Risk Radar Free Cyber Newsletter – Nov 7, 2017

Cyber Security Newsletter

Emergent threats, trends, and news annotated by some of the most well known and respected experts in the industry.

Data Pours from Cloud—And ‘The Enemy is Us’
Cloud data has been leaked by Accenture, Verizon, and Dow Jones. Researches are discovering that the problem is getting worse. The biggest problem with this online cloud storage is the configuration mistakes users make when the cloud storage is setup.
DDoS Attacks Become More Frequent in Q3, with Linux Dominating
Botnets launching DDoS attacks are becoming a bigger issue in 2017. Researchers from Kaspersky Labs are seeing increases in DDoS attack across the globe. They are also seeing an increase in Linux botnets. Much of this is due to insecure Linux on IoT devices.

Cisco Patches DoS Flaw in BGP over Ethernet VPN Implementation
If you use Cisco for your network there is a patch for the IOE XE software that you need to install. The vulnerability allows for remote exploitation of the Border Gateway Protocol (BGP). The attack can cause a crash or corruption of the BGP routing table. This can cause network instability.

Poisoned Search Results Deliver Banking Malware
Attackers are compromising webservers with great financial SEO to deliver banking malware. The search results end up leading the user to these compromised websites.  SEO poisoning has been around for a while, but it is not normally part of a large malware distribution network.
Multi-vector Attack on Android Throws the Kitchen Sink at Victims
The Marcher android banking Trojan is using many techniques to attack Android devices. The main attack starts with a social engineering scheme using a link in SMS or email. If this first attack is successful the user will be directed to install an android app to stop their banking accounts from being blocked.
The Rise of Super-Stealthy Digitally Signed Malware – Thanks to the Dark Web
Digital code signing certificates are used by developers to sign applications. Applications signed with these certificates will not give you a warning when installing the application. Stolen signing certificates are going for big money on the Dark Web. These stolen signing certificates are making digitally signed malware a reality. Right now many of the Anti-Virus programs are not detecting stolen signing certificates.