Security Leftovers

posted by Roy Schestowitz on May 04, 2023

• Security updates for Wednesday [LWN.net]

  Security updates have been issued by Debian (avahi, kernel, linux-5.10, nodejs, webkit2gtk, and wpewebkit), Gentoo (chromium, google-chrome, microsoft-edge, dbus, dbus-broker, dhcp, firefox, firejail-lts, libapreq2, libsdl, libsdl2, lua, proftpd, python, PyPy3, sudo, syslog-ng, systemd, tor, uptimed, vim, and xfce4-settings), Oracle (emacs and libwebp), Red Hat (libwebp), Scientific Linux (libwebp), and SUSE (ceph, ffmpeg-4, git, pdns-recursor, and shim).

• City of Dallas impacted by ransomware attack, police computer dispatch system down

  The city of Dallas working to recover from a ransomware attack that has infected its servers, limiting the delivery of city services, including the police department.

  FOX 4 learned about the breach through a tip and the city is continuing to be very tight-lipped, not making anyone available for interviews regarding the scope an impact of the attack.

  The city released a statement on Wednesday afternoon confirming that a number of servers have been compromised with ransomware, impacting "several functional areas."

• Persistent attackers: Eurasia Group believes it has been dealing with the same attackers since 2020

  The total number of individuals affected was not disclosed in the letter. Nor was it clear whether those affected were all employees or if client data was involved.

• Brightline continues notifying clients of GoAnywhere incident; count continues to rise (more than 1 million)

  DataBreaches has written to Brightline’s external counsel to ask whether Brightline has terminated its contract with Fortra or continues using it. No reply was immediately available.

• Murfreesboro Medical Clinic remains closed due to cyberattack

  Murfreesboro Medical Clinic & SurgiCenter was the victim of a sophisticated criminal cyberattack, according to a press release.

  The cyberattack happened on April 22 and in response, MMC said it had to shut down all operations on May 1-3 to limit the spread of the attack. Since shutting down, they’ve been working with law enforcement and experts to identify the source and scope of the attack to restore normal operations.

  CEO Joey Peay said they were able to limit the impact of the attack thanks to the quick response of their technology experts. MMC’s data backup systems were not affected by the attack.

  “They would hit us, and we would try to hit them back,” Peay said about trying to fight the cyber criminals for more than a week. “We thought we were in a pretty good shape and then Sunday morning things changed again. That is what necessitated us closing. We weren’t going to be able to continue to fend off the serious nature of these attacks with our clinic open, our physicians and staff trying to work. It just wasn’t going to be doable.”

• Lawrence Family Development Charter School allegedly attacked by Snatch Team

  Two attempts to contact LFCDS administrators through their website contact forms for messages to faculty and staff both failed with messages “{“statusText”:”*** Forbidden. You sent forms too often. Please wait a few minutes. ***”,”status”:403}”

  There is nothing on the charter school’s website at this time to indicate any disruption or incident and DataBreaches could find no confirmation by them of any attack. DataBreaches subsequently sent emails to administrators at the charter school, but no reply was immediately available. This post will be updated if a reply is received or more information becomes available.

x