This Week’s Top 5 Cybersecurity News Stories May 2024 | 04
Cybersecurity threats are evolving constantly as threat actors look to gain access to your data and money. To help you stay secure, we have searched the internet for the top five cybersecurity news stories of the week that we think you should be aware of. No story is too big or small, as we look at threats from espionage to security flaws in every day devices:
1. Microsoft outage affects Bing, Copilot, DuckDuckGo and ChatGPT internet search
A significant outage at Microsoft impacted several services, including Bing, Copilot, DuckDuckGo, and ChatGPT’s internet search capabilities. The disruption, starting at 3 AM EDT, primarily affected users in Asia and Europe. Bing’s homepage showed errors, though direct searches still worked. Copilot and related services were offline. The outage also disrupted DuckDuckGo, which relies on the Bing API. Microsoft and OpenAI acknowledged the issues and worked on resolving them, gradually restoring services. The root cause was under investigation, with ongoing efforts to prevent recurrence.
For more details, visit the full article here.
2. Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern
Recent ransomware attacks have increasingly targeted VMware ESXi environments, exploiting inherent vulnerabilities and misconfigurations. Cybersecurity firm Sygnia reports that attackers typically gain initial access through phishing or exploiting known vulnerabilities, escalate privileges, and then deploy ransomware on the ESXi infrastructure. The attacks often involve deleting or encrypting backups, exfiltrating data, and spreading to other network segments. Effective mitigation strategies include robust monitoring, strong authentication measures, network segmentation, and comprehensive backup solutions. This trend highlights the critical need for enhanced security protocols in virtualization platforms to prevent and mitigate ransomware threats.
For detailed information, visit the full article here.
3. CISA Warns of Actively Exploited Apache Flink Security Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of a critical security vulnerability in Apache Flink, tracked as CVE-2020-17519. This flaw involves improper access control, allowing attackers to read files on the JobManager’s local filesystem via its REST interface. It affects Flink versions 1.11.0, 1.11.1, and 1.11.2, which have been patched in subsequent releases. CISA advises federal agencies to apply these fixes by June 13, 2024, to protect against ongoing exploitation attempts.
For more details, visit the full article here.
4. Hackers Can Abuse Apple’s Wi-Fi Positioning System to Track Users Globally
Security researchers have identified a vulnerability in Apple’s Wi-Fi Positioning System (WPS) that allows hackers to track Wi-Fi access points and their owners globally. By exploiting the system, attackers can build a comprehensive database of access point locations and track device movements over time. This issue arises from the way Apple’s devices report nearby Wi-Fi BSSIDs and their GPS coordinates to Apple’s servers. Researchers collected data on over 2 billion BSSIDs worldwide, raising significant privacy concerns. Apple has since provided an opt-out mechanism for device owners.
For more details, visit the full article here.
5. Threat Actor Claiming Access to AWS, Azure, MongoDB & Github API Keys
A threat actor has claimed unauthorized access to API keys for major cloud services, including AWS, Azure, MongoDB, and GitHub. This exposure risks unauthorized data access, resource manipulation, and large-scale breaches. The threat actor, posting on social media, asserted that the keys have high permissions and are fully operational. Affected companies are investigating and advising users to rotate their API keys, enable multi-factor authentication, and monitor for unusual activities. These measures are critical to mitigate potential security threats and protect sensitive data.
For detailed information, visit the full article here.
At DIESEC, we have experts on hand waiting to help you with all of your cybersecurity needs, from ensuring your system is safe and secure to teaching your employees how not to fall victim to social engineering ploys.
For more information please contact us now!