TLP: WHITE

OPEN CALL FOR RECRUITERS

Conference attendees will have the opportunity to meet with representatives from local businesses and organizations with open or prospective cybersecurity positions. If your organization would like to staff a table at the conference, please contact the NJCCIC at njccic@.... There is no cost to staff a table. 

The NJCCIC Alice in Cyberspace conference will be hosted at Kean University in Union, NJ on September 28, 2018 from 8:00 AM through 4:30 PM. The intent of the conference is to attract women to the cybersecurity profession and encourage more women to pursue leadership roles in the field. Speakers will cover a range of topics, including highlighting different disciplines within cybersecurity, moving into management and CISO roles, and overcoming obstacles, particularly those e  xperienced by women. Our goal is to provide attendees with increased knowledge of the cybersecurity industry and the many opportunities it offers, empower women to pursue leadership roles in the industry, and provide a venue to network with industry professionals and potential employers. Additional details including agenda, speaker information, and directions can be found here.

There is no cost to attend this conference; however, seating is limited and registration is required.
 

Complimentary breakfast and lunch will be provided.

Please Note: Those who register for this event and are not currently NJCCIC members will be required to sign up for free membership.
 

Please use the appropriate registration form to register for this event.
If you are a professional, please register here.
If you are a student, please register here. 

Researchers at Palo Alto Network’s Unit 42 have identified new variants of the Mirai and Gafgyt internet-of-things (IoT) botnets. The newest Mirai botnet is targeting the same Apache Struts vulnerability, CVE-2017-5638, exploited in the 2017 Equifax breach, while the new Gafgyt botnet is targeting a recently disclosed vulnerability, CVE-2018-9866 , in older, unsupported versions of the SonicWall Global Management System (GMS). These botnet variants have been used in major distributed denial-of-service (DDoS) attacks since at least September 2016. The NJCCIC recommends administrators of Apache Struts and SonicWall GMS, as well as IoT devices, review the Unit 42 report and ensure the aforementioned products are kept up-to-date with the latest patch levels.
 

Security researcher Bob Diachenko discovered a new attack targeting remotely accessible MongoDB databases, dubbed Mongo Lock. In this campaign, threat actors scan the internet for vulnerable servers and, once located, export the databases, delete them, and generate a ransom note demanding payment in return for the servers’ contents. Using a publicly available internet-of-things (IoT) search engine, NJCCIC analysts determined that New Jersey has over 1,000 MongoDB servers open and exposed to the internet that may be vulnerable to this and similar attacks. Last year, the NJCCIC released several alerts warning members about cyber extortion campaigns that were actively targeting vulnerable MongoDB servers. We recommend that administrators of MongoDB servers review our previous NJCCIC Cyber Alert, audit their security settings, and implement the mitigation strategies provided as soon as possible. Additionally, review MongoDB’s recommendations and checklist for securing databases here and here.
 

Schneider Electric notified customers that they may have received USB drives infected with malware in recent product shipments. In an August 24 security advisory, the company stated that these USB drives held support documentation for the company's Conext Combox and Conext Battery Monitor solar-power products and did not contain any operational software, leaving operational security unaffected. The impacted USB drives were infected with malware during manufacturing by one of their suppliers. Schneider Electric advised customers to discard any USB drives that have shipped with their products and those who used a potentially infected USB drive are encouraged to perform a full system scan to identify and remove any malware found. This incident highlights the risks associated with the supply chain and the use of removable media. The NJCCIC recommends organizations who have purchased the impacted Schneider Electric equipment follow the recommendations provided in their security advisory, scan all USB drives prior to connecting them to any device on their network, and consider discontinuing the use of removable media.
 

A security researcher discovered an unpatched vulnerability, CVE-2018-8383, in the Safari web browser that allows an attacker to control the content displayed in the browser's address bar. The flaw can be exploited for phishing attacks, making them much more difficult to identify. The vulnerability also existed in Microsoft’s Edge browser but was patched on August 14 as part of their regular security updates; Apple has yet to release a patch.  The NJCCIC recommends Safari users and administrators review security researcher Rafay Baloch’s blog post for more information and apply the necessary patch if and when it becomes available. Users and administrators of the Edge browser are advised to ensure they have applied the most current patch levels.
 

The browser extension for Keybase, a communication and collaboration platform whose function is securing traffic between the source and destination via public-key cryptography, contains a flaw that leaves Keybase Chat messages unencrypted from the extension to their local copy of Keybase, possibly allowing sites to view these messages. The flaw was discovered by Wladimir Palant, maker of the AdBlock Plus tool. The NJCCIC recommends Keybase users review Palant's article and discontinue use of the extension, particularly if it is used for sensitive communications.
 

British Airways

British Airways announced that customer data was stolen between August 21, 2018 and September 5, 2018. The data retrieved includes the personal and financial details of approximately 380,000 customers who made bookings and changes on ba[.]com and on the airline’s app; travel and passport details were not revealed. According to a report by digital threat management company RiskIQ, the known adversary group Magecart is believed to be responsible for the breach. The NJCCIC recommends impacted British Airways customers closely monitor their credit profiles and financial accounts and immediately report any suspicious activity.
 

Veeam

Security researcher Bob Diachenko discovered about 445 million customer records on a server left unprotected and open to the internet belonging to Veeam, a Swiss-based company that provides intelligent data management services for virtual, physical, and cloud infrastructures. The 200 GB MongoDB database was discovered on September 5 and removed four days later. The information exposed includes customers' first and last name, email, email recipient type, country, attributes values, some IP addresses, and customer organization size. The NJCCIC recommends organizations using MongoDB servers review their security guidelines and advises impacted customers to be on alert for targeted social engineering campaigns.
 

Social Engineering Awareness

TLP: WHITE