_:n3d497a3aae244e918094e58b75b14bbdxb1
<http://schema.org/text>
"Good morning and welcome to today's briefing. We have multiple Updates and Security News starting with Zyxel Firewalls being targeted again, Dell BIOS Disconnect vulnerability, CISCO ASA XSS Vulnerability and Google Computer Virtual Machine Takeover Vulnerability. Then we move to various security news including more information on another attack by the Solawinds hackers, WD Hard drives being remotely wiped, Many Hats Group being closed and some ransomware/crypto currency news. We end up with a list of recent security breaches and we end up with two funnies. Have an awesome day!&gt;&gt; Patches &amp; UpdatesHackers are using unknown user accounts to target Zyxel firewalls and VPNs“Network device maker Zyxel is warning customers of active and ongoing attacks that are targeting a range of the company’s firewalls and other types of security appliances.In an email, the company said that targeted devices included security appliances that have remote management or SSL VPN enabled, namely in the USG/ZyWALL, USG FLEX, ATP, and VPN series running on-premise ZLD firmware. The language in the email is terse, but it appears to say that the attacks target devices that are exposed to the Internet. When the attackers succeed in accessing the device, the email further appears to say, they are then able to connect to previously unknown accounts hardwired into the devices.”https://arstechnica.com/gadgets/2021/06/zyxel-scrambles-to-thwart-active-hacks-targeting-customers-f...BIOS Disconnect: New High-Severity Bugs Affect 128 Dell PC and Tablet Models“Cybersecurity researchers on Thursday disclosed a chain of vulnerabilities affecting the BIOSConnect feature within Dell Client BIOS that could be abused by a privileged network adversary to gain arbitrary code execution at the BIOS/UEFI level of the affected device.\"As the attacker has the ability to remotely execute code in the pre-boot environment, this can be used to subvert the operating system and undermine fundamental trust in the device,\" researchers from enterprise device security firm Eclypsium said. \"The virtually unlimited control over a device that this attack can provide makes the fruit of the labor well worth it for the attacker.\"”https://thehackernews.com/2021/06/bios-disconnect-new-high-severity-flaws.htmlCisco ASA Flaw Under Active Attack After PoC Exploit Posted Online“Tracked as CVE-2020-3580 (CVSS score: 6.1), the issue concerns multiple vulnerabilities in the web services interface of Cisco ASA software and Cisco Firepower Threat Defense (FTD) software that could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks on an affected device.As of July 2020, there were a little over 85,000 ASA/FTD devices, 398 of which are spread across 17% of the Fortune 500 companies, according to cybersecurity company Rapid7.”https://thehackernews.com/2021/06/cisco-asa-flaw-under-active-attack.htmlUnpatched Virtual Machine Takeover Bug Affects Google Compute Engine“An unpatched security vulnerability affecting Google's Compute Engine platform could be abused by an attacker to take over virtual machines over the network.\"This is done by impersonating the metadata server from the targeted virtual machine's point of view,\" security researcher Imre Rad said in an analysis published Friday. \"By mounting this exploit, the attacker can grant access to themselves over SSH (public key authentication) so then they can login as the root user.\"https://thehackernews.com/2021/06/unpatched-virtual-machine-takeover-bug.html&gt;&gt; Security NewsMyBook Users Urged to Unplug Devices from Internet“Hard drive giant Western Digital is urging users of its MyBook Live brand of network storage drives to disconnect them from the Internet, warning that malicious hackers are remotely wiping the drives using a critical flaw that can be triggered by anyone who knows the Internet address of an affected device.”https://krebsonsecurity.com/2021/06/mybook-users-urged-to-unplug-devices-from-internet/https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-prompts-warning-from-weste...SolarWinds hackers breach new victims, including a Microsoft support agent“The nation-state hackers who orchestrated the SolarWinds supply chain attack compromised a Microsoft worker’s computer and used the access to launch targeted attacks against company customers, Microsoft said in a terse statement published late on a Friday afternoon.The hacking group also compromised three entities using password-spraying and brute-force techniques, which gain unauthorized access to accounts by bombarding login servers with large numbers of login guesses. With the exception of the three undisclosed entities, Microsoft said, the password-spraying campaign was “mostly unsuccessful.” Microsoft has since notified all targets, whether attacks were successful or not.”https://arstechnica.com/gadgets/2021/06/solarwinds-hackers-breach-new-victims-including-a-microsoft-...Many Hats Club founder announces closure – spelling end for podcast, conference, Discord community“The Many Hats Club (TMHC), the infosec non-profit that produces popular podcasts and conferences alongside a Discord community, is to disband as of today (June 29).Announced on Twitter yesterday by London-based co-founder Stuart Peck, the news spells the end of the TMHC’s podcast, blog, IsolationCon conference, dedicated server for security research collaboration, and Discord channels covering topics such as malware reversing, OSINT, and social engineering.Having founded the community with ‘@buydogs’ in 2017, Peck, director of cyber strategy at ZeroDayLab, tells The Daily Swig that he did not take the decision “lightly” having seen the community achieve “so many positive things that I’m extremely proud of.”https://portswigger.net/daily-swig/many-hats-club-founder-announces-closure-spelling-end-for-podcast...DoubleVPN servers, logs, and account info seized by law enforcement“Law enforcement has seized the servers and customer logs for DoubleVPN, a double-encryption service commonly used by threat actors to evade detection while performing malicious activities.DoubleVPN is a Russian-based VPN service that double-encrypts data sent through their service.”https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law...Binance reveals how data analytics led to ransomware-linked money laundering bust“The Binance cryptocurrency exchange has explained how advances in data analytics helped it track down a group of money launderers involved with various cybercrimes, including the notorious Clop ransomware scam.Ukrainian police announced the arrest of individuals and the takedown of infrastructure related to the ‘Clop’ ransomware operation earlier this month.Binance’s statement confirms that those arrested were cashing out and laundering funds, rather than being behind the creation of the ransomware.”https://portswigger.net/daily-swig/binance-reveals-how-data-analytics-led-to-ransomware-linked-money...&gt;&gt; Security Breacheshttps://threatpost.com/data-700m-linkedin-users-cyber-underground/167362/https://threatpost.com/tulsa-police-data-leaked-conti-ransomware/167220/https://portswigger.net/daily-swig/west-virginia-job-seekers-alerted-to-govt-employment-agency-data-...https://portswigger.net/daily-swig/mercedes-benz-usa-admits-some-customers-credit-card-details-drive...https://portswigger.net/daily-swig/instagram-vulnerability-nets-researcher-30k-after-exposing-users-...https://portswigger.net/daily-swig/security-training-org-ec-council-pulls-blog-over-copyright-violat...https://www.bleepingcomputer.com/news/security/microsofts-halo-dev-site-breached-using-dependency-hi...https://www.bleepingcomputer.com/news/security/russian-hackers-had-months-long-access-to-denmarks-ce...&gt;&gt; Security Funnieshttps://www.reddit.com/r/iiiiiiitttttttttttt/comments/oa470n/important_updates_are_waiting_to_be_ins...https://www.reddit.com/r/iiiiiiitttttttttttt/comments/o5ves3/you_already_know_how_this_goes/Stay safe. Stay cautious.To be kept in the loop quicker, join the Spiceworks Unofficial Discord (https://discord.gg/V7ggSA2) and keep an eye out on the #security-news channel. New SOC (Security Operations Center) briefings will always post in both the General IT Security and Cybersecurity groups.Which was the most impactful for you?"
<https://frontend.spiceworks.com/topic/2323452-the-soc-briefing-for-june-30th-remotely-wiped?page=1#entry-9212156>