webbläsare. Vi rekommenderar att du uppgraderar till en nyare webbläsare.

Publicerad - Veckobrev

CERT-SE:s veckobrev v.34

En grekisk leverantör av naturgas, ett franskt sjukhus och en leverantör till flygbolag har den senaste tiden utsatts för utpressningsvirus. Ytterligare organisationer berättar om både försök till och genomförda angrepp och ett felaktigt meddelande om "Luftangrepp, fara" har gått ut i Blekinge. Dessutom blir det som vanligt ett antal fördjupningar och mer tekniska analyser.

Trevlig helg önskar CERT-SE!

Nyheter i veckan

Software developer cracks Hyundai car security with Google search (17 aug)
https://www.theregister.com/2022/08/17/software_developer_cracks_hyundai_encryption/

PayPal Phishing Scam Uses Invoices Sent Via PayPal (18 aug)
https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent-via-paypal/

iOS Privacy: Announcing InAppBrowser.com (18 aug)
https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser

Personuppgiftsincident anmäld (19 aug)
https://www.regionkalmar.se/nyhetslista/personuppgiftsincident-anmald28/

LockBit ransomware blames Entrust for DDoS attacks on leak sites (22 aug)
https://www.bleepingcomputer.com/news/security/lockbit-ransomware-blames-entrust-for-ddos-attacks-on-leak-sites/

Norska Oljefonden: Vi utsätts för allvarliga cyberangrepp varje dag (22 aug)
https://sverigesradio.se/artikel/norska-oljefonden-vi-utsatts-for-allvarliga-cyberangrepp-varje-dag

Hiding a phishing attack behind the AWS cloud (22 aug)
https://www.theregister.com/2022/08/22/aws_cloud_phishing/

Greek natural gas operator suffers ransomware-related data breach (22 aug)
https://www.bleepingcomputer.com/news/security/greek-natural-gas-operator-suffers-ransomware-related-data-breach/

Hackers demand $10 million from Paris hospital after ransomware attack (23 aug)
https://www.bitdefender.com/blog/hotforsecurity/hackers-demand-10-million-from-paris-hospital-after-ransomware-attack/

Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies (23 aug)
https://edition.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html

Linus Larsson: Därför kommer du inte få rösta via mobilen (23 aug)
https://www.dn.se/sverige/linus-larsson-darfor-kommer-du-inte-fa-rosta-via-mobilen/

Major airline technology provider Accelya attacked by ransomware group (23 aug)
https://therecord.media/major-airline-technology-provider-accelya-attacked-by-ransomware-group/

ETHERLED: Air-gapped systems leak data via network card LEDs (23 aug)
https://www.bleepingcomputer.com/news/security/etherled-air-gapped-systems-leak-data-via-network-card-leds/
..
ETHERLED: Sending Covert Morse Signals from Air-Gapped Devices via Network Card (NIC) LEDs
https://arxiv.org/pdf/2208.09975.pdf

Plex discloses data breach and urges password reset (24 aug)
https://securityaffairs.co/wordpress/134814/data-breach/plex-data-breach.html

5G Networks Are Worryingly Hackable (24 aug)
https://spectrum.ieee.org/5g-virtualization-increased-hackability

Notice of Recent Security Incident (25 aug)
https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/

Felaktigt meddelande om ”Luftangrepp, fara” gick ut i Blekinge (25 aug)
https://www.dn.se/sverige/felaktigt-meddelande-om-luftangrepp-fara-gick-ut-i-blekinge/

Informationssäkerhet och blandat

Reservations Requested: TA558 Targets Hospitality and Travel (18 aug)
https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel

Grandoreiro Banking Trojan with New TTPs Targeting Various Industry Verticals (18 aug)
https://www.zscaler.com/blogs/security-research/grandoreiro-banking-trojan-new-ttps-targeting-various-industry-verticals

You Can’t Audit Me: APT29 Continues Targeting Microsoft 365 (18 aug)
https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft

Back in Black: Unlocking a LockBit 3.0 Ransomware Attack (19 aug)
https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/

Cyber Signals: Defend against the new ransomware landscape (22 aug)
https://www.microsoft.com/security/blog/2022/08/22/cyber-signals-defend-against-the-new-ransomware-landscape/

Cyber security experts team up to protect UK construction projects (23 aug)
https://www.ncsc.gov.uk/news/joint-ventures-construction-guidance

Legitimate SaaS Platforms Being Used to Host Phishing Attacks (23 aug)
https://unit42.paloaltonetworks.com/platform-abuse-phishing/

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone (24 aug)
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/

CERT-SE i veckan

Kritisk sårbarhet i Bitbucket

Kritisk sårbarhet i GitLab

Kritisk sårbarhet i Zimbra Collaboration Suite (uppdaterad 2022-08-25)