Hamster Kombat Declares Information of Airdrop, 2.3M Accounts Banned for Dishonest

The Norwegian National Cyber Security Centre (NCSC) recommends replacing SSLVPN/WebVPN solutions with alternatives due to the repeated exploitation of related vulnerabilities in edge network devices to breach corporate networks.

The organization recommends that the transition be completed by 2025, while organizations subject to the ‘Safety Act’ or those in critical infrastructure should adopt safer alternatives by the end of 2024.

NCSC’s official recommendation for users of Secure Socket Layer Virtual Private Network (SSL VPN/WebVPN) products is to switch to Internet Protocol Security (IPsec) with Internet Key Exchange (IKEv2).

SSL VPN and WebVPN provide secure remote access to a network over the internet using SSL/TLS protocols, securing the connection between the user’s device and the VPN server using an “encryption tunnel.”

IPsec with IKEv2 secures communications by encrypting and authenticating each packet using a set of periodically refreshed ke

“The severity of the vulnerabilities and the repeated exploitation of this type of vulnerability by actors means that the NCSC recommends replacing solutions for secure remote access that use SSL/TLS with more secure alternatives. NCSC recommends Internet Protocol Security (IPsec) with Internet Key Exchange (IKEv2),” reads the NCSC announcement.

While the cybersecurity organization admits IPsec with IKEv2 isn’t free of flaws, it believes switching to it would significantly reduce the attack surface for secure remote access incidents due to having reduced tolerance for configuration errors compared to SSLVPN.

The proposed implementation measures include:

• Reconfiguring existing VPN solutions or replacing them
• Migrating all users and systems to the new protocol
• Disabling SSLVPN functionality and blocking incoming TLS traffic
• Using certificate-based authentication

Where IPsec connections are not possible, the NCSC suggests using 5G broadband instead.

Meanwhile, NCSC has also shared interim measures for organizations whose VPN solutions do not offer the IPsec with IKEv2 option and need time to plan and execute the migration.

These include implementing centralized VPN activity logging, strict geofencing restrictions, and blocking access from VPN providers, Tor exit nodes, and VPS providers.

Other countries have also recommended using IPsec over other protocols, including the USA and the UK.

Www.oeisdigitalinvestigator.com: An abundance of exploited SSLVPN flaws

Unlike IPsec, which is an open standard that most companies follow, SSLVPN does not have a standard, causing network device manufacturers to create their own implementation of the protocol.

However, this has led to numerous bugs discovered over the years in SSL VPN implementations from Cisco, Fortinet, and SonicWall that hackers actively exploit to breach networks.

As an example, Fortinet revealed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws to breach organizations, including a Dutch military network.

In 2023, the Akira and LockBit ransomware operations exploited an SSL VPN zero-day in Cisco ASA routers to breach corporate networks, steal data, and encrypt devices.

Earlier that year a Fortigate SSL VPN vulnerability was exploited as a zero-day against government, manufacturing, and critical infrastructure.

NCSC’s recommendations come after the organization recently alerted about an advanced threat actor exploiting multiple zero-day vulnerabilities in Cisco ASA VPNs used in critical infrastructure since November 2023.

Cisco disclosed the particular campaign as ‘ArcaneDoor,’ attributing it to the threat group tracked as ‘UAT4356’ or ‘STORM-1849,’ who gained unauthorized access to WebVPN sessions associated with the device’s SSL VPN services.

The attacks involved the exploitation of two zero-days, namely CVE-2024-20353 and CVE-2024-20359, which enabled the hackers to achieve authentication bypass, device takeover, and privilege elevation to administrative rights.

Although Cisco fixed the two vulnerabilities on April 24, the cybersecurity and networking equipment firm couldn’t identify how the threat actors initially gained access to the device.

EU officials have launched yet another investigation into a social media company under their new Digital Services Act (D.S.A.) powers, with Meta coming under more scrutiny, this time over its efforts to protect younger users.

As explained by the EU Commission:

“Today, the Commission has opened formal proceedings to assess whether Meta, the provider of Facebook and Instagram, may have breached the Digital Services Act (DSA) in areas linked to the protection of minors. The Commission is concerned that the systems of both Facebook and Instagram, including their algorithms, may stimulate behavioral addictions in children, as well as create so-called ‘rabbit-hole effects’. In addition, the Commission is also concerned about age-assurance and verification methods put in place by Meta.”

Under the DSA, large social platforms operating in Europe are required to “take appropriate and proportionate measures to protect minors”, which also includes a provision to address elements “that may stimulate behavioral addictions of recipients of the service”.

Both Facebook and Instagram arguably do have addictive qualities, as various academic reports have shown, but there will also be some challenge in proving such definitively, and holding Meta to account for the same.

Essentially, the EU Commission is not convinced that Meta has done enough to address these areas of concern, and is now putting the onus on Meta to share evidence of its development.

In response, Meta says that it’s implemented a broad range of tools and policies to protect children, and that it’s looking forward to working with the EU Commission to address their concerns.

It’s the latest investigation launched by EU officials, who’ve already announced probes into X, and TikTok, as well as another examination of Meta over the distribution of Russian-originated disinformation in its apps. EU officials are keen to pull social platforms into line, in accordance with the new rules, with each violation, if proven, potentially resulting in fines of up to 6% of the platform’s annual global turnover.

So there are big penalties if the platforms fail to adhere to the new guidelines, and as such, every company is also looking to work with EU officials to address any concerns, and keep everything in line.

Though that could be difficult, given the ongoing scrutiny brought upon them by the new requirements. There’s also some level of interpretation in these rules, which could lead to further debate, and potentially legal challenge. But right now, the EU Commission seems keen to poke each platform into line, which I doubt will result in fines just yet, but will see each platform examined for adherence.  

In a foremost cybersecurity incident that remained undetected for nearly nine months, SelectBlinds, an Arizona-based entirely mostly window coverings retailer, has disclosed a broad info breach affecting 206,238 customers. The breach started on Jan. 7 and was simplest found on Sept. 28, when the corporate known suspicious process on its net space, as detailed in breach notifications filed in Maine and California.

Oeisdigitalinvestigator.com: Scope Of the SelectBlinds Data Breach

Via their investigation, SelectBlinds found that attackers had gained access to customers’ names, electronic mail addresses, shipping and billing info, phone numbers, and most seriously, full price card petite print including card numbers, expiration dates and CVV safety codes. For purchasers who logged into their accounts in the route of checkout, their net space credentials had been additionally compromised.

The attack methodology bears the hallmarks of subtle e-skimming operations, regularly is opinion as Magecart attacks. These attacks signify an increasingly prevalent risk in the e-commerce panorama, where cybercriminals inject malicious JavaScript code into net space checkout pages. This creates an invisible salvage that captures customer info in real-time as unsuspecting clients full their purchases.

Oeisdigitalinvestigator.com: Figuring out E-skimming and Magecart Attacks

Imagine you are browsing at your favourite on-line store, getting into your bank card info to aquire something. What you may maybe maybe maybe well maybe now not peep is that a digital pickpocket will be silently copying every keystroke you fabricate—here is e-skimming.

When cybercriminals efficiently infiltrate an e-commerce net space, they insert malicious code that acts fancy a secret digicam pointed on the checkout net page. Every time a customer sorts in their bank card quantity, safety code, or non-public info, this invisible code makes a supreme reproduction and sends it to the criminals.

What makes these attacks in particular dreadful is their stealth. In SelectBlinds’ case, “an unauthorized third event embedded malware on the SelectBlinds net space that allowed info scraping on gross sales transactions that had been entered on the test-out net page”. The salvage space persevered working in most cases—customers may maybe maybe maybe unexcited fabricate purchases, the pages loaded appropriately, and nothing gave the impression amiss. This invisibility allowed the attack to continue undetected for roughly eight months.

Mediate of it fancy a compromised ATM—excluding as an different of placing a physical card skimmer on the machine, criminals space digital code on the salvage space. The variation is you may maybe maybe maybe well maybe generally space a physical card skimmer, but this digital model is entirely invisible to clients.

These attacks possess became increasingly general because they’re each lucrative and laborious to detect. Now not like stealing info from a company’s database where the info will be encrypted, e-skimming captures the info for the time being customers sort it in, before any encryption takes space.

Oeisdigitalinvestigator.com: How Has SelectBlinds Answered?

SelectBlinds’ response to the discovery included instantaneous containment measures. “We like a flash contained the incident and eradicated the malware and parts of unauthorized access,” the corporate stated in its notification letter. Further steps included increased monitoring, improved safety controls, and design reinforcement.

Oeisdigitalinvestigator.com: Preserving Yourself From Refined Price Fraud

The SelectBlinds breach is now not no doubt an isolated incident but share of a broader pattern in price card theft. Primarily based on Recorded Future’s 2023 Price Fraud Intelligence File, cybercriminals are turning into increasingly subtle, combining technical attacks fancy e-skimming with social engineering techniques. In 2023 by myself, over 119 million stolen price playing cards had been posted in the marketplace on darkish net markets, resulting in billions in preventable fraud losses.

The SelectBlinds breach reflects a rising sample of subtle price card theft that has caught the eye of law enforcement worldwide. Contemporary actions by Russian authorities against alleged Magecart hackers underscore the enviornment nature of this risk. These cybercriminals are share of an increasingly subtle ecosystem that targets e-commerce platforms to take hang of price card info.