Watch out for marketplace scams, why vulnerabilities are increasing and more
Welcome to Cyber Security Today. It’s Friday, January 15th. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.
Cyber Security Today is brought to you by the new Cisco Security Outcomes Study, where we surveyed 4,800 cybersecurity and IT professionals.Visit https://cisco.com/go/SecurityOutcomes to read the results.Cisco Secure Insights Summit on January 21, 2021, at 10 a.m. Pacific Time.
 |
 |
 |
Online marketplaces and websites running the equivalent of classified ads are being targeted around the world by criminals. These marketplaces offer used and new cameras, game consoles, laptops, smartphones and other products for sale. But according to a security company called Group IB, crooks are making copycat sites that look like the real ones to cheat victims out of their money. The scam, operated by some 40 gangs, first began in Russia but is now moving to cheat people in the United States, France, Poland and other countries. As part of the scheme ads promising goods at very low prices at put on real marketplaces. When a potential buyer contacts the seller they are asked to talk through a messenger service such as WhatsApp or Telegram, or through a local phone number. After paying through a fake website that mimics the real one the crook sends the buyer a URL to a fake delivery service that looks like FedEx or another courier that will supposedly deliver the goods.
Companies operating online marketplaces have to use technology to prevent their infrastructure from being manipulated. Consumers need to make sure they only buy through trusted websites. Requests to use offsite communications services like Telegram or others should be a warning sign. As are large discounts and unbelievable promotions.
One of the ways to measure the lack of success in cybersecurity efforts is by counting the increasing number of reported data breaches. There’s also another way: By measuring the number of reported software vulnerabilities, called CVEs, for short. Security vendor Tenable has looked at the numbers for last year and they aren’t pretty. Researchers reported 18,358 vulnerabilities in 2020, compared to 17,305 in 2019. Some of those found last year were holes in major infrastructure applications from F5 Networks, Palo Alto Networks and PulseSecure that were quickly exploited by crooks.
The number of vulnerabilities keeps going up in part because more people are looking for bugs, and more companies are paying for them to be found. But it can also mean software and website developers aren’t writing enough secure code. The cost, as the report points out, is that cyberattackers take advantage of organizations that don’t patch their systems quickly to close those vulnerabilities.
Network administrators with F5 Networks’ BIG-IP application delivery controller on their systems should install the latest version. Researchers at Positive Technologies discovered a vulnerability that can be exploited just by sending a simple HTTP request to the server the configuration utility is on. Hopefully by now admins have already patched a vulnerability in the controller that was fixed last June.
Here’s more advice for network admins: If you have older and unsupported versions of Cisco Systems’ Small Business RV routers in your infrastructure you need to ditch them. Cisco said this week that while vulnerabilities have been found, they won’t be patched because these devices have reached their end of life. Newer models that have the same features can be bought that are still being supported.
That’s it for this morning. Remember this afternoon you can tune into the Week In Review edition, when I’ll discuss predictions for 2021 with Terry Cutler of Cyology Labs.
Links to details about stories can be found in the text version of this podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at cybersecurity professionals.
Subscribe to Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.