Welcome to CyberIntelMag’s weekly roundup! A place where you can find the most important stories in the cybersecurity world from the past week.
From the good news:
This week’s good news includes Apple providing a solution to one of the zero-day exploits, Oracle joining the initiative to provide multi-cloud security notifications, Biden signing the Cybersecurity in schools act into law, over 30 countries coming together to stop ransomware attacks, and more.
- Apple has provided a fix to CVE-2021-30883, a zero-day vulnerability. There was a severe memory corruption issue in the IOMobileFrameBuffer. Apple has resolved it, and now this flaw will no longer allow an application to perform commands with kernel privileges on affected devices.
- Google has created a cybersecurity action team with the sole purpose of assisting governments, critical infrastructure, companies, and small businesses with security and digital transformation. The team’s services will cover strategic advisory, trust & compliance, security customer & solutions engineering, and threat intelligence & incident response.
- Oracle is the newest member of the Cloud Security Notification Framework (CSNF). It is a project to mitigate the dependency on security reporting systems of individual cloud service providers. The project’s success will benefit businesses as well as cloud service providers.
- The Biden administration has turned K-12 Cybersecurity Act into law. This law will mandate CISA to assess the threats to the nation’s schools and then provide recommendations and toolkits to school staff on cybersecurity hygiene. It’ll eventually help in securing the critical information held by schools throughout the country.
- The US-led 2-day ransomware virtual summit included representatives from over 30 countries. According to all participating countries, ransomware is an increasing worldwide security issue with significant economic and security repercussions. They emphasized a shared responsibility and assured to strive to increase network resilience to prevent attacks and respond effectively when they occur.
From the bad news:
Many negative events occurred this week, such as Amnesty International identifying a connection between a cybersecurity company and spyware operation, a prestigious Hollywood school being hacked, Iran-based hackers targeting US defense tech businesses, Olympus being cyber attacked again, Acer’s after-sales support system being hacked, Accenture admitting a data leak, and others.
- Amnesty International uncovered proof of espionage against a Togolese activist and signs of spyware deployment in many key Asian nations. An Android malware belonging to the Indian cybersecurity firm Innefu Labs was frequently used to spread the spyware payload.
- Two vulnerabilities discovered by Cisco Talos in the Anker Eufy Homebase may lead to code execution and buffer overflows. The CVE-2021-21940 and CVE-2021-21941 flaws allow an attacker to send the malicious packet(s) to either execute codes or cause a heap-based buffer overflow.
- A prestigious Hollywood school – Harvard-Westlake – got hacked. Academic data of around 150 elite alumni was stolen. It happened because an attacker was able to get the account and password credentials of a senior administrator.
- Microsoft identified that Iran-based hackers are involved in password spray attacks against defense companies that provide military-grade radars, satellite systems, drone technology, and emergency response communication systems to the US, EU, and Israeli government partners.
- A cybersecurity incident primarily affected Meliá’s Spain-based operations. The attackers took down parts of the internal network and specific web-based servers, including the company’s reservation system and public websites.
- A cybersecurity breach happened at Olympus, a Japan-based electronics company. The attack was second in 2021 and targeted its EMEA IT infrastructure. The event occurred only in America, and the company said that no data was accessed.
- Acer’s after-sales support systems in India got hacked, and the hackers stole over 60GB of files and databases from Acer’s servers. Client, business, financial data, and login information of Acer dealers and distributors in India were stolen.
- Accenture admits to unlawful access to their and their service providers’ systems, and the unauthorized acquisition of their data along with customers’ information. All information was confidential, but part of it was made public by the hackers.
