Insights

Cyber Insurance – Necessary But Harder To Get

Cyber insurance is becoming more necessary due to the rising costs of a breach. But it is also getting more difficult and expensive to obtain. This Insight looks at the reasons why and what a company can do to help lower cyber insurance costs. 

 

Cyber insurance help

 


Microsoft Discloses 4 Zero-Days in September Update

The recently released patches from Microsoft addressed almost 80 vulnerabilities. Four are Zero-Days that are quite serious. Two allow attackers to bypass Windows security. Another permits attackers to increase their privileges to system-level and the last Zero-Day undoes recent updates that patched other vulnerabilities.  Be sure to patch the first two as soon as possible and the other Zero-Days soon after. Then prioritize the remaining patches based upon the affected systems and your use of that software. 

 

Install Microsoft patches now!


WordPress Mandates Two-Factor Authentication for Plugin and Theme Developers

WordPress is a widely used platform for creating and deploying web content. Its broad acceptance makes it a popular target for hackers. To counter that WordPress is now requiring two-factor authentication to help keep information safer. 

 

WordPress requiring 2FA


Hackers Proxyjack & Cryptomine Selenium Grid Servers

Selenium grid is an open source platform for doing parallel testing of web applications on multiple platforms and browsers. It is said to be used in 30% of cloud environments meaning the compromise of it will affect many companies. It is supposed to be an internal testing tool but over 30,000 servers are publicly reachable making them vulnerable. 

 

Selenium Grid used to deploy malware


'Hadooken' Malware Targets Oracle's WebLogic Servers

Oracle’s WebLogic servers are a widely used platform for developing and deploying applications. Now it is being used by attackers to deploy malware on users. 

 

Oracle WebLogic compromised


Scams, Scams, and more Scams

Scams are very effective ways to steal your information and compromise your accounts. There are many variations but most fall into a few categories. This Insight gives descriptions to help you recognize them and stay safer. 

 

Know the scams to be safer


Apache OFBiz Update Fixes High-Severity Flaw Leading to Remote Code Execution

A recently discovered flaw in Apache’s ERP system that could lead to remote code execution has been patched. Install the patch as soon as possible as the vulnerability is serious. 

 

Apache flaw patched, install ASAP


Cyberattackers Spoof Palo Alto VPNs to Spread WikiLoader Variant

Virtual Private Networks, VPN, are used to provide extra security when connecting to a network. Sadly, attackers have found a way to fool the search engines and prioritize their own sites that masquerade as legitimate resells of Palo Alto’s VPN.   

VPN security circumvented by fake reseller


It looks like we’re stuck with Windows Recall: Microsoft confirms option to uninstall was just a ‘bug’

Windows Recall was a “feature” Microsoft added to their AI system to record everything you do on your device.  This was viewed as  major security nightmare by cybersecurity professionals. Microsoft said Recall could be disabled. Now they say the option to uninstall it was itself a bug.  

Microsoft Recall can't be turned off


Malvertising Campaign Builds a Phish for Lowe's Employees

An example of how easy it is to fool people even employees of a major firm. The way it was done, even fooled the search engines enough to allow the postings. Be very careful when clicking a link, any link. 

Lowes employees led to fake site