Australia, UK, and US Announce Security Partnership

With the help of malicious insiders, a fraudster was able to install malware and remotely divorce iPhones and other handsets from the carrier’s U.S. network — all the way from Pakistan.

Jeff Costlow, CISO at ExtraHop, makes the case for implementing next-gen intrusion-detection systems (NG-IDS) and retiring those noisy 90s compliance platforms.

You can find ram’s horn squid shells on beaches in Texas (and presumably elsewhere).

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Microsoft and RiskIQ researchers have identified several campaigns using the recently patched zero-day, reiterating a call for organizations to update affected systems.

Citizen Lab released a report on a zero-click iMessage exploit that is used in NSO Group’s Pegasus spyware.

Apple patched the vulnerability; everyone needs to update their OS immediately.

News articles on the exploit.

Sadly, online job scams targeting older adults have been an issue for years. However, in a pandemic job market, cybercriminals are working overtime to devise schemes that exploit job seekers’ need for financial security.  

According to the Better Business Bureau, Americans lost more than $62 million in employment scams in 2020. In addition, with federal unemployment benefits ending this month, that number is expected to rise as more people head online to look for work.    

Online hiring scams can be hard to detect because scammers advertise job opportunities the same way legitimate employers do—via online ads, job sites, and popular social networking channels. They promise job seekers opportunity and hope but are carefully designed to the applicant’s personal information or deceive them into sending money. 

Online Hiring Scams 

Here are just a few examples of online jobs scams targeting older adults and a few ways to avoid becoming a victim.   

Bogus LinkedIn job offers 

Last year the Federal Trade Commission (FTC) identified and shut down a scam on LinkedIn in which a company sent potential job candidates a direct message promising a high-paying job still unpublished to the public. The catch? Potential candidates were asked to pay a fee of up to $2,500 to set up the interview. Variations of this scam, using LinkedIn as a channel, may be in play. 

Fraudulent employers 

Some scammers are getting especially bold and posting job openings using the names, logos, and even staff names from legitimate companies to lure unsuspecting job seekers into fake interviews. After a questionnaire or interview, the company informs the applicant they have the job. From there, they collect personal information as if it’s part of a legitimate onboarding process—only the job doesn’t exist. 

Work-from-home scams 

A popular scam involves a company offering job seekers a six-figure income working from home with the promise you can “be your own boss “and “set your own schedule.” The catch: Job seekers must first purchase a starter kit or some form of online coaching package to qualify for the “opportunity.” After that, the company can disappear or charge the consumer thousands of dollars more for training that never comes. 

Identity theft 

According to the BBB, some scams include job seekers submitting personal information to potential employers only to have that information stolen and used for fraudulent schemes. Some scams even involve online interviews that appeared legitimate; only the interviewer didn’t appear on camera. The bogus employer asks for personal data during the interview, including banking information needed for direct depositing a paycheck. 

Spot & Stop a Scam 

Awkward hiring process 

If an employer attempts to hire you by text, email, or a photo-only video interview, beware. Legitimate employers, no matter how small, will have a professional hiring process. Job Search Safety Tips: 1) Call the company to make sure the job offer is legitimate. 2) Verify the name of the company contact through LinkedIn and verify the person with whom you are communicating  3) Consider comprehensive security software to protect your devices from malware sent via phishing emails from potential employers.  

Request for money 

A legitimate employer will not ask for money from a potential or new hire. Nor will they ask you to purchase “training” or cash a check for “software” as part of your employment. Job Search Safety Tip: Check the BBB’s Scam Tracker for scams connected to a company.  

Checks exchanged 

If an employer sends you a cashier’s check or even a corporate check, know it may not be real, even if your bank accepts it for a deposit (it won’t clear). Various fake check scams can pull in unwitting victims through job posts that advertise positions for merchandise resellers, virtual assistants, mystery shoppers, car wrappers, caregivers, and photographers.  

Request for personal financial info

If an employer immediately asks for personal data such as your SSN, birthdate, driver’s license number, etc., chances are it’s a scam. Job Search Safety Tip: 1) Bank-routing information is for direct deposits after you’ve met an employer in person. If you are applying for remote work, wait for a signed offer, be sure to verify the company and the offer before sharing financial information. 2) Consider using a Virtual Private Network, to share any kind of private information regarding employment.  

Urgency and pushiness

Job scammers target people who are stressed and desperate for work. If the potential employer seems to be pushing you to give information, send money, or take the next step, it may be a scam. Job Search Safety Tip: Slow down and ask yourself, “Does this sound right?” Seek out the opinion of a friend or relative if needed.  

Resources for Seniors

Stay informed 

Need guidance? Call the AARP Fraud Watch Network helpline toll-free at 877-908-3360. Stay aware of scams targeting seniors at aarp.org/fraudwatchnetwork. 

Report job fraud

If you are the victim of a scam or attempted scam, report it to the FTC, IC3, FBI, and IdentityTheft.gov. 

Finally, remember that legitimate job boards such as Indeed, Monster, and LinkedIn can contain fake companies, bogus jobs, and positions that look incredible that will cause incredible heartache for a job seeker that forges ahead without caution.    

The post How to Help Seniors Spot Online Job Scams appeared first on McAfee Blogs.

Why am I here?

There’s a lot of information out there on critical vulnerabilities; this short bug report contains an overview of what we believe to be the most news and noteworthy vulnerabilities. We don’t rely on a single scoring system like CVSS to determine what you need to know about; this is all about qualitative and experience-based analysis, relying on over 100 years of combined industry experience within our team. We look at characteristics such as wormability, ubiquity of the target, likelihood of exploitation and impact. Today, we’ll be focusing on CVE-2021-40444.

CrossView: CVE-2021-40444

What is it?

CVE-2021-40444 is a vulnerability in Office applications which use protected view such as Word, PowerPoint and Excel which allows an attacker to achieve remote code execution (RCE). CVE-2021-40444 is a vulnerability which allows a carefully crafted ActiveX control and a malicious MS Cabinet (.cab) file to be launched from an Office document. 

Most importantly, this vulnerability impacts the applications themselves, as well as the Windows Explorer preview pane.

Who cares?

This is a great question! Pretty much anyone who uses any Microsoft Office applications, or has them installed, should be concerned.

Office is one of the most widely-used applications on the planet. Odds are good you have it open right now. While many companies have disabled macros within Office documents at the Group Policy level, it is unlikely ActiveX is treated similarly. This means that without proper data hygiene, a large proportion of Office users will be vulnerable to this exploit.

Fortunately, “spray and pray” style email campaigns are unlikely to gain traction with this exploit, as mail providers have started flagging malicious files (or at least known PoCs) as potential malware and removing them as attachments.

What can I do?

Good news! You aren’t necessarily completely helpless. By default, Windows uses a flag known as the “Mark of the Web” (MoTW) to enable Protected Mode in Office. Email attachments, web downloads, and similar all have this MoTW flag set, and Protected Mode prevents network operations, ActiveX controls, and macros embedded within a document from being executed, which effectively disables exploitation attempts for this vulnerability.

That said, users have become so inured to the Protected View message, they often dismiss it without considering the consequences. Much like “confirmation fatigue” can lead to installing malicious software, attackers can leverage this common human response to compromise the target machine.

Even more so, while exploitation can occur via the Office applications themselves and via the Explorer preview pane, the Outlook preview pane operates in a completely different manner which does not trigger the exploit. Exactly why this distinction exists only MS can explain, but the upshot is that Outlook users have to explicitly open malicious files to be exploited – the more hoops users have to jump through to open a malicious, the less likely they are to be pwned.

If I’m protected by default, why does this matter?

It depends entirely on how the file gets delivered and where the user saves it.

There are many ways of getting files beyond email and web downloads – flash cards for cameras, thumb drives, external hard drives, etc. Files opened from these sources (and many common applications[1]) don’t have MoTW flag set, meaning that attackers could bypass the protection entirely by sending a malicious file in a .7z archive, or as part of a disk image, or dropping a USB flash drive in your driveway. Convincing users to open such files is no harder than any other social engineering strategy, after all.

Another fun workaround for bypassing default protections is to make use of an RTF file – emailed, downloaded, or otherwise. From our testing, an RTF file saved from an email attachment does not bear the MoTW but can still be used as a vector of exploitation. Whether RTF files become the preferred option for this exploit remains to be seen.

TL;DR

Ha! We put the tl;dr near the end, which only makes sense when the information above is so important it’s worth reading. But if all you care about is what you can actively do to ensure you’re not vulnerable, this section is for you.

Mitigations:

• Apply the Patch! Available via Windows Update as of 9/14/2021, this is your best solution.
• Enable registry workaround to disable ActiveX – details can be found on Microsoft’s bulletin page and should effectively disable exploitation attempts until a formal patch can be applied.
• Confirm that Windows Explorer “Preview” pane is disabled (this is true by default). This only protects against the Preview pane exploitation in Explorer. Opening the file outside of Protected Mode (such as an RTF file) or explicitly disabling Protected Mode will still allow for exploitation.

The Gold Standard

In case you simply can’t apply the patch or have a “production patch cycle” or whatever, McAfee Enterprise has you covered. Per our KB we provide comprehensive coverage for this attack across our protection and detection technology stack of endpoint (ENS Expert Rules), network (NSP) and EDR.

https://kc.mcafee.com/corporate/index?page=content&id=KB94876

[1] 7zip, files from disk images or other container formats, FAT formatted volumes, etc.

The post The Bug Report | September 2021: CVE-2021-40444 appeared first on McAfee Blogs.

FTC: Health Apps Must Notify Consumers of Data Breaches

Household Names Hit with £500K Fine for Spamming Consumers