Researchers at Defiant authored the popular Wordfence security solution for WordPress users and they have detected a massive campaign that has seen hackers actively scanning for websites employing the Kaswara Modern WPBakery Page Builder plugin.
The plugin was recently abandoned by the creative team behind it before receiving a patch for a critical security flaw.
The flaw, tracked as CVE-2021-24284 would allow an attacker to inject a malicious Javascript into any site using any version of the plugin, which would allow the uploading and deletion of files that could easily lead to a complete takeover of the site targeted.
What makes this campaign so impressive is the fact that the hackers have scanned more than a million and a half sites so far, searching for vulnerable targets. Fortunately, only a tiny percentage of sites scanned have been running the vulnerable plugin.
Based on the data collected, the campaign appears to have started on July 4th of 2022, and is ongoing to this day. The attacks originate from more than ten thousand unique IP addresses, indicating a large, organized group of attackers. The identity of the group behind the campaign is not known at this time.
The bottom line here is simple. If you are running this plugin, we recommend stopping immediately and uninstalling it. Since it has been abandoned by its authors, there’s no fix coming and no matter how helpful it may have been to you, it’s just not worth the risk.
Even if some other group adopts the plugin later, there’s no telling how long it might take for that to happen. Even if it did, there’s no way to know how long it might take them to develop a patch for it. For now then, your best bet is to treat this plugin as toxic and steer clear of it.
If you haven’t heard of the UK startup Speechmatics, it may come as a surprise to learn that the company may be on its way to becoming a globally recognized brand.
The company’s ambitious goal is to leapfrog over the progress made by America’s tech giants in speech recognition by using AI and machine learning.
If you own a Google Home device or have ever worked with Siri or Alexa, you are already familiar with the challenges associated with speech recognition. The technology only works well for a tiny slice of the consuming public, with the tech giants focused firmly on their most valuable customers, naturally.
For everyone else, using speech recognition devices is a lesson in frustration. It can even be a problem for some of the speakers for whom the tech has been optimized around, and it can still be frustrating. If you doubt that, try sending a text message using just your voice. It’s an uphill battle, even under ideal conditions.
Speechmatics raised eyebrows worldwide when they released a report which contained the following bit of information:
“Based on datasets used in Stanford’s ‘Racial Disparities in Speech Recognition’ study, Speechmatics recorded an overall accuracy of 82.8 percent for African American voices compared to Google (68.6 percent) and Amazon (68.6 percent). This level of accuracy equates to a 45 percent reduction in speech recognition errors – the equivalent of three words in an average sentence.”
That’s huge and game changing. That fact was one of the keys that enabled the tiny start up to secure more than sixty million USD in Series B funding.
So far, Speechmatic’s AI engine only understands 34 languages, which is a tiny slice of the more than 7,000 languages in use around the world. The company is absolutely determined though, and they’re aiming for the moon.
Their goal is functional speech recognition for everyone who speaks, planet wide, regardless of the language they’re using. It’s a lofty goal, and we can hardly wait to chart their progress.
There’s interesting news in the world of Windows 11 development. Microsoft recently began testing a new Kiosk feature that will enable IT administrators to limit which applications users can use while logged into their user profiles, blocking all other functionalities.
Even better is that the kiosk approach allows you to create multiple different apps and access configurations for different user classifications on a single device.
This approach also unlocks the door to use Windows 11 machines in a variety of ways, including but not limited to:
- Selective blocking of pop-ups and toasts that lead to a cluttered UI and diminish the overall user experience
- Locking down the Start Menu such that it only shows allowed applications
- And limiting access to the Windows Settings menu to selected pages defined by the Admin
If the new feature piques your interest, you can start playing around with it right now by joining the Windows Insiders team and joining the Dev channel.
Once you do, you’ll have access to the detailed instructions on how to toggle the feature on and configure it. All you’ll need to do is to install the latest build, which is Windows 11 Insider Preview Build 25169.
Whatever your opinion is after testing it out, you can leave feedback by pressing WIN +F to access the Feedback Hub under Security and Privacy, then Device Lockdown.
Although this is the latest intriguing addition to Microsoft’s new and improved operating system, there have been a whole raft of additions like this in recent months. So if you decide you want in on the action, you’ll have all sorts of new features and capabilities to explore and play with, most of which will add value to your whole business.
The bottom line is Microsoft really seems to be trying to pull out all the stops here. We think you’ll be impressed.
If you eat out or are in the habit of ordering take-out on a regular basis, be aware.
Recently, a large, well-organized web-skimming campaign has been uncovered that allowed hackers to swipe the payment card details for more than 300 restaurants, impacting more than 50,000 customers.
Web-skimmers are sometimes called Magecart malware and they are bits of JavaScript that collects credit card data when shoppers enter their card data on the checkout page on an online payment portal.
This latest campaign was brought to light by researchers at Recorded Future, who noticed suspicious activity on the ordering portals of InTouchPOS, Harbortouch, and MenuDrive.
There have been two distinct campaigns so far, with the first one beginning on January 18 of 2022 and impacting 80 different restaurants using MenuDrive and another 74 that were utilizing Harbortouch’s platform.
Big chains don’t typically use platforms like these, so most of the impacted restaurants were small, local operations widely scattered across the United States. In both campaigns just mentioned, the web skimmer malware code was discovered on the restaurant’s web pages and its subdomain on the payment portal’s platform.
In the case of Harbortouch, a single malicious JavaScript was used, while two different scripts were deployed against MenuDrive users.
The second campaign targeted InTouchPOS beginning on November 12 of 2021, but most of the actual attacks occurred in January 2022. Here, no details were stolen from the site itself but rather, the attackers overlaid a fake payment form on top of the legitimate one and harvested payment details that way.
Recorded Future reports that both campaigns appear to be ongoing, and the firm has alerted all impacted entities. At the time this piece was written, they had not received a response back from anyone.
In any event, if you order online from a local eatery near you, keep a watchful eye on your account. Your payment data may have been compromised.
Quantum computing is on the horizon. Unfortunately, it’s been on the horizon for at least two decades. It’s one of those technologies that’s always “just around the corner.”
In recent years, however, several important strides have been made. Although quantum computing isn’t exactly mainstream, great strides have been made where the technology is concerned.
There’s a missing link, however. It’s not as though the entire world will wake up one day and just start migrating to quantum computers. There will be a step in between where people are using hybridized systems that can take advantage of the new technology while still using highly optimized conventional computer architecture.
That missing link is currently being developed by Nvidia.
The company has been quietly developing a new platform that it’s calling QODA, which stands for Quantum Optimized Device Architecture. The new platform will create a unified, open environment that can be used to bridge the gap between conventional computer technology and quantum processors.
The hope is that with such a standard in place, it will be a critical step in making quantum computing easier to embrace, which will help to speed mainstream acceptance.
Nvidia hopes to have an open beta available by the end of the year, and once the platform is complete, it will be available for free.
Nvidia initially pitched the idea to the largest quantum computing hardware producers and got a warm reception. So the platform is being designed specifically to allow the equipment produced by those manufacturers to work seamlessly with conventional computing hardware.
That’s big news indeed, as it will allow existing applications to leverage the new technology and give developers plenty of time to work out how best to take advantage of quantum architecture. Kudos to the folks at Nvidia. We can hardly wait to see the fruits of their labor.
According to ongoing research by Group-IB, a massive phishing campaign is currently underway.
This is a campaign that has impacted no less than 130 organizations across a broad range of industries. These include but are not limited to professional recruiting firms and companies connected to finance and technology.
Some of the companies targeted include giants in their respective fields such as:
- TTEC
- Best Buy
- HubSpot
- Evernote
- Riot Games
- AT&T
- Epic Games
- Microsoft
- Slack
- Verizon Wireless
- MetroPCS
- Twilio
- MailChimp
- Klaviyo
- And T-Mobile
This comes with an unsuccessful attempt to breach Cloudflare’s network as well.
The phishing campaign utilizes a kit that has been code-named ‘Oktapus,’ and has been underway since at least March of this year (2022). As the Group-IB report indicates, it has many tentacles indeed. So far, the group behind the campaign has been able to steal nearly ten thousand login credentials and use these to gain access to targeted networks.
The attack begins simply enough, as many such attacks do. The target receives an SMS message with a link to a web page. This page appears to be legitimate. It is a precise copy of a corporate webpage, utilizing all the right branding and logo images.
Invariably, users are presented with a login box and are promoted to enter their account credentials and two-factor authentication codes if applicable. Doing so hands that information over to the hackers controlling the site, giving them another login to abuse.
Okta is a perfectly legitimate and in fact, widely respected Identity-as-a-service (IDaaS) platform that allows users to employ a single login to access all software assets in their company. Unfortunately, hackers have discovered a means of abusing that to steal customer data, which is then used to conduct additional attacks, targeting firms in the supply chain of the initially targeted company.
Even if your company isn’t connected to any of the industries the hackers have targeted thus far, be sure your IT staff is aware of this threat.
Do you make use of the “MyChart” portal to refill prescriptions, contact your healthcare providers or make appointments?
If so, you should know that recently, the healthcare giant Novant disclosed a data breach that impacted more than 1.3 million patients. Impacted patients had their personal information collected by a Meta Pixel ad tracking script.
Meta Pixel, which was formerly known as Facebook Pixel, is a mostly innocuous tracking script used by Facebook advertisers to track the performance of their ads.
According to Novant’s disclosure, the unauthorized access of patient data began in May of 2020 when the company ran a promotional campaign that involved Facebook advertisements. In a bid to track the effectiveness of those advertisements, Novant utilized the Meta Pixel code.
Unfortunately, the code was not configured correctly on the Novant site, and the company’s “MyChart” portal began transmitting personal information to Meta and its advertising partners.
The patient information that may have been exposed includes:
- Patient Email address
- Patient Phone number
- Patient Emergency contact information
- Appointment type and date
- Patient physician
- Portal menu selections
- IP address
- And any content typed into the “free text” boxes
Unfortunately, the MyChart portal is not a Novant specific technology. It is utilized by a total of 64 different healthcare service providers around the country. So even if you don’t use Novant to meet your healthcare needs, your personal data may have been compromised due to the misconfiguration of the tracker.
If there’s a silver lining to be found in all of this, it lies in the fact that the company has now identified all the patients whose data was compromised and has already reached out to them. If you haven’t received a notification, then you can breathe a sigh of relief as your data was not compromised.
Using different passwords on every website and storing them in a secure password manager is a standard best practice in data security. It’s generally good advice, but what happens when the makers of password vaults get hacked?
That’s what the more than twenty-five million users of LastPass are now finding out. LastPass is one of the largest password vaults in the world, and unfortunately, that makes it a tempting target for hackers everywhere. On August 25, 2022, LastPass’ CEO Karim Toubba announced that “an unauthorized third party had stolen portions of the source code and some proprietary LastPass technical information.”
The breach appears to have been confined to the company’s development servers when a developer’s account was compromised. The good news for LastPass customers takes two forms. First is that the development servers did not contain any customer data. Second, LastPass employs “zero knowledge” architecture, meaning that even though it stores your passwords, no one can access your information without your master password.
LastPass stated that the breach had no effect on the master passwords of its users and said that there is no evidence of any more criminal activity. Therefore, there is currently no action that is necessary from those who use their service.
While an investigation into the incident continues, the company said that it has installed new preventative measures and that it has retained the assistance of an industry-leading cybersecurity and forensics firm.
Do you have the Kali Linux distribution running on one of the machines you own? If you’re not sure what that is, then you almost certainly don’t. Kali is a Linux distro used mostly by “ethical hackers” who use it mainly to perform security audits, cybersecurity research, penetration testing and the like.
Offensive Security has recently released an update to the distribution, 2022.3, which adds a raft of improvements including but not limited to:
- Kali NetHunter Updates
- Kali ARM updates
- Improved virtual machine support
- And several wholly new tools
The new tools include BruteShark for network analysis, DefectDojo, which is an open-source application vulnerability correlation and security orchestration tool, phpsploit which is a stealth post-exploitation framework, shellfire, a tool for exploiting LFI/RFI and command injection vulnerabilities and Spraying Toolkit, which replicates password spraying attacks against Lync/S4B, OWA and O365.
If you get your distribution from Kali-Linux-Labs, it will include two additional tools: The Damn Vulnerable Web Application (DVWA) and OWASP Juice Shop.
In terms of ARM support, you’ll find new versions for Raspberry Pi, Pinebook, and USArmory MKII.
The particulars are as follows:
- All Raspberry Pi devices have had their kernel upgraded to 5.15.
- Created arm.kali.org to include an overview and statistics for kali-arm.
- Every Kali ARM device has had their default size for the boot partition set to 256 MB.
- Pinebook has had the broken sleep modes removed, so it should no longer go to sleep and be unable to wake up.
- And USBArmory MKII moved to the 2022.04 u-boot release.
Of interest, Offensive Security made the strategic decision to release this version in tandem with the Black Hat, BSides LV and DefCon security conference. As they put it, it provided a “nice surprise for everyone to enjoy.”
If you use Kali, grab the latest today. If you’ve been looking for a top of line security testing distro, this is the one you want.
