BU-CERT News

From helpnetsecurity.com

Cloud infrastructures are a growing target for threat actors looking to mine cryptocurrency, as their vast computational power allows them to multiply the mining malware’s effect.

Keeping its presence from being noticed as long as possible is, naturally, a goal worth striving for and criminals are coming up with new ways to achieve it.

One of the approaches, employed by a threat group dubbed Rocke, is to uninstall agent-based cloud security products before downloading the mining malware and starting the mining process.

The coin miner targets Linux machines and mines Monero (by far the most popular cryptocurrency among criminals deploying mining malware).

Read more…

From securityaffairs.co

Wondering about the state of global cybersecurity in 2019? Wonder no more with these nine cybersecurity predictions for where the new year will take us — and what it means for our digital properties, online lives andlivelihoods.

1. Everybody Will Have to Choose Their Partners and Equipment More Carefully

The Internet of Things is a remarkable benchmark in human technological advancement. It’s in its infancy, though — and it shows.

A few years ago, big box chain Target demonstrated the potential folly of using vendors and connected technologies that hadn’t been fully vetted yet. In 2014, the personal records of some 40 million Target shoppers, including names and credit card numbers, were stolen by hackers. Their way in was through the company’s internet-connected HVAC system.

Read more…

From securityaffairs.co

Drupal released security updates for Drupal 7, 8.5 and 8.6 that address two “critical” security vulnerabilities that could be exploited for arbitrary code execution.

The first vulnerability could be exploited by a remote attacker to execute arbitrary PHP code. The flaw resides in the phar stream wrapper implemented in PHP and is related to the way it handles untrusted phar:// URIs.

“A remote code execution vulnerability exists in PHP’s built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. ” reads the security advisory.

“Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability, This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.”

Read more…

From itproportal.com

Machine Learning capabilities hold great potential for new revenue streams and tremendous cost savings for enterprises. Increasingly, businesses are using ML to strengthen their competitive advantage and drive innovation. Is your organisation embracing this shift or are you falling behind? If you are on the “bias-for-action” side of the scale and have already started steering your organisation towards digital & ML transformation, are you confident you are doing so in the right way?

Read more…

From itproportal.com

As part of his plan to improve the U.K.’s defences, including cybersecurity, last year Phillip Hammond pledged an additional £1bn to the cause during his most recent Budget announcement. Given previous cyberattacks, such as WannaCry on the NHS, this investment is well needed. But what will this money be spent on in 2019, and will we see tangible results emerge? The following points highlight what to expect regarding cybersecurity in public sector technology in the coming year.

Read more…

From gbhackers.com

Hundreds of E-commerce sites infected with the malicious skimming code that steals the customer payment card from checkout pages.

The malicious code found inserted with number of e-commerce websites providing various services such as ticketing, touring, flight booking services and shopping cart sites.

According to TrendMicro analysis report, 277 e-commerce sites found injected with the malicious skimming codes. With further analysis researchers observed that the e-commerce websites are mot directlu compromised.

Read more…

From helpnetsecurity.com

oo many Facebook users aren’t aware that the company uses the information provided by them and their actions on the platform and outside of it to create a list of their traits and interests, which is then used by to target them with relevant ads.

The survey

According to the results of a new Pew Research Center surveys, which polled a representative sample of US-based, adult Facebook users:

Read more…