Cybersecurity Digest - Making Hard Targets - 09Sep2023 | KD Sec & Tech

Hello, Hard Targets!

Welcome back to another issue of our cybersecurity digest, presented by KD Sec & Tech, where the realms of security and art beautifully converge. Each issue is not just a compilation of the latest vulnerabilities, tech breakthroughs, and scams but also a canvas where we paint the intricate details of the digital world with custom artwork for each section.

As the digital landscape continuously evolves, so do the threats that lurk within it. These threats are relentless, adapting, and evolving, always seeking new ways to exploit vulnerabilities. This issue provides a comprehensive overview of the latest vulnerabilities affecting our most-used platforms, groundbreaking advancements in cybersecurity, and a spotlight on the newest scams that have been deceiving users globally.

In today's digital age, cyber threats aren't just about a compromised password or a breached account. They have far-reaching implications, affecting everything from our personal information to our financial well-being. Being informed is your strongest shield against these threats, and our mission is to arm you with this knowledge.

However, it's crucial to remember that cybersecurity isn't a solo endeavor. It's a collective responsibility. The more informed each of us is, the more fortified our entire digital community becomes. If you find this digest insightful, we urge you to subscribe and share it with your friends, family, and colleagues. Most of you will read that and do nothing, but this newsletter will cease without subscribers. Together, we can foster a digital community that's not just interconnected but also safeguarded.

Stay vigilant, stay informed, and always be a Hard Target!

Test your cybersecurity knowledge with our quick quiz. Let's see if you're a true Hard Target!

1. Which of the following is NOT a type of malware?

   • Ransomware

   • Spyware

   • AdBlock

   • Trojan

2. What does the term "phishing" refer to?

   • A type of online scam where attackers try to trick people into giving out their personal information.

   • Searching for vulnerabilities in a network.

   • The process of encrypting data.

   • A method used to increase internet speed.

3. Which of these is a secure password?

   • password123

   • 12345678

   • iloveyou

   • Jk4$9!2mP&1

4. What should you do if you receive an unexpected email with an attachment from an unknown sender?

   • Open the attachment to see what it is.

   • Forward the email to your friends to check if they received it too.

   • Delete the email immediately without opening it.

   • Reply to the sender asking for more details.

5. Which of the following is a good cybersecurity practice?

   • Using the same password for all online accounts.

   • Sharing your password with trusted friends.

   • Regularly updating and patching software.

   • Writing down passwords and keeping them under your keyboard.

Answers:

1. AdBlock

2. A type of online scam where attackers try to trick people into giving out their personal information.

3. Jk4$9!2mP&1

4. Delete the email immediately without opening.

5. Regularly updating and patching software.

Cybersecurity News and Emerging Technology

• Emerging Cyber Threats in 2023: From AI to Quantum to Data Poisoning

• Millions Infected by Spyware Hidden in Popular Apps

• United Airlines Grounded by Software Glitch

• Federal Cybersecurity is Challenged and Strengthened by Emerging Technology

Platform-Specific Vulnerabilities and Pertinent News

iOS

• Update: iPhone - Apple Pushed Out Significant Security Update

• iOS 16.6.1 Patches Security Vulnerabilities in Wallet and More

Android

• Android 14 is Tipped to Release Along with Google Pixel 8

• CherryBlos Malware on Android

macOS

• ConnectionLocator Adware on Mac

• Urgent Apple Zero-Day Flaws Affecting macOS

Windows 10

• Microsoft Vulnerabilities Make Up 75% of the Top 20 Exploited List

• Microsoft Enables Windows Kernel CVE-2023-32019 Fix for Everyone

Windows 11

• KB5028407: How to manage the vulnerability associated with CVE-2023-32019

• Windows 11 Users Urged to Upgrade from Original Version

Scams to Watch Out For

The Top 3 Scams to Look Out For

• Service Survey Scams

• Fake Booking Sites

• Dating Scams

Emerging Cyber Threats in 2023: From AI to Quantum to Data Poisoning

Source: CSO Online

Summary: The article sheds light on the evolving landscape of cyber threats in 2023. It highlights the increasing role of artificial intelligence in both cybersecurity solutions and cyber-attack strategies. The potential of quantum computing to break encryption and the rise of data poisoning attacks are also discussed. These emerging threats underscore the need for organizations to be proactive in their cybersecurity measures.

Everyday Application: The cyber landscape is rapidly changing, with emerging threats that leverage advanced technologies. It's essential to be aware of these threats, especially as they can impact personal data and business operations.

Action: Regularly update and review cybersecurity protocols. Consider investing in advanced security solutions that can counteract the sophisticated threats posed by AI, quantum computing, and data poisoning.

Millions Infected by Spyware Hidden in Popular Apps

Source: The Hacker News

Summary: This article reveals a massive spyware campaign that has infected millions of devices through popular apps. These apps, once downloaded, secretly install spyware that can access personal data, track user activities, and even control device functionalities. The exact source of this campaign is still under investigation.

Everyday Application: The prevalence of spyware in seemingly legitimate apps underscores the importance of being cautious about the apps we install. Even popular apps can be compromised, posing significant risks to personal data and privacy.

Action: Regularly review and audit the apps installed on your devices. Ensure to download apps only from trusted sources and keep your device's operating system and security software updated to protect against such threats.

United Airlines Grounded by Software Glitch

Source: CyberNews

Summary: A software glitch recently grounded several United Airlines flights, causing significant disruptions and delays. The issue, which lasted for hours, is a stark reminder of how reliant modern industries are on technology and the potential fallout when things go wrong.

Everyday Application: This incident highlights the interconnectedness of technology in our daily lives and the broader implications when systems fail. It's not just about data breaches; operational disruptions can have immediate real-world consequences.

Action: For businesses, it's crucial to have contingency plans in place for technological failures. For individuals, always have backup plans when traveling or relying heavily on tech-driven services.

Federal Cybersecurity is Challenged and Strengthened by Emerging Technology

Source: FedScoop

Summary: The article discusses the dual-edged sword of emerging technology in the realm of federal cybersecurity. While innovations offer enhanced security measures and improved defense mechanisms, they also present new challenges and vulnerabilities. The federal sector is in a continuous race to adapt to these technological advancements, ensuring that their systems are both leveraging the latest tech and safeguarded against potential threats.

Everyday Application: The balance of adopting new technologies while ensuring security is a challenge not just for federal entities but for everyone. As technology evolves, so do the threats, making it essential to stay updated and informed.

Action: Stay informed about the latest in tech advancements and the associated security implications. Regularly update systems and software to benefit from the latest security patches and enhancements.

Update: iPhone - Apple Pushed Out Significant Security Update

Source: CBS News

Summary: Apple has released a crucial security update for its iPhone users. This update addresses vulnerabilities that could allow malicious actors to execute arbitrary code with kernel privileges. Apple has acknowledged that these vulnerabilities may have been actively exploited.

Exploitation: Malicious actors could exploit these vulnerabilities to run arbitrary code with kernel-level privileges, potentially gaining full control over the device.

Mitigation: iPhone users are urged to update their devices to the latest version to protect against these vulnerabilities. Regularly checking for software updates and promptly installing them is essential for maintaining device security.

iOS 16.6.1 Patches Security Vulnerabilities in Wallet and More

Source: 9to5Mac

Summary: Apple's iOS 16.6.1 update brings with it patches for several security vulnerabilities, notably in the Wallet app. These vulnerabilities could allow attackers to access sensitive information or perform unauthorized actions within the affected apps.

Exploitation: The vulnerabilities in the Wallet app and other parts of the iOS system could be exploited by attackers to access sensitive data or carry out unauthorized operations.

Mitigation: Users are advised to update to iOS 16.6.1 to benefit from these security patches. Regularly updating the iOS system ensures that users are protected from known vulnerabilities.

Android 14 is Tipped to Release Along with Google Pixel 8

Source: Phone World

Summary: The article discusses the anticipated release of Android 14 alongside the Google Pixel 8. This new version of Android is expected to bring a slew of features and improvements, enhancing the overall user experience. The simultaneous launch with Google Pixel 8 is seen as a strategic move to showcase the capabilities of the new OS.

Everyday Application: The release of a new Android version is significant as it affects a vast number of devices worldwide. It's essential to keep an eye out for updates to benefit from new features and security enhancements.

Action: If you're an Android user, especially a Pixel enthusiast, stay tuned for the official release. Ensure to update your device once Android 14 is available to leverage the latest features and security patches.

CherryBlos Malware on Android

Source: PC Risk

Summary: The article highlights the emergence of the CherryBlos malware targeting Android devices. This malicious software is designed to steal sensitive information from infected devices, posing a significant threat to user privacy and data security.

Exploitation: The malware typically infiltrates devices through malicious app downloads or compromised websites. Once installed, it can access and transmit personal data without the user's knowledge.

Mitigation: To protect against such threats, it's crucial to download apps only from trusted sources like the Google Play Store. Regularly updating your device's software and using reliable security apps can also help in safeguarding against malware.

ConnectionLocator Adware on Mac

Source: PC Risk

Summary: The article delves into the ConnectionLocator adware that specifically targets macOS users. This adware displays intrusive advertisements and can redirect users to dubious websites, potentially leading to further malware infections or data theft.

Exploitation: ConnectionLocator often sneaks into systems bundled with other software or through deceptive advertisements. Once installed, it starts its intrusive ad campaigns and can even modify browser settings.

Mitigation: To prevent such adware infections, always choose custom installation when installing new software to deselect any unwanted apps. Regularly scan your Mac with reputable security software and remove any detected threats.

Urgent Apple Zero-Day Flaws Affecting macOS

Source: Yahoo

Summary: The article alerts users about critical zero-day vulnerabilities discovered in macOS. These flaws can be exploited by attackers to gain unauthorized access, execute arbitrary code, or even take full control of the affected system.

Exploitation: Zero-day vulnerabilities are flaws that are unknown to the software vendor, giving them zero days to fix them before they are exploited. Attackers can leverage these vulnerabilities to compromise macOS devices.

Mitigation: It's crucial for macOS users to keep their systems updated with the latest patches from Apple. Regularly check for software updates and install them promptly to protect against known vulnerabilities.

Microsoft Vulnerabilities Make Up 75% of the Top 20 Exploited List

Source: SDX Central

Summary: The article highlights a concerning trend where Microsoft vulnerabilities constitute a staggering 75% of the top 20 most exploited vulnerabilities. These vulnerabilities are frequently targeted by cybercriminals, making Windows 10 systems particularly susceptible to attacks.

Exploitation: Cybercriminals are increasingly targeting known Microsoft vulnerabilities, leveraging them to infiltrate systems, steal data, and cause disruptions.

Mitigation: Windows 10 users should prioritize keeping their systems updated with the latest security patches from Microsoft. Regularly checking for software updates and promptly installing them can significantly reduce the risk of exploitation.

Microsoft Enables Windows Kernel CVE-2023-32019 Fix for Everyone

Source: Bleeping Computer

Summary: Microsoft has rolled out a fix for the Windows Kernel vulnerability, CVE-2023-32019, to all users. This vulnerability could allow attackers to elevate privileges and take control of the affected system.

Exploitation: The Windows Kernel vulnerability could be exploited by attackers to gain elevated privileges on the system, potentially leading to unauthorized access and control.

Mitigation: Microsoft has released a fix for this vulnerability, and it is essential for Windows 10 users to apply this update immediately. Regularly checking for and installing security updates is crucial to ensure system protection.

KB5028407: How to manage the vulnerability associated with CVE-2023-32019

Source: Microsoft Support

Summary: Microsoft has provided detailed guidance on managing the vulnerability associated with CVE-2023-32019. The documentation offers steps on how to identify and mitigate the risks associated with this specific vulnerability.

Exploitation: The vulnerability, if exploited, could allow attackers to perform actions with elevated privileges, potentially compromising the system.

Mitigation: Microsoft recommends following the provided steps in the support document to manage and address the vulnerability. Ensuring that systems are updated and patched is crucial.

Windows 11 Users Urged to Upgrade from Original Version

Source: Android Headlines

Summary: The article emphasizes the importance for Windows 11 users to upgrade from the original version of the OS. Staying on the initial version could expose users to potential security risks and vulnerabilities.

Everyday Application: Running outdated software versions can lead to potential security breaches and inefficiencies. It's essential to keep operating systems updated to benefit from the latest security enhancements and features.

Action: Windows 11 users should check for available updates and upgrade their systems to the latest version to ensure optimal security and performance.

The Top 3 Scams to Look Out For

Source: YouTube

Summary: In recent times, various scams have been on the rise, targeting unsuspecting individuals. Notable among these are service survey scams, where fake emails from reputed companies lure individuals with promises of gifts in exchange for taking online surveys. These surveys, however, are designed to steal personal information. Another prevalent scam involves fake booking sites that mimic popular platforms. These sites deceive users into providing personal and credit card details under the pretense of making a booking. Lastly, dating scams, especially those targeting men, have seen a surge. These scams often involve emails from individuals posing as potential romantic partners, requesting money for various expenses. It's crucial to remain vigilant and verify the authenticity of any online offers or communications.

Service Survey Scams

• Summary: Online security company Trend Micro has identified a surge in fake emails that appear to be from well-known companies like Costco and Apple. These emails offer attractive gifts, such as a new Samsung Smart TV, in exchange for taking an online survey. However, these fake survey pages are designed to steal your online information when clicked.

• Action: Be cautious of emails offering free gifts in exchange for taking surveys. Always verify the authenticity of such offers before clicking on any links.

Fake Booking Sites

• Summary: Trend Micro has also identified fake booking sites that mimic popular platforms like Airbnb and Booking.com. These counterfeit sites look realistic and prompt users to enter personal and credit card information under the guise of making a booking. However, they are merely collecting this information for malicious purposes.

• Action: Always verify the web addresses of booking sites. Hover over links to check their authenticity and avoid clicking on suspicious links.

Dating Scams

• Summary: Dating scams, particularly those targeting men, are on the rise. These scams often involve emails from individuals, typically posing as young Russian women, promising relationships in exchange for money to cover living expenses, travel costs, and visa fees. The U.S. Embassy in Moscow receives daily complaints from American citizens who have fallen for these scams.

• Action: Be wary of unsolicited emails promising relationships in exchange for money. Always verify the authenticity of such communications and avoid sending money to unknown individuals.

Thank You, Hard Targets!

Your commitment to navigating the intricate world of cybersecurity with us is truly commendable. In this rapidly changing digital landscape, staying informed is our collective strength, and knowledge remains our best defense.

A special acknowledgment to ChatGPT, our AI assistant, for assisting with the formatting and presentation of this digest.

If our insights resonate with you, I wholeheartedly invite you to immerse yourself in our upcoming issues. And for those who haven't taken the plunge yet, consider subscribing here.

To our devoted readers and those just beginning their journey with our digest, remember that sharing this knowledge can create ripples of awareness. Please spread the word to friends, family, and peers, amplifying our collective digital consciousness.

Stay updated with our freshest content and revisit past issues on our website. For a deeper dive into the world of cybersecurity, explore our official website at kdsecntech.com.

Your trust and commitment mean the world to us. Together, let's pave the way for a more enlightened and secure digital tomorrow! Contact me if you have questions or concerns.

Kingdom Dominion Security & Technology