The cybersecurity landscape continues to evolve rapidly, with threat actors evolving their modus operandi every week to target individuals and organizations worldwide. Here are the latest cybersecurity headlines to follow this week:

Apple Fixes Several Security Flaws Affecting its Platforms

Apple recently fixed multiple flaws affecting iOS, iPadOS, tvOS, macOS, and watchOS. Around 37 security flaws were patched in different components of macOS and iOS. These include arbitrary code execution, privilege escalation, DoS, information disclosure, and so much more.

The most notable vulnerability among these was tracked as CVE-2022-2294. It is a memory corruption flaw affecting the WebRTC component and was actively used to launch attacks against Chrome users. However, there is no evidence to prove its exploitation for iOS, macOS, and Safari.

Other arbitrary code execution flaws affecting Apple Neural Engine,  ImageIO, Audio, Kernel, IOMobileFrameBuffer, and WebKit were also detected and patched. Furthermore, five security vulnerabilities were fixed in the latest version of macOS. These affected the SMB module and could be used to leak data, gain privileged access, or execute arbitrary code. Apple recommends that iPadOS 15.6, iOS 15.6, tvOS 15.6, macOS Monterey 12.5, and watchOS 8.7 update their devices at the earliest to ensure ransomware protection.

 

Beware of Fake Nvidia Giveaway Scams

Cyber adversaries have found a new way of tricking people – this time, it’s impersonating popular software company Nvidia. Nvidia’s 30th anniversary is coming soon, and the adversaries are using that to launch a scam where they promise to give away 50,000 Bitcoin. In reality, however, their objective is to steal cryptocurrency.

The hackers created a fake website resembling that of Nvidia, and the website promoted its 30th anniversary. The adversaries also used the company’s logo and CEO’s photo to enhance the scam’s credibility.

As part of the scam, visitors are asked to participate in the ongoing event and choose a category for participation. However, only one big button on the screen says “Bitcoin Giveaway.” Once users click on this button, they are redirected to a page full of bogus giveaway information.

Users are asked to contribute to becoming eligible for the giveaway and are promised their money will be doubled. In addition, they also have a chance to win 50,000 BTC. With such an attractive lure standing in front of the investment-oriented users. Adversaries have always leveraged human greed to quench their greed, and this Nvidia giveaway scam is just another example. Therefore, it is important to be wise on the web and take cybersecurity measures.

 

SEBI Reports Security Incidents

The Securities and Exchange Board of India (SEBI) recently reported a cybersecurity incident affecting its email system. However, experts later confirmed that no sensitive data was stolen in this episode. SEBI had registered an FIR after noticing some suspicious activities in its email system, which was undergoing system upgrades at the time.

Reportedly, 11 official email accounts belonging to SEBI employees were hacked and used to send out bogus emails. SEBI quickly adopted ransomware protection measures and informed CERT-IN about the incident. An official SEBI spokesperson mentioned that it was a small incident and did not lead to any compromise of sensitive information. Further, the organization has taken measures to strengthen its systems.

 

Google to Remove App Permissions List

Google is currently removing the app permissions list from its web and mobile versions. This comes after the launch of its new Data Safety section on the Android Play Store. The Data Safety section was launched in April 2022 and is parallel to the Privacy Nutrition Labels in iOS. This feature lets users have a unified view of an app’s data collection and processing practices.

Google’s Data Safety section requires third-party app developers to provide the required details by 20th July 2022, after which the app permission list will be removed. So far, it’s uncertain whether this decision is a good one because major apps like Instagram, Facebook, WhatsApp, Messenger, Discord, Amazon, PhonePe, and DuckDuckGo are yet to fill out their data safety sections.

What triggered Google to go ahead with the Data Safety Section remains unclear, especially considering that it runs on an honor system and requires developers to make full and correct declarations in the app’s store listing. Cybersecurity experts guess that improved readability is a strong factor influencing Google’s switch to the Data Safety section.

 

Hackers Target Premint NFT

The NFT platform Premint NFT recently underwent a cyberattack where hackers took over its official website and stole 314 NFTs. Cybersecurity experts claim this is one of the biggest NFT hacks ever. Reportedly, hackers infected premint.xyz with a malicious JavaScript code that was designed to instruct users to “set approvals for all” while connecting their wallets to the Premint site. This would enable the threat actors to access users’ crypto assets.

Six externally owned accounts (EOAs) are linked to this attack, which continued to affect on-chain and stole approximately 275 ETH. Fortunately, two of these EOAs were detected, and the funds were redirected back to the victims’ accounts. Experts advise users to refrain from signing transactions that say ‘set approvals for all.’

Certik experts recommend that web3 projects require multiple signatures before granting access to privileged controls’ accounts. Further, it advises that such access be revoked after each use. This marks another example of the rising number of cyberattacks where hackers use web2 vulnerabilities to exploit web3 projects.

 

Adobe Releases Security Updates

Adobe has recently released security updates for Acrobat and Reader, Photoshop RoboHelp, and Character and Animator products. The updates would patch vulnerabilities in these products that could let adversaries take over the affected systems. The patch for Adobe Acrobat and Reader (APSB22-32) addresses 15 Critical vulnerabilities, all of which could end up in arbitrary code execution. These flaws affect both Windows and macOS devices.

The security patch for RoboHelp (APSB22-10) fixes an important vulnerability tracked as CVE-2022-23201. It affects RH2020.0.7 and the earlier versions of RoboHelp. The fix for Adobe Photoshop (APSB22-35) deals with two critical vulnerabilities dubbed CVE-2022-34243 and CVE-2022-34244. The former could lead to arbitrary code execution, and the latter was a memory leak vulnerability. These vulnerabilities affect both Adobe Photoshop 2021 (22.5.7 and earlier versions ) and Adobe Photoshop 2022 (23.3.2 and earlier versions) for Windows and macOS.

As for the patches for Character Animator, the Adobe Acrobat and Reader security update (APSB22-34) fixes two critical vulnerabilities – CVE-2022-34241 and CVE-2022-34242. Both could lead to arbitrary code execution and affect the Character Animator 2021 version 4.4.7 and previous versions. It also affects the Character Animator 2022 (22.4 or earlier versions) for Windows and macOS. Adobe urges that users update their systems at the earliest to ensure protection against cybersecurity issues.

 

Beware of Phishing Scams: Says NYS DMV

The New York State Department of Motor Vehicles (DMV) has recently released a warning asking all customers to be wary of phishing scams. The scam attempts to steal users’ personal details using a text that promises then $1500 rebate on fuel prices. Clicking on the link leads users to a spoofed web page designed by adversaries to look like the official DMV website. It asks users to enter their personal information; as in other phishing attacks, these details automatically reach the attackers.

Providing details on this page also exposes users to malicious software and identity theft. Therefore, cybersecurity experts at DMV advise users to remain vigilant and report any suspicious texts that they receive.

Pin It on Pinterest

Share This