Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Avast_Security_News: Thunderbolt flaw leads to Thunderspy exploit
#1
Information 
Quote:
[Image: TVDumYE.png]

Plus, an FBI warning to COVID-19 researchers and a ransomware attack on a Fortune 500 health network

Björn Ruytenbe, a Dutch security researcher at Eindhoven University of Technology, revealed details this week of a new attack he discovered that exploits a vulnerability in the common Intel Thunderbolt port found in millions of PCs around the world. The attack, called Thunderspy, takes less than 5 minutes to perform, but it must be executed in person, for the hacker needs physical access to the target laptop. This kind of attack is called by researchers an “evil maid attack.” 

“All the evil maid needs to do is unscrew the backplate, attach a device momentarily, reprogram the firmware, reattach the backplate, and the evil maid gets full access to the laptop,” Ruytenbe told Wired. The attack can be successful even when the laptop is sleeping or locked, and the flaw cannot be patched with any software update. Changing the security settings of the Thunderbolt port does not make a difference either as the attack deactivates those settings. The only protection from Thunderspy is to turn off one’s laptop when it’s not in use or disable the Thunderbolt port. As for eradicating the flaw entirely, Ruytenbe sees only one solution. “Basically they will have to do a silicon redesign,” he said. 

“This is a vulnerability that in order to be exploited needs physical access to the computer,” commented Avast Security Evangelist Luis Corrons. “Fingerprint scanning, passwords, and even hard drive encryption is useless in this particular case. Disabling the Thunderbolt port from the BIOS will close the door to this attack. This is something all users should be doing when they leave their computers in places where other people could have access, such as hotel rooms.”

FBI warns of Chinese hackers stealing COVID-19 research

The FBI and CISA issued a public service announcement this week to warn U.S. research facilities that hacking groups affiliated with the People’s Republic of China (PRC) have been observed trying to illicitly attain unpublicized information related to COVID-19 vaccines, treatments, and testing. The PSA asserts that the theft of this information could jeopardize the efficacy and efficiency of the treatment options being developed. Recommendations provided by the agencies to block the hacking include patching all systems for critical vulnerabilities and proceeding with the knowledge that press attention on a research organization will most likely lead to increased interest from other entities.

This week’s stat
$10 million

The amount that scammers were able to steal using business email compromise scams on Norfund, Norway’s state investment fund. 

US government urges populace to update and patch

Citing that foreign cybercriminals tend to exploit publicly known – and often dated – software vulnerabilities, U.S. government agencies released an alert this week listing out the most common software flaws that are routinely exploited, all of which are patchable. The alert admonishes all IT professionals to place a priority on timely patching, particularly for the vulnerabilities it lists, which cover the ten most exploited flaws within the years 2016-2019, as well as 2020’s top exploits.

Patching these vulnerabilities will protect users from the most common threats, but best practice would be for users to get in the habit of applying all software patches as soon as they are made available for their systems. 

Magellan Health hit with ransomware

Fortune 500 company Magellan Health sent a notification to affected individuals this week about a ransomware attack to the company’s servers that occurred on April 11, 2020. Attackers breached Magellan’s systems with a phishing email impersonating a client on April 6, the notification states. An investigation revealed that a subset of data was stolen from a Magellan corporate server containing Magellan employee data, which includes names, addresses, tax details, Social Security numbers, and, in some cases, usernames and passwords. Magellan Health informed victims that it is continuing to work with the FBI to investigate the attack, and that it has since bolstered its security protocols. 

This week’s quote

“In terms of infection vector, we expect to see scam emails and infected pirated applications to be the main delivery mechanisms for targeting consumers with ransomware,” said Avast researcher Jakub Kroustek, speaking about the future of ransomware on the third anniversary of the WannaCry attack. Read more about it here.

Zoom and other video conference platforms spoofed

Researchers have noted dozens of malicious Zoom-related domains being registered over the past three weeks, and hundreds of others that they deemed “suspicious.” A new report described in The Verge states that hackers have been registering domains posing as URLs for Zoom, Microsoft Teams, and Google Meet since the COVID crisis began. The malicious URLs are most likely meant to trick users into downloading malware or inadvertently sharing personal information.

The same cyber report also warned about phishing emails that pose as the World Health Organization (WHO), soliciting donations to be sent to several known compromised bitcoin wallets. For more information, see the WHO cybersecurity page

Merkel cites evidence that Russia hacked German parliament

German federal prosecutors have issued an arrest warrant for Dmitriy Badin, an alleged officer of Russia’s military intelligence who is also wanted by U.S. authorities. New evidence has emerged that incriminates him in the hacking of German parliament in 2015. “I can honestly say this pains me,” said German Chancellor Angela Merkel. “On the one hand, I work every day for a better relationship with Russia, and when you see on the other hand that there is such hard evidence that Russian forces are involved in acting this way, this is an area of tension.” The Kremlin denies any involvement with the hack. More on this story at The Associated Press
...
Continue Reading
[-] The following 1 user says Thank You to harlan4096 for this post:
  • Deep900
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
AWZ Screen Recorder
AWZ Screen Recorder ...zevish — 11:05
Website X5 Go 2024.1
Website X5 Go 2024.1...zevish — 09:32
Apple's rules to allow third-party app ...
Apple has announ...alison30 — 09:28
Intel: Microsoft AI PCs need a Copilot K...
Microsoft hopes th...harlan4096 — 08:55
Synchredible 8 Professional Edition v8.2...
          Synchredib...zevish — 08:54

[-]
Birthdays
Today's Birthdays
No birthdays today.
Upcoming Birthdays
No upcoming birthdays.

[-]
Online Staff
There are no staff members currently online.

>