Critical firmware bugs found in products from major IT manufacturers, another WordPress plugin vulnerability found, and this is Identity Theft Awareness Week.
Welcome to Cyber Security Today. It’s Wednesday, February 2nd, 2022. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.
 |
 |
 |
Administrators with hardware and software from some of the world’s biggest IT firms including Microsoft, Fujitsu, Siemens, Dell, HP, HPE, Lenovo, Intel, AMD and Bull Atos are being warned to watch for and install the latest security patches or mitigations. This comes after the discovery of 23 high-impact vulnerabilities in firmware from IT manufactures that used a software development kit from a company called Insyde. It makes the BIOS firmware used by many IT manufacturers. The vulnerabilities could allow an attacker to install malware that bypasses device security solutions. Insyde issued patches on Tuesday. It isn’t known how many computers, servers and routers could be vulnerable.
WordPress administrators who use the Essential Addons for Elemenator plugin on their sites are being urged to install the latest version. This follows the discovery of a critical vulnerability that allows any user to add unapproved files to the website. These files could, for example, steal customer data. The plugin is popular, having been downloaded 1 million times. The version that needs to be installed is 5.0.5, which was released last Friday.
The U.S. Federal Trade Commission has declared this Identity Theft Awareness Week. There are two things to tell you about: Public and private sector organizations have a responsibility to make sure the personal data they hold on employees, customers and partners aren’t stolen. That means having a tough cybersecurity policy to reduce the risk of hacks, limiting access to sensitive information to only those who need it and protecting sensitive information with encryption and de-identifcation technologies. For their part individuals have a responsibility to do everything they can to make sure their identities can’t be stolen. That means making it hard for hackers to guess passwords. That includes not re-using the same password for all the websites you use; not using the default passwords on your Wi-Fi router or internet TV; making sure Windows, Android, iOS and other operating systems on your devices have the latest security patches. Above all, make sure all your online accounts are set up for two-factor authentication to boost protection of logins. Find more information at idtheftcenter.org
Threat actors continue trying to leverage the log4j vulnerability, which was discovered and patched a month ago. The latest report comes from researchers at Morphisec who say hackers are going after the Unifi Network management software that comes with gateways and network appliances made by Ubiquiti. This vulnerability was fixed in Unifi versions 6.5.54 and later. But according to Morphisec, the bug was successfully exploited in an unnamed organization on January 20th. This is another example of why IT departments have to know everything that’s on their network and install security patches on them as soon as possible.
Finally, here’s another of those oopsy reports. Someone didn’t protect data on hundreds of thousands of students from around the world collected by a group that promotes the United Kingdom and English called the British Council. The data was held in a Microsoft Azure blob repository. The information included names, email addresses, student ID numbers and their status. But security researcher Bob Diachenko — known for roaming the internet looking for unprotected databases — and staff at the cybersecurity company MacKeeper found the collection of files in December using a public search engine. If they could find it so could a threat actor. The database has now been locked down.
That’s it for now Remember links to details about podcast stories are in the text version at ITWorldCanada.com. That’s where you’ll also find other stories of mine.
Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon
