Security News & Updates
Keep up-to-date on the latest cybersecurity news
Windows domain controller boot loops
Hi, the latest Windows Server updates are causing severe issues for administrators, with domain controllers having spontaneous reboots, Hyper-V not starting, and inaccessible ReFS volumes until the updates are rolled backYesterday, Microsoft released the Windows Server 2012 R2 KB5009624 update, the Windows Server 2019 KB5009557 update, and the Windows Server 2022 KB5009555 update as part of the January 2022 Patch Tuesday.After installing these updates, administrators have been battling multiple issues that are only resolved after removing the updates. Here is the source of the newshttps://www.bleepingcomputer.com/news/microsoft/new-windows-server-updates-cause-dc-boot-loops-break-hyper-v/
Security Wrap-Up (January 11th, 2022)News
Hi, everybody! On this Wednesday after #PatchTuesday, I thought we’d cover a few stories that have been swirling around the weblogosphere this week. Here we are, what - twelve days into 2022 and we’re already seeing warnings from the gov’t, mass outages, and I just finished up Ted Lasso but now….what, I just have to wait for more episodes to get made?? This is not the future I signed up for, y’all. Let’s check out some stories: Europol Ordered to Delete Data of Individuals With No Proven Links to CrimesI think the headline there tells the story, but yup - pretty awesome win for personal privacy in the EU! From the article: “Datasets older than six months that have not undergone this Data Subject Categorisation must be erased," the European Data Protection Supervisor said in a press statement. "This means that Europol will no longer be permitted to retain data about people who have not been linked to a crime or a criminal activity for long periods with no set deadline.” I hope you’re p
Video: Apache Log4j and the Log4Shell Vulnerability
Interested in learning more about Apache Log4j and the Log4Shell vulnerability? Automox just posted a video where we review Log4j and how it is used, and the timeline of events of the Log4Shell vulnerability and how it works. We also, of course, provide detailed instructions on how to remediate the vulnerability.Apache Log4j and the Log4Shell Vulnerability
Weekly Security Wrap-Up (January 5th, 2022)News
Happy midweek, y’all! I’m just getting back from my first week off in about a decade, and I may have forgotten how to use 2/3 of the apps we use every day here at AX. Has anyone seen my Post-It® full of passwords? Sigh, this is a disaster. Speaking of disasters…Unfortunately, the cybersecurity world didn’t stop being scary in my absence. Rather than try to go back to everything I missed, let’s just talk about a couple of this week’s big stories. The jerk store called... Okay, as offensive as that attack was, I don’t have time to rant about it. Instead:iOS malware can fake iPhone shut downs to snoop on camera, microphoneI’m already pretty paranoid about mobile devices and there are some specific tools that I use on every device I own. That being said, there’s just really no end to the layers required for good cyber-hygiene these days. While you shouldn’t assume your mic and camera aren’t already spying on you, this is a pretty nasty piece of malware. All you iOS users who download apps
[UPDATE] New Log4j Critical Vulnerability Scores a 10/10 (So Act Fast)
UPDATE (12/17/21) - includes new Remediation Code: On December 6, version 2.15.0 was released to address CVE-2021-44228, the now infamous 10/10 CVSS remote code execution (RCE) vulnerability in Log4Shell. Shortly after, CVE-2021-45046 was discovered in version 2.15.0, with a CVSS of 3.7. Version 2.16.0 was released on December 13 to address the new vulnerability.However, on December 17 a researcher discovered a new bypass to allow full RCE once again, which resulted in a CVSS increase from 3.7 to 9.0. If you only upgraded to version 2.15.0, you are not protected from possible RCE, upgrade to 2.16.0 immediately. Visit the Apache website for additional information.Log4Shell is a zero-day unauthenticated Remote Code Execution (RCE) vulnerability in Log4j versions 2.0-beta9 up to 2.14.1 identified as CVE-2021-44228.--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Weekly Security Wrap-Up (December 14th, 2021)News
Happy Tuesday, folks - Chad here. Yup, I’ll just shut up now, and we can start screaming about Log4j. There are obviously other stories in security news this week, but man...never mind those for today. Let’s get the obvious part for Admins out of the way:Sigh, yup!That pretty much sums up how most of my friends in Security feel this week. So now that we’re all laughing instead of crying, it’s alphabet soup time, I guess: WTAH*eck is Log4j? Well, if you haven’t read by now, here’s a TL;DR: Log4j is an open-source Java library from Apache. It’s been downloaded ~500k times from GitHub and is pretty widely-used for things like event logging in applications. Among other things. It’s already being exploited, and could get pretty wild if not widely remediated ASAFrigginP. @Brittany recently posted a thread that contains a “quick fix” worklet, so be sure to check that out. “10 out of 10” is like, pretty bad, y’all. Even the government has taken quick action. I mean, read that last sentence a
Security Wrap-Up (December 7th, 2021)News
Hi, everybody - Chad here. Happy Wednesday morning! Well, unless you’ve recently been victimized by worldly, ultra-sophisticated cybercriminals. Couple of pretty scary stories in the news this week, especially if you still get all itchy in the scalp when you hear “SolarWinds”. Let’s go see.. SolarWinds Attackers Spotted Using New Tactics, MalwareWell, it’s been a year, so these jerks are back. But this time, they’re getting creative - one newtechnique researchers observed the group using in the attacks is the abuse of repeated MFA push notifications to gain access to corporate accounts, according to the article. Most MFA providers send users a push notification or a phone call where they then enter a code/press a key as a second factor to authenticate access to an account.From the article: “Using a valid username and password combination, the researchers said that the attackers issued multiple MFA requests to an end user’s legitimate device until the target accepted the authentication.
New Blog: Who’s Minding the Store? How to Protect Against Cybersecurity Threats This Holiday Season
We are into the 2021 Holiday Season. Beginning with Thanksgiving, millions of people take time off from their jobs and schools to spend time with relatives, eat lots of good food, watch "Miracle on 34th Street" on repeat, and shop Black Friday deals.Unfortunately, the holidays have become a magical time for hackers and cybercriminals, too.Be sure to read our blog “Who’s Minding the Store? How to Protect Against Cybersecurity Threats This Holiday Season.” Included is a list of best practices and recommendations for organizations to follow to help address the risk posed by all cyber threats, including ransomware during the holidays.
The Best Practices in Out-of-Band Patch Management
Want to lean about best practices for managing out-of-band vulnerabilities through cloud-native patch management and endpoint management? Be sure to join Marina Liang, Senior Security Engineer from Automox as she gives you all the details in this informative video. The Best Practices in Out-of-Band Patch Management - YouTube
Weekly Security Wrap-Up (December 1st, 2021)News
Fancy graphics with captions!Happy Wednesday, y’all - Chad here. I hope everyone had a good Thanksgiving and enjoyed the break. We’re trying to get back on schedule with our regular posts, so in that vein, here’s your weekly Security Wrap-up. There were too many stories to post this week (yay Holidays!), so here’s a couple to check out. IKEA Hit by Email Reply-Chain CyberattackA Black Friday, indeed! According to the story, “The phishing emails were coming from internal IKEA email addresses, as well as from the systems compromised at the company’s suppliers and partners.” Stop thinking about Liz and Criss failing the IKEA test for just a second and put yourself in their employees’ shoes: valid emails from real coworkers and external contacts were suddenly malicious! I’m not sure how you could ever trust your email again. This one’s frustrating because email’s just such a good invention, you know? I’m sure some of you don’t know a life without it, but I sure do. Here’s a quick selfie o
Security Wrap-Up (November 12th, 2021)
Happy Friday, y’all - Chad here. As you hopefully saw in our announcement earlier this week, we’re currently migrating the Community and are up to our n*cks in new platform stuff, so we’re only going with a couple of security stories this week. The good news is, they’re both terrifying! 🙂 Costco discloses data breach after finding credit card skimmer Sigh…seriously? A physical skimmer got into a Costco? My card got skimmed at a gas station once, so I guess I’m just a bit sensitive to this one. That’s so annoying. Anyways, as you can imagine, getting your card of any sort skimmed can go real bad. I got lucky and my bank caught it, but man…I could own so many iPhones! “‘If unauthorized parties were able to remove information from the device before it was discovered, they may have acquired the magnetic stripe of your payment card, including your name, card number, card expiration date, and CVV,’ Costco revealed.” Call your bank, Costco customers. A stalker’s wishlist: PhoneSpy mal
30 Days with Helix Honeypot
honey1000×500 41.5 KB Cybercrime is big business, with cybercrime costs expected to grow by 15% per year over the next 5 years, reaching $10.5 trillion USD annually by 2025. This is up from $3 trillion back in 2015. There are many tools to help detect and deter criminals from gaining access to your IT environment, including the “honeypot,” which is a virtual trap to lure attackers. (Though if you ever want to catch Winnie the Pooh red-handed, a physical honeypot is the way to go.) When discussing cybersecurity, a honeypot is a system, device, or software that is intentionally compromised to expose opportunities for attackers so that they can be studied to improve security policies. And as our software architecture becomes more complex, threat-research has become more difficult, especially within containerization. To that end, Helix Honeypot was created to help solve some of the pain-points when doing threat-research around public-facing Kubernetes deployments. Our team did a very com
Security Wrap-Up (November 2nd, 2021)
Happy Tuesday, everybody - Chad here. I hope your week is off to a trouble-free start. I’ve been informed that it’s officially “the Holidays”, and you know what that means: an uptick in cyber threats, especially things like phishing attempts. Those things can look a lot different on a mobile device or in a text, so keep your ears peeled and stay vigilant out there. Here’s a couple of security stories from this week: Apple macOS Flaw Allows Kernel-Level Compromise This may show my age (and my unfortunate allegiance), but I’ve had an Apple computer since 1987. It’s because of that experience that I always practice my “ABCs” when it comes to macOS releases: Always Be Clickingremindmetomorrowuntiltheyvepatchedtheholes – just, you know…they’re becoming pretty infamous for these kinds of OS exploits so just be patient. The new hotness will still be there after the bugs all get squashed. Signal Now Lets You Report and Block Spam Messages In related news (because I’m also a Signal user)…huzzah
Adobe Releases Urgent Updates for 14 Products
On Tuesday afternoon, Adobe released out-of-band updates to patch 92 vulnerabilities across 14 products. Of the 92 vulnerabilities patched, 61 are regarded as critical remote code execution vulnerabilities by Adobe, and five are critical memory leak issues. Memory leak vulnerabilities are unintentional memory consumption by an application, which can lead to denial of service. If you use any of the products listed in the blog post here, update them ASAP! And most importantly, have a good weekend!
Cybersecurity Awareness Month - has your organization been prepared?
We’re a little late on the game here in the Automox Community, but October is Cybersecurity Awareness Month - a great month to check-in on your organization’s cybersecurity practices and make users more aware of the importance of staying safe. Through this month, you have seen plenty of educational pieces of content or advice about getting into the cybersecurity industry, but I wanted to take a moment to hear from y’all. Do you feel like your organization is well-prepared for any cyberattacks? Is cybersecurity a priority? (PS: if you are interested in reading some advice from cybersecurity experts here at Automox, you can read the blog post here!)
Security Wrap-Up (October 25th, 2021)
Hi, everybody - Chad here. Happy Monday to all y’all. As you know, October is Cybersecurity Awareness Month, so let’s get to some security news already. Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability In unsurprising facepalm news, a politician doesn’t understand how technology works! It’s mentioned by the story’s author as well, but to me, the worst part of this is how it could discourage other people to report vulnerabilities. I’ve never heard of anything like this before, and I hope it’s a one-off. It’s Windows XP’s 20th birthday and way too many still use it TWENTY YEARS!? It’s fine…I’m fine. Anyways, why would anyone still use a 20yr old operating system you ask? I would ask too, tbh. But the short answer is: Threat Actors Abuse Discord to Push Malware Okay first of all, how dare you!? Second…no, I don’t even need a second thing to rage about. Leave my Discord alone! FWIW, that’s the app that did me the most good during quarantine,
Have you or someone you know been affected by a cyberattack?
You may be entitled to comp- Wait, wrong intro… Hello! We are looking for some individuals that have been affected by, or know someone who has been affected by, a cyberattack. As cyberattacks grow in number, the effects on people can range from a mild inconvenience to an absolute nightmare, and we want to learn more. If you would be willing to chat with our team about your first-hand experience going through a cyberattack, feel free to reach out through this thread or via PM to discuss the opportunity further. And if you have any friends that might be interested in sharing their thoughts, please share this post. Thanks in advance for your help!
Security Wrap-Up (Oct 7th, 2021)
FORGET THE INTRO - OMZJ, TWITCH!! Even in a week when Facebook booted itself off the internet entirely, you likely heard/read/ranted to someone by now about the astoundingly nasty Twitch breach. So let’s talk about Twitch this week. First off, I hope you’ve already changed your password(s). Second, sigh…it’s tough to feel sorry for Twitch after some of their recent heat, but there’s really no hyperbole hyper-enough to get across how terrible this was for them. TL;DR that article - the information stolen/posted contains: The entirety of Twitch’s source code with comment history “going back to its early beginnings” Creator-payout reports from 2019 Mobile, desktop and console Twitch clients Proprietary SDKs and internal AWS services used by Twitch “Every other property that Twitch owns” including IGDB and CurseForge An unreleased Steam competitor, codenamed Vapor, from Amazon Game Studios Twitch internal “red-teaming” tools (designed to improve security by having staff pretend to be hac
Anyone else having problems with Microsofts September patches breaking network printing?
We are in the process of rolling back some patches now and testing. (Update - Rollback of [KB5005613] fixed our printing problems.) BleepingComputer New Windows security updates break network printing Windows administrators report wide-scale network printing problems after installing this week's September 2021 Patch Tuesday security updates.
"Back to School...Back to Ransomware Attacks" A Blog by Chad
Hi, everybody - Chad here. Since we’re still getting to know each other, I’m going to reveal some things about myself this morning. Aside from being a super-professional Technical Community Manager and a bottomless goldmine of accidental comedy, I’m also a long-time writer/blogger/etc. A couple of weeks ago in our Security Wrap-Up post here on AA, I wrote about a single subject for a change: the unsettling uptick in ransomware attacks against the Education sector this time of year. I hope you get through the entire post as it’s got some great info, but if not…TL; DR: This is a damn scary time to be a school Admin, and between remote folks, campus folks, BYOD, yada yada, attackers know that you’re stretched pretty thin…and they’re getting downright nasty. But, I bet some patch automation will help you sleep at night. Well…maybe. I don’t know your life. But I do know network/endpoint security in the Education sector, as I was up to my chins in it for the better part of the last decade. I
Security Wrap-Up (August 31st, 2021)
Hi, everybody - Chad here. Well, luckily for all of us who live near the swimming pool at my condos, it’s back to school time! And you know what that means: no, not homework and new shoes. Today, I’m focusing solely on the now-annual and still alarming uptick in ransomware attacks in the Education sector this time of year. While it may come as no surprise to those of us in the industry, it’s still shocking to see graphs like this one from a recent Comparitech ransomware report: Screen Shot 2021-08-31 at 1.40.56 PM837×409 18.1 KB As you can clearly see, September kind of sucks - which is a sentence I haven’t had to type on the Internet since season 2 of Fringe. But in general, attackers know that as schools get back into session (especially in our post-Covid world), things will be hectic. This can present them with a window of opportunity, so to speak. If I know that a school district has ~5,000 students coming back onto campus (or worse, learning remotely) at once, then I can assume
Security Wrap-Up (August 25th, 2021)
Patch Tuesday Rundown - August 2021
Hi, everybody - Chad here. Well, we’ve all survived another Patch Tuesday, and here’s a quick rundown. For more info, be sure to check out this month’s Patch Tuesday webinar or blog. August proved to be a lighter month than usual, with just 51 vulnerabilities addressed from Microsoft (seven of which are rated as critical, and only 1 being actively exploited in the wild). This shows a 56% reduction in overall vulnerabilities from July, and 33% fewer vulnerabilities on average for each month so far this year. 👏 👏 👏 On the Automox Patch Tuesday blog, @Eric writes, “This month’s vulnerabilities seem to follow a trend, impacting components in Microsoft Windows that perform network communications, internet connections, printing, file repair, and remote connections…The trend is that remote work is here to stay, making the prioritization of patching these components all the more vital.” In Adobe news, they gave everyone a break this month and only released two vulnera
Security Wrap-Up (August 10th, 2021)
Hi, everybody - Chad here. First off, Happy Tuesday! You’ve survived another Monday in 2021, and that’s no small feat! This week’s on time Security Wrap-Up is chock full of frustrating news, simple annoyances, and maybe a couple of things that even angried up my blood…real good! So, let’s get to it: New “Glowworm attack” recovers audio from devices’ power LEDs If you’re like me, you often sit on the balcony of your condo staring to the west - the glorious Red Rocks Amphitheater in the foreground, when it’s got-danged visible - and ponder the world’s seeming lack of evil geniuses. Well then, here’s a story for you. From ArsTechnica: “Researchers at Ben-Gurion University of the Negev have demonstrated a novel way to spy on electronic conversations. A new paper released today outlines a novel passive form of the TEMPEST attack called Glowworm, which converts minute fluctuations in the intensity of power LEDs on speakers and USB hubs back into the audio signals that caused those fluctuatio
Security Wrap-Up (August 4th, 2021)
Hi, everybody - Chad here. In case you missed it, today is Wednesday; not Tuesday. Good news: here’s your weekly Security Wrap-Up. Bad news: I officially need a new router. 😒 Once again, some pretty troubling stories in our little world this week. Here’s a peek at a few doozies: LockBit ransomware recruiting insiders to breach corporate networks In ransomware news, the LockBit 2.0 ransomware gang seems to be actively recruiting corporate insiders to help them breach/encrypt networks. In return, they’re promising the insider payouts of one million dollars. Various ransomware gangs operate as a Ransomware-as-a-Service organization, which consists of a core group of devs who maintain the ransomware and payment sites and recruited affiliates who breach victims’ networks and encrypt devices. While this kind of tactic sounds like a long-shot, it’s not the first time threat actors attempted to recruit an employee to encrypt their company’s network (nor will it be the last). In August
Already have an account? Login
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.