BU-CERT News

From darkreading.com

At Interop 2019, IT and security experts urged attendees to focus on data asset management as a means of mitigating risk.

INTEROP 2019 – LAS VEGAS–  At a time when organizations are launching digital transformation projects, bringing more devices onto their networks, and embracing cloud technology, it’s imperative leaders work together to create a plan for protecting vast stores of information.

It’s no secret that cybersecurity and business teams often have a rocky relationship. As Optiv practice director Mark Adams explained here at Interop, security is viewed as a drag on the business. “It doesn’t demonstrate a value proposition,” he said.

Read more…

From zdnet.com

For more than a year, mobile browsers like Google Chrome, Firefox, and Safari failed to show any phishing warnings to users, according to a research paper published this week.

“We identified a gaping hole in the protection of top mobile web browsers,” the research team said.

“Shockingly, mobile Chrome, Safari, and Firefox failed to show any blacklist warnings between mid-2017 and late 2018 despite the presence of security settings that implied blacklist protection.”

The issue only impacted mobile browsers that sued the Google Safe Browsing link blacklisting technology.

Read more…

From welivesecurity.com

May 2019 has seen bitcoin growing, with its price climbing to its highest points since September 2018. Not surprisingly, cybercrooks were quick to notice this development and started upping their efforts in targeting cryptocurrency users with various scams and malicious apps.

One such app was recently spotted on Google Play by Reddit users, impersonating the popular hardware cryptocurrency wallet Trezor and using the name “Trezor Mobile Wallet”. We haven’t previously seen malware misusing Trezor’s branding and were curious about the capabilities of such a fake app. After all, Trezor offers hardware wallets that require physical manipulation and authentication via PIN, or knowledge of the so called recovery seed, to access the stored cryptocurrency. Similar constraints apply to its official app, “TREZOR Manager”.

Analyzing the fake app, we found that:

1. it can’t to do any harm to Trezor users given Trezor’s multiple security layers;
2. it is connected to a fake cryptocurrency wallet app named “Coin Wallet – Bitcoin, Ripple, Ethereum, Tether”, which is capable of scamming unsuspecting users out of money; and
3. both these apps were created based on an app template sold online.

Read more…

From helpnetsecurity.com

There is still no public, working exploit code for CVE-2019-0708, a flaw that could allow an unauthenticated remote attacker to execute remote code on a vulnerable target running Remote Desktop Protocol (RDP).
But, as many infosec experts have noted, we’re not far off from when one is created and leveraged by attackers in the wild. With the vulnerability being wormable, when it hits, the exploit could end up compromising millions of systems around the world, in homes and enterprises.

Read more…

From zdnet.com

Driven by the laws of physics, economics, and land, the future of enterprise computing will head towards a multi-cloud era and technology vendors will have to step up to help businesses manage these environments. Organisations also will need to get a better handle on security, which–comprising multiple tools from different vendors–has become too complex to manage effectively and is in need of a transformation. 

Every organisation eventually would operate in a multi-cloud, hybrid environment, predicted VMware CEO Pat Gelsinger, who was speaking at the company’s CIO Forum held in Singapore on Thursday. He pointed to the “three laws of cloud” that were fuelling this movement where economics, for instance, made it more cost effective for enterprises to look to the cloud as their storage, bandwidth, and networking requirements grew alongside their business. 

The laws of physics, however, meant that they would have to run some functions on-premise to ensure higher response time. For example, robotic arms in a factory floor that required a 50-millisecond response time would not be able to do so via the cloud. 

Read more…

From thehackernews.com

Less than 24 hours after publicly disclosing an unpatched zero-day vulnerability in Windows 10, the anonymous hacker going by online alias “SandboxEscaper” has now dropped new exploits for two more unpatched Microsoft zero-day vulnerabilities.

The two new zero-day vulnerabilities affect Microsoft’s Windows Error Reporting service and Internet Explorer 11.

Just yesterday, while releasing a Windows 10 zero-day exploit for a local privilege escalation bug in Task Scheduler utility, SandboxEscaper claimed to have discovered four more zero-day bugs, exploits for two has now been publicly released.

Read more…

From securityonline.info

BlackArch Linux is an open source distribution of Linux derived from the lightweight and powerful Arch Linux operating system and designed from the ground up to be used by security professionals for penetration testingtasks. The repository contains more than 2050 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installs. For more information, see the installation instructions.

Read more…