Security Leftovers

posted by Roy Schestowitz on Jun 01, 2023

• Security updates for Wednesday

  Security updates have been issued by Debian (connman and kamailio), Fedora (texlive-base), Mageia (cups-filters, postgresql, qtbase5, tcpreplay, tomcat, and vim), Slackware (openssl), SUSE (amazon-ssm-agent, cni, cni-plugins, compat-openssl098, installation-images, libaom, openssl, openssl-1_0_0, openssl-1_1, terraform, terraform-provider-helm, tiff, tomcat, and wireshark), and Ubuntu (batik, flask, linux-oem-5.17, linux-oem-6.0, linux-oem-6.1, linux-oracle, linux-oracle-5.4, mozjs102, nanopb, openssl, openssl1.0, snapd, and texlive-bin).

• OpenZFS – OpenZFS, Your Data and the Challenge of Ransomware

  As commercial storage becomes increasingly expensive, more and more of the Education vertical is looking at Open Source solutions for storage. In this article, we discuss the value of OpenZFS for Universities and how system administrators can best leverage it to their benefit.

• Raidforums member data leaked on new ‘Exposed’ hacking forum

  A recently launched hacking site has published the member database of RaidForums, a notorious hacking forum taken offline in 2022. Founded in 2015, RaidForums operated on the regular internet and was a popular hacking and data leak forum. Although it offered various illegal services, it was best known for trading stolen credentials.

• US intelligence research agency examines cyber psychology to outwit criminal [cr]ackers

  An Intelligence Advanced Research Projects Activity project looks to study hackers' psychological weaknesses and exploit them.

• Penetration tester develops AWS-based automated cracking rig [Ed: Outsourcing anything to AWS is in itself a security/data breach]

  Building a custom cracking rig for research can be expensive, so penetration tester Max Ahartz built one on AWS. In this Help Net Security interview, he takes us through the process and unveils the details of his creation.

• Clinical test data of 2.5 million people stolen from biotech company Enzo Biochem

  An April ransomware attack on a biotech company resulted in the compromise of test information and personal data of nearly 2.5 million people, according to regulatory filings.

  Enzo Biochem, a New York-based biosciences and diagnostics company, said that on April 6 it experienced a ransomware attack that involved the “unauthorized access to or acquisition of clinical test information of approximately 2,470,000 individuals.”

  The company was able to maintain operations but discovered on April 11 that names, test information, and approximately 600,000 Social Security numbers were accessed, “and in some instances, exfiltrated from the Company’s information technology systems,” the company said in an 8-K filing with the U.S. Securities and Exchange Commission. It added that it would notify affected individuals and regulators, as required by law.

• Data breach exposes 58K Hillsborough County voters’ personal information

  An investigation determined the Hillsborough County Supervisors of Elections Office underwent an illegal data breach in early May, exposing more than 50,000 people’s voter information.

  An unauthorized user appeared to have illegally accessed and copied files containing personal identification information, such as social security or driver’s license numbers, the Hillsborough County Supervisor of Elections Office said in a news release. The user was able to gather the information from files used to conduct voter registration list maintenance.

• Russia’s ‘Silicon Valley’ hit by cyberattack; Ukrainian group claims deep access

  Ukrainian hackers have breached the systems of Skolkovo Foundation, the agency which oversees the high-tech business area located on the outskirts of Moscow. The Foundation was founded and charged by Russian former President Dmitry Medvedev to rival Silicon Valley in the U.S.

  According to Skolkovo’s statement, the hackers managed to gain limited access to certain information systems of the organization, including its file hosting service on physical servers.

• Local clinic closes following cyberattack; hospital redirects emergency services

  A local clinic was forced to close its doors temporarily following a cyberattack on its computer systems on Monday morning. A local hospital is also redirecting it’s emergency services to other area hospitals.

  It’s not clear how it happened or when the issue will be resolved, but Mountain View Hospital spokesman Brian Ziel tells EastIdahoNews.com the IT team “identified the attack quickly.” They’re working “around the clock” to solve the problem as quickly as possible. […]

  Idaho Falls Community Hospital is redirecting emergency services to nearby hospitals, but it remains open.

• 9M dental patient records published following LockBit ransomware attack

  The records of nearly 9 million people have been published online following a LockBit ransomware attack on Managed Care of North America Inc. The company, also known as MCNA Dental, is a leading provider of dental plans in the U.S., serving private employers, individuals and families through a range of Medicare, long-term and commercial plans.