Hello and welcome back to a new week of the Security Wrap-Up! There are some great security updates on this week’s list and a must-patch update for macOS. Check it out -
Nvidia warns of severe security bugs in GPU driver, vGPU software
Nvidia has disclosed a group of security vulnerabilities in the Nvidia graphics processing unit (GPU) display driver, which could cause privilege-escalation attacks, arbitrary code execution, denial of service, and information disclosure. Out of the five bugs in the GPU display driver, the most severe is CVE-2021-1074, which rates 7.5 out of 10 on the CVSS vulnerability scale. This vulnerability exists within the display driver’s installer and allows an attacker with local system access to replace an application source with malicious files, potentially leading to code execution, escalation of privileges, denial of service, or information disclosure. The link above will show you the remaining four bugs (CVE-2021-1075, CVE-2021-2076, CVE-2021-1077, and CVE-2021-1078). In addition to GPU vulnerabilities, Nvidia’s vGPU software has eight different security holes, all of which can also be found in the link above.
Adobe releases open-source “One Stop Anomaly Shop” for security threat, data anomaly detection
Adobe has released a new “one-stop shop” project for data processing out to the open-source community. The One-Stop Anomaly Shop (OSAS) is available now on GitHub and has been developed to make the detection of abnormalities in datasets easier, as well as to improve the processing and format of security log data. According to Adobe, OSAS combines the vendor’s past security research and other open-source projects to offer an “out-of-the-box” system for dataset sexperimentation, processing and to allow developers to explore ways to “shorten the path to finding a balanced solution for detecting security threats.” Security logs can be complicated and messy, a problem which Adobe hopes to fix.
Ransomware recovery costs near $2m
According to a Sophos researchers report, the average total cost of recovery from a ransomware attack has more than doubled in a year, increasing from $761,106 in 2020 to $1.85 million in 2021. The average ransom paid is $170,404. Sophos’ report also reveals that only 8% of organizations managed to get back all of their data after paying a ransom, and 29% received no more than half of their data. That being said, the number of organizations that experienced a ransomware attack fell from 51% of respondents in 2020 to 37% in 2021. The bad news is, although the number of overall attacks went down, Sophos researchers say the impact of a ransomware attack is now more damaging and costly.
Apple patches zero-day MacOS bug that can bypass anti-malware defenses
Apple has patched a zero-day vulnerability in macOS that can bypass critical anti-malware capabilities and which a variant of Mac threat Shlayer (an adware dropper) has already been exploiting for months. The vulnerability, discovered by security researcher Cedric Owens, is perilous to macOS users because it allows an attacker to very easily craft a macOS payload that goes unchecked by the strict security features built into the OS specifically to keep malware out. The vulnerability, tracked under CVE-2021-30657 could bypass three key anti-malware detections present in macOS - File Quarantine, Gatekeeper, and Notarization.
Any security news you’d like to share? Add it in the comments below!