If you use certain VMWAre products, be aware that the company has recently identified and issued a patch for a total of five critical security vulnerabilities.

These are being tracked as:

CVE-2022022954 (This issue is a server-side template injection remote code execution issue)
CVE-2022-22955
CVE-2022-22956 (This issue, and the one above it are both OAuth2 ACS authentication bypass vulnerabilities)
CVE-2022022957
And CVE-20220958, with these last two being JDBC injection remote code execution vulnerabilities.
The products impacted by these issues are:

vRealize Suite Lifecycle Manager
VMware Cloud Foundation
VMware vRealize Automation (vRA)
VMware Identity Manager (vIDM)
And VMware Workspace ONE Access (Access)
The patch the company released to address the issue is VMSA-2021-0011.

The company made a point to stress that different organizations will have varying risk tolerances, security controls, and defenses in place to manage risk. So customers using VMWare equipment should certainly feel free to make their own decisions regarding what priority to place on installing the patch for this issue. They strongly recommended that all their customers take immediate action given the severity of the security vulnerability.

VMware stressed that so far, they have found no evidence of any of these vulnerabilities being exploited in the wild. Of course, it’s just a matter of time until that happens and the company recommends applying the patch as soon as possible if you use any of the products mentioned above.

If you are unable to apply the patch immediately, also be aware that the company has a workaround detailed on their website that could be used as a stopgap measure in the short run. It doesn’t remove the risk and it may introduce some added wrinkles and complexities but it’s better than doing nothing until the patch can be applied.

Kudos to VMware for their fast action in addressing these issues and in providing a workaround for those who cannot patch immediately.

Do you use the popular smartphone app “Cash App?” If so, you’re certainly not alone. It is wildly popular and used by millions of people around the world.

As one of the most wildly popular things on the web, that has made it a target. Cash App was formerly known as Square. Recently, they submitted a filing to the SEC (Securities and Exchange Commission) acknowledging that they had been breached.

This was not a conventional hacking attack however. In this instance it was a matter of a former employee accessing sensitive customer information before leaving the firm. Based on the filing, the incident occurred on December 10th, 2021.

Apparently the employee in question had regular access to reports containing customer information as part of their job duties. Upon leaving the firm, the employee somehow re-gained access to that information.

The information taken from Cash App includes:

The full names of customers
Brokerage account numbers (US customers only)
Brokerage portfolio value
Brokerage portfolio holdings
Stock trading activity
Cash App has launched a formal investigation into the matter and retained the services of a third-party forensics firm.

Beyond that, details about the incident are somewhat sparse. About all we know beyond what we mentioned above is that the former employee accessed the records of more than eight million Cash App current and former customers. In addition, the firm is currently in the process of reaching out to all impacted users to inform them.

As is generally the case in the aftermath of an incident like this, Cash App stressed that they take customer security very seriously and will be conducting a complete review of their processes to minimize the chances of a repeat occurrence in the future. Cash App also stressed that the future costs associated with the incident based on its preliminary assessment are virtually impossible to predict.

In any case, if you are a current or former Cash App customer be on the lookout for a communication from the company if you’re one of the people potentially impacted by the breach.

There’s a new malware threat to keep an eye out for according to researchers from Zscaler. Dubbed FFDroider, this one is known for hijacking a variety of social media accounts and stealing credentials and cookies stores in web browsers.

Given the dominance of social media properties on the web, that makes FFDroider a serious threat.

If there’s a silver lining to be found, it lies in the fact that for now, FFDroider seems to be spread primarily from websites offering cracked software. Steer clear of downloading cracked software. Until the hackers behind the malicious code change their approach, you can minimize your risk of infection.

If you do happen to fall victim to the malware, know that it does take steps to obscure its presence on an infected system. This happens most commonly by appearing as a Telegram desktop application. Once installed on a system, it creates a new Windows registry key called “FFDoider,” which served as the basis for naming the strain.

The strain scans the infected system for a pre-defined list of web browsers and essentially goes shopping. It goes rifling through the browser file harvesting cookies and saved password information, then exfiltrates the stolen contents to a command-and-control server managed by the hackers.

Currently, FFDroider can scan the contents of Chrome and any Chromium-based browser, Mozilla’s Firefox, Internet Explorer, and Microsoft Edge.

FFDroider will also make attempts to authenticate stolen login information. As an example, if it finds Facebook login information and can use it to successfully log in, it will gather information on the victim’s friends and the groups that person belongs to. If the user runs advertising on Facebook, FFDroider will also grab that information along with any account, billing, and payment details the victim has entered.

It’s fairly easy to avoid this one for now but if you do run afoul of it, it can cause serious headaches. So make sure everyone you know is aware.

Over the past few weeks, there’s been a bit of an uproar on various social media channels. Many AMD users are reporting inexplicable changes to their BIOS settings which users were never asked to approve.

AMD began investigating the issue and isolated it to AMD Ryzen chips and it appears the company’s user base was correct.

There’s an issue with some AMD systems built around combined AMD CPUs and GUPs. These were apparently introduced with the release of the AMD Adrenalin graphics card software version 22.3.1 which was released on March 17, 2022.

The Radeon Adrenalin driver introduced the auto-overclock feature back in September 2021 in a bid to offer users an easy way to increase system performance with a single click. Unfortunately, the software mentioned above automatically changes the setting whether it’s needed or not.

The good news is that you get faster speed and better performance. The bad news is that doing so generates more heat because the chips must draw more electricity. Overclocking can also increase stress on the hardware and reduce longevity. So in the longer term there is a real cost associated with it which is why so many users were in an uproar over the unasked changes.

If you’re using an AMD system and the Adrenalin driver, you should update to the latest version as soon as possible. Your system may be overclocking without you even realizing it (and it probably is). That is almost certain to shorten its useful life.

Kudos to the sharp-eyed user community for catching the issue so quickly and to AMD for being equally quick to respond. This is one of those cases where the company was acting in good faith and in a bid to increase convenience for its user base, they ran afoul of an unintended consequence. Easily remedied, but something to be aware of.

If you’re an Apple user and you have an iPhone, a Mac, or both, you’ll want to grab the company’s most recent security update.

The latest release pushes out fixes for a pair of zero-day vulnerabilities that researchers have seen actively exploited in the wild.

The flaws in question are being tracked as CVE-2022-22674 and CVE-2022-22675 respectively. The former is an out-of-bounds write issue in an Intel Graphics driver and the latter is an out-of-bounds-read issue in the AppleAVD media decoder that would allow an attacker to execute arbitrary code with kernel privileges.

Impacted devices include the iPhone 6S and newer, the iPad Pro (all models), the iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and the iPod Touch (7th generation). Also note that users with Macs running macOS Monterey are at risk.

To make sure you’re protected download and install the iOS 15.4.1, the iPadOS 15.4.1, or the macOS Montery 12.3.1 update as appropriate for your device.

It’s still early in 2022 and so far, Apple has pushed out three zero-day patches this year resolving a total of five different zero-day issues.

In January 2022, the company’s first zero-day patch was pushed out resolving CVE-2022-22587 and CVE-2022-22594. Those allowed attackers to execute arbitrary code with kernel privileges and track web browsing activity in real time.

Then in February, Apple released another patch to address a new zero-day exploit that allowed attackers to hack iPhones, iPads, and Macs, leading to OS crashes and arbitrary code execution.

It appears 2022 is shaping up a lot like 2021. Last year, Apple faced a seemingly endless stream of zero-day exploits and spent much of the year busily pushing fixes out the door. Here’s hoping this year will be at least somewhat calmer on that front!

Do you have an iPhone? If so, are you running IOS 15.4? If you are, you may have noticed an unusual power drain on your battery that’s dramatically shortening the life per charge. That’s the kiss of death for any handheld device and if you’re experiencing the issue, you’re not alone.

The good news is that Apple just issued a fix in the form of IOS 15.41. Don’t let the relatively small size of the update fool you.

Though it weighs in at just over 313 MB, this is an update you won’t want to miss. Not only does it fix the unexpected battery drain issue, but it’s packed with other cool fixes. They include a fix for braille devices that become unresponsive while navigating text or displaying certain alerts. The latest update also fixes a problem with “Made for iPhones” hearing devices that would sometimes lose connection with third-party apps.

Granted, the other bug fixes are only applicable and important to a relatively small slice of the mammoth iPhone market but for those users who were impacted the effect was enormous. So this is a welcome patch indeed.

It’s also worth mentioning that not everyone who updated to 15.4 experienced the mysterious battery drain issue, so you may not have noted any real difference. If you did however and it has been a source of frustration for you the fix is here and ready to be downloaded at your earliest convenience.

Kudos to Apple for moving quickly on all three issues. There’s a reason that Apple’s customers tend to behave more like fans and the company’s prompt attention to issues like this is a big part of why. No matter what business you’re in take a lesson from the folks at Apple. They’re obviously not perfect but they get a lot right and they get it right consistently. Bravo!

Do you have an HP LaserJet Pro, a Pagewide Pro, an OfficeJet, Enterprise, Large Format, or DeskJet printer at your home or in your office?

If so, then be aware that your machine is likely vulnerable to at least one of four security vulnerabilities rated as critical.

The first of these is a buffer overflow flaw that could lead to remote code execution. Tracked as CVE-2022-3942, this issue was originally reported by Trend Micro’s Zero Day Initiative team.

The other vulnerabilities to be aware of are tracked as follows:

CVE-2022-24291
CVE-2022-24292
And CVE-2022-24293
All also reported by Trend Micro’s Zero Day Initiative Team.

Although the team that discovered the flaws haven’t provided many details about them, the good news is that HP has already released a security patch for the firmware of all the impacted printers. Just head to HP’s driver download portal, select the make and model of your printer, and grab the appropriate firmware update for your machine and you’ll be all set.

All the issues mentioned here are as serious as they get. All will allow an attacker to gain a foothold inside your home or office network and execute code at will. If they do that, you can bet that it won’t be to your benefit so it pays to update your firmware as quickly as possible to mitigate your risk.

Kudos to the researchers at Trend for spotting these vulnerabilities, and to HP for moving quickly and decisively to protect their vulnerable customers. This could have played out very differently given how many makes and models of HP printers were impacted by this quartet of security flaws.

Thanks to the company’s quick action though it seems that much of the potential impact has been blunted at least for those who move quickly to update their firmware. That’s how it’s done.

A nasty new malware strain has recently been spotted in the wilds by researchers at zScaler.

Dubbed “BlackGuard” the malicious code has been found on a variety of Russian underground Blackhat forums. It is offered as a service and anyone criminally minded can access the code for the bargain price of just $200 a month.

Because the malware is quite new the yet unknown authors are also selling lifetime subscriptions for just $700 in a bid to rapidly grow the code’s user base and get their name circulating in the global hacking community.

BlackGuard isn’t an inherently destructive form of malware. It is classified as an Infostealer and its main purpose is to harvest as much valuable information as possible when it lands on a target system.

Most Infostealers tend to be somewhat generalized while siphoning up data ranging from OS details, network traffic statistics, users’ contact lists and of course, harvesting various login credentials (with a preference for account details users use to log into various financial institutions). BlackGuard’s focus is a bit different.

zScaler reports that this code steals any login credentials stored in whatever web browser the user has along with that user’s browsing history, email client data, any autofill content, and all conversations in messenger software.

In addition to that, it also targets login credentials and other account information for popular Messengers including Tox, Element, Discord, Signal, and Telegram. If that wasn’t bad enough, BlackGuard is also designed to pilfer cryptocurrency wallet information including wallet browser extensions for both Microsoft Edge and Google Chrome.

The zScaler team remarked that although BlackGuard’s capabilities are not yet as broad based as many Infostealers, the malicious code is extremely well-designed. It’s clear that the developers know what they’re doing, and they seem to have a well-crafted plan to grow the popularity of their new creation.

Keep an eye on this one. We’re almost certain to hear more about it in the months ahead.

Do you have an Android device? Even if you don’t, you know someone who does.

Google is incredibly good at spotting poisoned copies of apps on its Play Store and getting rid of them before they can spread to the devices of users who rely on the safety and security offered by the Play Store.

As good as they are, they’re not perfect and sometimes malicious code masquerading as a legitimate app can slip through the company’s impressive filtering system.

Recently, the company discovered that an Android app that has more than 100k installs contains a trojan called “FaceStealer” which displays a Facebook login screen that requires users to log in before they can make use of the app.

Although the Facebook login prompt looks official, it is not and all a user accomplishes by entering their login credentials is to give those credentials to the hackers that control the code. Given that millions of people around the world use their Facebook login details to connect to a host of other websites, this essentially gives the hackers the keys to your digital kingdom. From that point there’s really no end to the amount of damage they can do.

In addition to making the discovery itself, the researchers who originally brought the poisoned app to Google’s attention did a deep dive into the malicious code and discovered that the author has apparently automated the repackaging process. This means that it’s a trivial matter to turn almost any legitimate app into a carrier of this trojan.

Given that fact, it’s worth asking the question, “How many other poisoned apps might there be on the Play Store right now?”

It’s a fair question with no easy answer. Your best bet is to practice extreme caution when downloading any app, only get them from the Google Play store and do as much due diligence as possible before committing to an installation.