October 2016 - Page 2 of 7 - Cyber Security Minute

Flaw in Schneider Industrial Firewalls Allows Remote Code Execution

Issued by: Security Week

On Wednesday, at SecurityWeek’s 2016 ICS Cyber Security Conference, in a presentation meant to demonstrate that attackers could easily bypass defenses if proper ICS protection technologies are not in place, researchers at industrial security firm CyberX disclosed the existence of several important flaws. One of them affects Schneider Electric’s ConneXium TCSEFEC family of industrial ethernet…

Application Security, Vulnerabilities

Cisco Patches 9 Flaws in Email Security Appliance

Issued by: Security Week

The most serious, rated “high severity,” are three DoS flaws in the AsyncOS software for Cisco ESA. The security holes, tracked as CVE-2016-6356, CVE-2016-1486 and CVE-2016-1481, allow a remote, unauthenticated attacker to cause a DoS condition on affected devices using specially crafted emails and malicious attachments. CVE-2016-1481 and CVE-2016-6356 affect AsyncOS versions 8.0 and prior,…

Vulnerabilities

Adobe Rushes Out Emergency Patch For Critical Flash Player Vulnerability

Issued by: Dark Reading

As it has numerous times in the past, Adobe this week rushed out an emergency patch to fix a critical vulnerability in its Flash Player software that would have let attackers take complete control of a vulnerable system. An exploit for the vulnerability is available in the wild and is already being used in attacks…

Malware & Threats

Let’s Clean Up The Internet By Taking Responsibility For Our Actions

Issued by: Dark Reading

Someone has to clean the house, shovel the walk, and mow the lawn. As we grow to adulthood, we realize that this person is us. We either do it ourselves, or we have to earn enough to pay someone else to do it. The Internet has reached a point where we need to take responsibility…

Malware & Threats, Network Security

Was the Dyn DDoS attack actually a script kiddie v. PSN?

Issued by: CIO Security

The massive DDoS attack that disrupted the internet address-lookup service Dyn last week was perhaps pulled off by a script kiddie targeting PlayStation Network and using Mirai malware to assemble a massive IoT botnet, according to research by Flashpoint. “Flashpoint assesses with moderate confidence that the most recent Mirai attacks are likely connected to the…

Network Security

ICS Networks at Risk Due to Flaw in Schneider PLC Simulator

Issued by: Security Week

On Tuesday, at SecurityWeek’s 2016 ICS Cyber Security Conference, Indegy CTO Mille Gandelsman disclosed a vulnerability found by the company in Unity Pro, a Windows-based programming, debugging and operating software for Schneider’s programmable logic controllers (PLCs). Unity Pro, typically deployed on engineering workstations, includes a PLC simulator component that allows users to test applications without…

Vulnerabilities

Critical Vulnerabilities Patched in Joomla

Issued by: Security Week

Two critical account creation vulnerabilities have been addressed on Tuesday in the Joomla content management system (CMS) with the release of version 3.6.4. One of the flaws, identified as CVE-2016-8870, allows an attacker to register on a website even if registration has been disabled. The security hole, affecting the Joomla core in versions 3.4.4 through…

Network Security

Data Leaked by Pagers Useful for Critical Infrastructure Attacks

Issued by: Security Week

Pagers are still used in industrial environments and many organizations don’t realize that the messages sent with these devices can be highly useful to malicious actors looking to launch a targeted attack. After analyzing the use of pagers in the healthcare industry, researchers at Trend Micro have focused their attention on the risk they pose…

Malware & Threats

7 Scary Ransomware Families

Issued by: Dark Reading

As the season of evil witches, ghosts, goblins, and ghouls approaches, it’s time to be on guard. But security managers face scary prospects year-round, especially as new strains of ransomware escalate. And ransomware variants are getting more pervasive – and creepier – than ever. The FBI says that from Jan. 1, 2016 to June 30,…