U.S. restaurant chain has been hacked, an attack uses a real document to trip uses and patch open office suites
Welcome to Cyber Security Today. It’s Wednesday February 6th. To hear the podcast click on the arrow below:
 |
 |
 |
Another U.S. restaurant chain has been hit with a data breach. Huddle House, which has several hundred outlets, said the company that supplies its cash register data system was hacked and some restaurant systems were compromised. As a result personal data from an unknown number of credit or debit cards that were used between August 2017 and the first of this month were stolen.
Who could have been victimized? Those who swiped their cards on a card reader, instead of inserting the cards into the bottom of the reader. Remember, if you have a card with a small gold square on it don’t swipe the card. That square is a special chip that protects the data on the card. When you swipe the card, the reader takes personal data off the black stripe on the back of the card. Card readers no longer safely protect data captured that way. And never hand your card over to someone so they take it to the card reader for processing. Have them bring the card reader to you.
This week a network equipment company called Cisco Systems put out a blog about a new attack it’s seen against the Tibetan government in exile. That may not mean much to most listeners, but I’m telling you because it’s an example of how a sophisticated cyber attack works. First, the attacker got hold of the email list of the target organization. Then an email with an infected PowerPoint slide show attachment was sent to everyone on the list. The slide show was real — it had been created and publicly posted by the organization two months ago. So those who opened it saw a copy of a genuine document. Unfortunately opening the attachment they also set up a process which secretly sent out an automated message to a server that this computer was compromised. In response, the server automatically sent malware back to to the computer. In this case the malware allowed an attacker to access the victim’s computer. The Microsoft Office vulnerability that allowed this attack had been patched a year ago. This is another example of why patching your software is so important.
Speaking of patching, some people and businesses are saving money by using open source productivity suites like LibreOffice or Apache OpenOffice for Windows, Linux or Macs. Well, they’re not immune from being attacked, just like Microsoft Office. A security researcher has discovered a severe vulnerability in the two open source suites. He reported them months ago, and LibreOffice was patched — which is another reason why you should update to the latest version if you haven’t done so already. OpenOffice, which may be vulnerable. hasn’t yet issued a fix. For technical details here’s a link to the researcher’s blog.
Finally, Check Point Software is warning Linux server users that a new attack has been spotted. It installs a trojan that can open a backdoor into infected machines. So far its been seen in China and Latin America, but could spread. Linux users, watch for security patches. Here’s a link to more details.
That’s it for Cyber Security Today. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon