CISA Scolds Microsoft; Ivanti Promises to do Better; xz-utils Backdoor Open Source Community Response; Help Us Improve NewsBites

The US Cybersecurity and Infrastructure Security Agency's (CISAs) Cyber Safety Review Board (CSRB) has released a report on the Microsoft Exchange Online intrusion that occurred last summer. The threat actor accessed Microsoft Exchange mailboxes of high-level officials in the US government using authentication tokens that were signed by a key Microsoft had created in 2016. Microsoft does not know how the threat actor obtained the key. CSRB report finds that the intrusion was preventable, and concludes that Microsofts security culture was inadequate.

Ivanti has published a security advisory that includes fixes or four vulnerabilities in their Connect Secure and Policy Secure Gateways. The flaws CVSS scores range from 5.3 to 8.2. Over the past several months, Ivanti has been struggling with the fallout of government breaches related to their products. The company's CEO, Jeff Abbott, published an open letter promising a revamp of their core engineering, security and vulnerability management practice, and an emphasis on secure by design.

An interview with Andres Freund, who discovered the backdoor; more information about the malicious code itself; and musing about the identity of the developer, Jia Tan, who contributed the malicious code.

Please take 3 minutes to give us your suggestions.

By stealing authentication cookies, thieves can bypass multi-factor authentication and access accounts belonging to true owner of the cookies. Google is taking steps to make stolen cookies useless. A Chromium Blog post reads, we're prototyping a new web capability called Device Bound Session Credentials (DBSC) that will help keep users more secure against cookie theft. The project is being developed in the open at github.com/WICG/dbsc with the goal of becoming an open web standard.

Omni Hotels & Resorts has told customers that recent IT outrages were due to a cyberattack. In a statement on their website, the company says it began responding to the attack on Friday, March 29. Omni initially took some of their systems offline as a precaution; most have since been restored. Customers reported that door locks were not working and that they were unable to pay their bills with a credit card.

A critical vulnerability in the LayerSlider plugin for WordPress could be exploited to steal data, including password hashes. The SQL injection flaw was discovered by a security researcher participating in a recent Wordfence Bug Bounty Extravaganza. The vulnerability was submitted on March 25 and the plugins developers were notified of the flaw that same day. They fixed the vulnerability in LayerSlider version 7.10.1, which was released on March 27. The plugin, which is used to create animated content, has more than one million active installations.

On Tuesday, April 2, Jackson County, Missouri, confirmed that a ransomware attack was responsible for disrupting county services and declared a state of emergency. Impacted services include online property, marriage license, and inmate searches, as well as tax payments. The incident is being investigated by the FBI, the Department of Homeland Security, and third-party IT experts.

City of Hope, a California-based cancer treatment and research center, has disclosed a data breach that impacts personal information belonging to more than 800,000 individuals. The incident occurred between September 19 and October 12, 2023. In a notification letter, City of Hope said that an intruder accessed their IT systems and stole data, including names, various ID information, bank account and payment card numbers, and health insurance and medical information.

Progress Software has released updates to address a critical Improper Neutralization of Special Elements used in an OS Command vulnerability in their Flowmon network monitoring and security solution. The flaw can be exploited to attain remote, unauthenticated access to vulnerable systems. The issue affects Flowmon versions 11.x and 12.x on all platforms. Users are urged to upgrade to Flowmon version 12.3.5 or 11.1.14.

The US Cybersecurity and Infrastructure Security Agency (CISA) has compiled a library of cybersecurity resources for high risk communities, which include activists, journalists, human rights defenders, academics, and other employees associated with civil society organizations that are at heightened risk of being targeted by cyber threat actors because of their identity or work, and many of which have little to no budget for cybersecurity. The resources are grouped into categories: customized tools to assess and mitigate risk; helplines and communities; and tools and services to strengthen your cyber defenses.

Researchers from Cisco Talos have discovered a threat actor that has been stealing financial data and account access credentials from individuals in Asian and Southeast Asian countries. The researchers say the threat actor, which they're dubbed CoralRaider, has been active since at least May 2023. CoralRaider uses a Telegram bot, as a C2, to exfiltrate the victims data.

Researchers at Cofense have detected a phishing campaign targeting organizations in the oil and gas sector with intent to infect systems with a new variant of Rhadamanthys information-stealing malware. The phishing emails purport to be vehicle incident communications from the Federal Bureau of Transportation, which does not exist.