Who Is the Network Access Broker ‘Babam’?
Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in stealing remote access credentials -- such as usernames and passwords needed to remotely connect to the target's network. In this post we'll look at the clues left behind by "Babam," the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years.

Read more »

Ubiquiti Developer Charged With Extortion, Causing 2020 “Breach”
In January 2021, technology vendor Ubiquiti Inc. [NYSE:UI] disclosed that a breach at a third party cloud provider had exposed customer account credentials. In March, a Ubiquiti employee warned that the company had drastically understated the scope of the incident, and that the third-party cloud provider claim was a fabrication. On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower.

Read more »

The Problem with Default Passwords – Intego Mac Podcast Episode 216
The UK is mulling a bill to prohibit default passwords; the admin/admin that is often set by default on internet-connected devices. This would be a good thing, but there are drawbacks. We also discuss how Apple takes the lead in smartphone sales in China, and an upgrade program for Mac laptops. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of November 22, 2021
Original release date: November 29, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 4mosan -- gcb_doctor 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files. 2021-11-19 10 CVE-2021-42338 CONFIRM adobe -- creative_cloud_desktop_application Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability. 2021-11-23 9.3 CVE-2021-43019 MISC MISC adobe -- incopy Adobe InCopy version 16.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability. 2021-11-22 9.3 CVE-2021-43015 MISC adobe -- prelude Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability. 2021-11-22 9.3 CVE-2021-42738 MISC asus -- gt-ax11000_firmware An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet. 2021-11-19 7.8 CVE-2021-41436 MISC MISC MISC MISC MISC MISC MISC MISC asus -- gt-ax11000_firmware A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request. 2021-11-19 10 CVE-2021-41435 MISC MISC MISC MISC MISC MISC MISC MISC beyondtrust -- privilege_management_for_windows BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions. 2021-11-19 7.2 CVE-2021-42254 MISC MISC c-ares_project -- c-ares A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability. 2021-11-23 7.5 CVE-2021-3672 MISC MISC dell -- cloudlink Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-coded credentials, may potentially exploit this vulnerability to gain unauthorized access to the system. 2021-11-23 8.5 CVE-2021-36312 CONFIRM dell -- cloudlink Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it may be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity. 2021-11-23 9 CVE-2021-36313 CONFIRM dell -- emc_cloud_link Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. A remote unauthenticated attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary files on the end user system. 2021-11-23 7.5 CVE-2021-36314 CONFIRM dell -- networking_os10 Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system. 2021-11-20 8.5 CVE-2021-36307 MISC dell -- networking_os10 Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to gain access and perform actions on the affected system. 2021-11-20 9.3 CVE-2021-36308 MISC dell -- networking_os10 Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to gain access and perform actions on the affected system. 2021-11-20 9.3 CVE-2021-36306 MISC dell -- x1008p_firmware Dell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially hijack a session and access the webserver by forging the session ID. 2021-11-20 7.5 CVE-2021-36320 MISC duplicate_post_project -- duplicate_post The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In many cases it also possible to exploit features of SQL server to execute system commands and/or access the local file system. This particular vulnerability can be exploited by any authenticated user who has been granted access to use the Duplicate Post plugin. By default, this is limited to Administrators, however the plugin presents the option to permit access to the Editor, Author, Contributor and Subscriber roles. 2021-11-19 9 CVE-2021-43408 MISC MISC gerbv_project -- gerbv An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. 2021-11-19 7.5 CVE-2021-40391 MISC huawei -- cloudengine_5800_firmware There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. Due to lack of privilege restrictions, an authenticated local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege. 2021-11-23 7.2 CVE-2021-39976 MISC huawei -- fusioncompute There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system. Affected product versions include: FusionCompute 6.0.0, 6.3.0, 6.3.1, 6.5.0, 6.5.1, 8.0.0. 2021-11-23 9 CVE-2021-37102 MISC ibm -- planning_analytics IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 208396. 2021-11-24 9.3 CVE-2021-38873 CONFIRM XF iptime -- c200_firmware ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command. 2021-11-22 10 CVE-2021-26614 MISC isync_project -- isync A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution. 2021-11-22 7.5 CVE-2021-44143 MISC MISC MISC moodle -- moodle A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified. 2021-11-22 7.5 CVE-2021-3943 MISC MISC nvidia -- geforce_gt_605 NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to instantiate a specifically timed DMA write to corrupt code execution, which may impact confidentiality, integrity, or availability. 2021-11-20 7.2 CVE-2021-23217 CONFIRM nvidia -- geforce_gtx_950 NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller which may allow a user with elevated privileges to generate valid microcode. This could lead to information disclosure, data corruption, or denial of service of the device. 2021-11-20 7.2 CVE-2021-23201 CONFIRM oisf -- suricata Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments. 2021-11-19 7.5 CVE-2021-37592 MISC CONFIRM CONFIRM pulsesecure -- pulse_connect_secure A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device. 2021-11-19 7.8 CVE-2021-22965 MISC quagga -- quagga An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update. 2021-11-19 7.2 CVE-2021-44038 MISC MISC roundcube -- webmail Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. 2021-11-19 7.5 CVE-2021-44026 MISC MISC MISC FEDORA FEDORA DEBIAN sharetribe -- sharetribe Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value. 2021-11-19 7.5 CVE-2021-41280 CONFIRM MISC MISC vim -- vim vim is vulnerable to Heap-based Buffer Overflow 2021-11-19 8.5 CVE-2021-3968 CONFIRM MISC FEDORA vim -- vim vim is vulnerable to Heap-based Buffer Overflow 2021-11-19 9.3 CVE-2021-3973 MISC CONFIRM FEDORA wazuh -- wazuh In the wazuh-slack active response script in Wazuh before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution. 2021-11-22 7.5 CVE-2021-44079 MISC MISC wpwave -- hide_my_wp The SQL injection vulnerability in the Hide My WP WordPress plugin (versions

Read more »

The Internet is Held Together With Spit & Baling Wire
Imagine being able to disconnect or redirect Internet traffic destined for some of the world's largest companies -- just by spoofing an email. This is the nature of a threat vector recently removed by a Fortune 500 firm that operates one of the world's largest Internet backbones.

Read more »

Apple Sues NSO Group for Pegasus Spyware – Intego Mac Podcast Episode 215
Apple has filed a lawsuit against NSO Group, the creator of Pegasus spyware, that has targeted politicians, journalists, and activists. We discuss this surprising lawsuit and what it means for Apple users and security. The post appeared first on The Mac Security Blog.

Read more »

Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain Works
The macOS and iOS keychain allows you to store passwords securely, and access them on all your Apple devices. The post appeared first on The Mac Security Blog.

Read more »

Arrest in ‘Ransom Your Employer’ Email Scheme
In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employer's network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the scheme -- a young man who said he was trying to save up money to help fund a new social network.

Read more »

The ‘Zelle Fraud’ Scam: How it Works, How to Fight Back
One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim's funds via Zelle, a "peer-to-peer" (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that precede these bank account takeovers begin with a spoofed text message from the target's bank warning about a suspicious Zelle transfer. What follows is a deep dive into how this increasingly clever Zelle fraud scam typically works, and what victims can do about it.

Read more »

Shop Safely on Black Friday and Cyber Monday – Intego Mac Podcast Episode 214
We had to check our calendars when Apple announced a new self-service repair program for iPhones. We look at some new Mac malware, and we discuss how to shop safely and securely online this Black Friday and Cyber Monday. The post appeared first on The Mac Security Blog.

Read more »

Apple now offering free overnight delivery on all Macs, iPads, iPhones, TVs, and Watches through December 22, 2021
Apple is now offering free overnight delivery on all in-stock Macs, iPads, iPhones, TVs, and Watches, including certified refurbished products, purchased on their online store though 3:00pm local time on December 22, 2021. Free overnight delivery is the default shipping method on these products, and you can optionally choose free pickup at a local Apple Store and free two-hour courier delivery in select metros. Apple’s […] The post first appeared on MacPrices.net.

Read more »

These are Apple’s Christmas 2021 shipping cut off dates
Apple has announced shipping cutoff dates to receive various products in time for Christmas 2021. The following dates apply for Apple’s free shipping. Note the stock can vary, especially given recent supply constraints due to COVID-19. Faster options, such as overnight delivery, Apple Pickup, and 2-hour courier delivery may also be available. Click a header to visit Apple’s site: iPhone iPhone 13, 12, or SE: […] The post first appeared on MacPrices.net.

Read more »

New Sale! 13″ M1 MacBook Pro with 512GB SSD for $1249, $250 off Apple’s MSRP
Amazon has 13″ M1 MacBook Pros with a 512GB SSDs on Holiday 2021 sale for $250 off Apple’s MSRP shipped: – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1249.99 $250 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1249.99 $250 off MSRP Their $1249 price is the lowest available for any 13″ M1 MacBook Pro with 512GB of storage this […] The post first appeared on MacPrices.net.

Read more »

Use your Education discount this Holiday shopping season 2021 to get an M1-powered iPad Pro for $100 off MSRP
iPad sales are rare and hard to come by this 2021 holiday shopping season, largely due to global supply constraints and limited inventory (see our iPad price trackers). However, Apple will take $100 off 12″ M1 iPad Pros and $50-$100 off 11″ M1 iPad Pros for all teachers, students, and staff of any educational institution with a .edu email address as part of their Apple […] The post first appeared on MacPrices.net.

Read more »

Holiday Sale: How to get the 512GB M1 Mac mini for only $749, save $150
Amazon has the Apple M1 Mac mini with a 512GB SS on Holiday sale for $150 off Apple’s MSRP, only $749 shipped: – Mac mini M1 CPU/512GB SSD: $749.99 $150 off MSRP Stock was very limited at the time of this post. Their price is the lowest we’ve seen for this model anywhere this holiday shopping season. Be sure to purchase from Amazon rather than […] The post first appeared on MacPrices.net.

Read more »

Holiday Sale! Apple AirPods for only $79, $50 off MSRP
AT&T has base-model Apple AirPods with Charging Case, 2nd generation, on Holiday sale for only $79 while supplies last. Their price is $50 off Apple’s MSRP, and it’s the lowest price we’ve ever seen for a new pair of AirPods. Shipping is free, and AT&T is estimating delivery between December 8th and 10th if you order today. AT&T service is not required. Act now if […] The post first appeared on MacPrices.net.

Read more »

New Holiday sale at AT&T: $200 off any Apple Watch when you buy 2 and add a line of service
AT&T is offering Apple Watch models for $200 off MSRP when you purchase two Watches with AT&T service and add at least one new line. The fine print: “Enjoy $200 off Apple Watch when you buy Two. Limited Time Offer. You’ll need to: – Purchase two new Apple Watches (Series 3 up to $289.99, Series 4 up to $699.99, Series 5 up to $749.99, Series […] The post New Holiday sale at AT&T: $200 off any Apple Watch when you buy 2 and add a line of service first appeared on MacPrices.net.

Read more »

Save $260 on 13″ M1 16GB RAM/512GB SSD MacBook Pros with these Certified Refurbished models at Apple
Apple has 13″ M1 MacBook Pros with 8GB of RAM and 256GB or 512GB SSDs for $200-$230 off MSRP, Certified Refurbished. If 8GB of RAM is not enough for you, Apple has restocked custom-configurations with 16GB of RAM and 512GB of SSD storage for $260 off the cost of new models. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new […] The post first appeared on MacPrices.net.

Read more »

AirPods Max headphones back on Holiday sale for $120 off Apple’s MSRP
Amazon has Blue and Space Gray AirPods Max headphones on sale again for $120 off Apple’s MSRP, down to $429. Shipping is free. Their price is the lowest we’ve ever seen for AirPods Max headphones from any Apple reseller and equals their Black Friday/Cyber Monday discounts: – AirPods Max headphones (Blue, Space Gray): $429 $120 off MSRP See our AirPods Price Tracker for the latest […] The post first appeared on MacPrices.net.

Read more »