Apache Tomcat Servers - Act Now; WordPress Plugins Actively Exploited; FBI Talks Ransomware at RSA

A vulnerability in the Tomcat AJP protocol can be exploited to read file contents and access source code and configuration files. If the servers allow file uploads, the flaw can also be exploited to remotely execute code. Dubbed GhostCat because it has existed in Tomcat for more than a decade, the vulnerability affects Tomcat versions 6.x, 7.x, 8.x, and 9.x. Apache Tomcat has released versions 9.0.31, 8.5.51, and 7.0.100 to address the issue.

Read more in

Hackers have been exploiting vulnerabilities in several WordPress plugins. Updates are available to address flaws in the Duplicator, Profile Builder, ThemeGrill Demo Importer, Flexible Checkout Fields for WooCommerce, Async JavaScript, 10Web Map Builder for Google Maps, and Modern Events Calendar Lite plugins. Attackers have also been exploiting a vulnerability in ThemeREX Addons; there is currently no update available to address this flaw, and users are urged to remove the plugin from their sites.

Read more in

At the RSA Conference in San Francisco last week, Joel DeCapua, FBI special agent in the Global Operations and Targeting Unit, told an audience that victims of ransomware have paid more than $140 million over the past six-and-a-half years. That figure accounts only for ransom demands paid in bitcoin. DeCapua also said that the initial vector of intrusion for about three-quarters of ransomware attacks is Remote Desktop Protocol (RDP).

Read more in

A ransomware attack hit servers in the UK council of Redcar and Cleveland more than three weeks ago; residents are still unable to access online services. One councilor said they were told recovery would take several months and cost between #11 million and #18 million (US $14 million and $23 million).

Read more in

RailWorks Corp., a railroad track and transit system provider, suffered a ransomware attack in late January 2020. The breach may have compromised personally identifiable information of current and former employees as well as their beneficiaries and dependents; the company has begun notifying affected individuals.

Read more in

A "cybersecurity incident" at Visser Precision, a maker of custom parts for companies in the automotive, aerospace, and other industries, is believed to be a ransomware attack. The attackers also stole data belonging to its business partners, and have reportedly already posted some of the stolen documents.

Read more in

A privacy issue in the Walgreens mobile app (Android and iOS) secure messaging feature exposed users' information to other users. The bug allowed some user to view others' personal messages, which included some health-related information, for several days last month. Walgreens became aware of the issue on January 15, 2020. It has since been fixed. Walgreens operates more than 9,000 drugstores across the US.

Read more in

A database maintained by Internet service provider C3UK was found to be unprotected, exposing information belonging to roughly 10,000 people who used the company's wi-fi service at railway stations. C3UK is a contractor for Network Rail, which owns and manages the infrastructure of most of the railway network in Great Britain.

Read more in

Hackers gained access to email accounts of at least two employees at Munson Healthcare Group in Michigan between July 31 and October 22, 2019. The breach was not detected until January 16, 2020. The compromised accounts had access to patient data, including names, financial account information, Social Security numbers, and insurance, diagnostic, and treatment information. Munson Healthcare operates nine hospitals in Northern Michigan.

Read more in

Pro Publica found that at least 50 election-related websites in the US have serious security issues. Some of the sites are running on software that dates back to 2003, some have inadequate encryption, and some contain unnecessary software. The election-related sites provide information for voters about where to vote, how to register to vote, and they provide election results. None of the sites Pro Publica examined had reported cyberattacks.

Read more in