OpSec is hard. Lessons learned from the Twitter hack arrests.
As many of you may already know, social media platform Twitter was attacked on 15 July 2020 and 130 high-profile accounts were taken over and used in a scam to collect Bitcoin. During the attack, there was a lot of discussion and marvel at the scope and complexity of the attack and a $1 million bounty was offered to "those who successfully track down and provide evidence for bringing to justice the hackers / people" [behind the attack]. Coverage of the attack and 'buzz' on social media continued for a couple of days. Fast forward to this morning and one of the first things in my news feed was an article that the 17 year old alleged mastermind of the attack was arrested after authorities tracked him down using a…
Adobe issues emergency update to multiple products
Adobe has released emergency updates to address critical vulnerabilities in multiple products including Photoshop, Bridge and Prelude. The vulnerabilities could be used by an attacker to gain access to unpatched systems. Additional Info https://threatpost.com/critical-adobe-photoshop-flaws-patched-in-emergency-update/157581/
Possible Outlook problem with July 2020 Updates
Not much detail (yet) but we just got a notification from AppRiver that they are seeing high call volume regarding Outlook restarting. Below is a link to the issue at AppRiver and we'll post any additional information that we get here. https://status.appriver.com/
Excellent articles / video series from the FTC on protecting Small Business from Cyber Threats
The FTC has released an excellent (and short) video series highlighting some excellent information to help small businesses better understand cyber threats and steps they can take to protect themselves. The videos all relatively short (I believe the longest so far is around four minutes +/-) and the concepts are simple (but not easy). If you own, manage or work for a small business, this is an excellent resource and definitely one that I would recommend checking out. US CERT ArticleFTC ArticleFCC Video Series Are you a small to medium sized business looking to leverage technology and enable your business and workforce to work smarter and more efficiently? Do you already have computers, servers, firewalls, VPNs or other technology that you're not taking full advantage of? Are you looking for…
Happy Independence Day
From all of us at Cyber Tech Cafe to all of you and yours, we hope you have a happy Independence Day.God Bless you and yours and God Bless the United States of America.
Microsoft issues emergency security update
A private security researcher discovered two bugs affecting Windows 10 and Windows Server 2019 that can allow a remote attacker to take remote control of a computer if a user opens a specially crafted image. The bug was reported to Microsoft and updates to fix the bugs were issued earlier today. Additiinal information is available here .
Can I use Windows 7 and / or Windows Server 2008 and still be HIPAA compliant?
On 14 January of this year, Microsoft ended support for its Windows 7 and Windows Server 2008 workstation and server operating systems. This meant that neither Windows 7 or Windows Server 2008 would receive any additional security updates or support from Microsoft. Based on this, I believe that the short answer is no. The HIPAA Security Rule requires that all software used by Covered Entities and their Business Associates be kept up to date with updates from the [software] manufacturer. This means the Electronic Medical Records (EMR), Electronic Health Records (EHR), Practice Management software as well as the Operating Systems. In the case of Windows 7 and Windows Server 2008, since the manufacturer [Microsoft] no longer provides support or updates, this simply is not possible, even if your EMR, EHR,…
June 2020 News & Updates
Executive Summary Criminals continue to take advantage of remote workers connecting to work resources via home networks with (often) lax security controls. In many cases, these unprotected home networks that are connected via VPN connections back to the office are giving attackers an opportunity to completely bypass the corporate firewall.Based on number of bugs patched, June 2020 marks Microsoft's largest Patch Tuesday to date with 129 (or 130, depending on who you ask) bugs patched, with 115 in March 2020 and 113 in April 2020 pulling a close second and third.Adobe released significant security updates for Flash Player and Framemaker that could allow an attacker remote access to vulnerable systems.Windows 7 and Windows Server 2008 are now six months out of support from Microsoft, meaning they are no longer being…