Vulnerabilities in popular tech, major WordPress plugin attacks and phishing, highlight this week’s cybersecurity news. Here are the latest threats and advisories for the week of September 16, 2022.
Threat Advisories and Alerts
Security Updates Released for Apple Zero-Day Vulnerabilities
For the eighth time this year, Apple has addressed zero-day vulnerabilities in its Mac and iPhone operating systems. The vulnerabilities apply to Safari 16, iOS 15.7, iOS 16, macOS Monterey 12.6, macOS Big Sur 11.7 and iPadOS 15.7. Threat actors could exploit the flaws to take control of affected devices. Users of these products are recommended to apply the security updates immediately.
Microsoft’s September Patch Tuesday Addresses 63 Vulnerabilities
In this month’s Patch Tuesday, Microsoft fixes 63 vulnerabilities, 5 of which are classified as critical because they allow remote code execution. Two zero-day vulnerabilities are also included, one of which has been actively exploited in attacks. Click the source link below for a complete list of this month’s Patch Tuesday security updates.
Potential Increase in Phishing Attacks in Light of Queen’s Death
The National Cyber Security Centre has issued a warning that phishing scams may increase in the weeks following Her Majesty the Queen’s death. While the NCSC has yet to see a notable uptick in attacks, British citizens should remain vigilant as cybercriminals often exploit victims’ vulnerability around emotional events or topics. All suspicious emails should be reported to [email protected]gov.uk.
Source: https://www.ncsc.gov.uk/news/potential-phishing-activity-update
Emerging Threats and Research
Customers’ Personal Information Exposed in U-Haul Data Breach
The American moving and storage company U-Haul revealed they suffered a data breach between November 5, 2021, and April 5, 2022. The incident occurred when an unauthorized person infiltrated the U-Haul rental contracts search portal to access some customers’ driver’s license information, names and rental contracts. Customers’ payment information wasn’t accessed, nor were U-Haul’s payment processing, financial or email systems.
280,000+ WordPress Sites Attacked Due to WPGateway Plugin Vulnerability
The WordPress premium plugin WPGateway is being actively exploited. Over 4.6 million attacks on 280,000+ websites have occurred in the past month, trying to exploit the vulnerability. In the event of a successful attack, threat actors could take over a website. Users can tell their website has been affected if they see an admin with the username “rangex.” Until a patch is released, users are advised to uninstall the plugin.
Source: https://thehackernews.com/2022/09/over-280000-wordpress-sites-attacked.html
New Browser-in-the-Browser Phishing Technique Used to Steal Steam Credentials
Users of the video game digital distribution service Steam are being targeted by threat actors with a new type of phishing attack. The technique called Browser-in-the-Browser (BitB) opens a fake browser window within a legitimate active window. This malicious window masquerades as a sign-in pop up page for users to login. If users enter their information, it’s sent to the cybercriminals. Some of the Steam accounts that have been stolen are worth a reported $100,000 - $300,000.
Source: https://www.infosecurity-magazine.com/news/hackers-steal-steam-logins-bitb/
Nearly 5 Million Attacks Strike WordPress BackupBuddy Plugin Vulnerability
A zero-day vulnerability in the WordPress plugin BackupBuddy has had nearly 5 million attempted attacks since August 26, 2022. According to the plugin’s developer, "This vulnerability could allow an attacker to view the contents of any file on your server that can be read by your WordPress installation… This could include the WordPress "wp-config.php" file and, depending on your server setup, sensitive files like "/etc/password." BackupBuddy users are advised to update the plugin immediately.
Source: https://thehackernews.com/2022/09/hackers-exploit-zero-day-in-wordpress.html
To stay updated on the latest cybersecurity threats and advisories, look for weekly updates on the (ISC)² blog. Please share other alerts and threat discoveries you’ve encountered and join the conversation on the (ISC)² Community Industry News board.