{"id":20345,"date":"2022-02-21T09:20:00","date_gmt":"2022-02-21T13:20:00","guid":{"rendered":"https:\/\/www.itworldcanada.com?p=473901"},"modified":"2022-03-14T13:01:43","modified_gmt":"2022-03-14T17:01:43","slug":"cyber-security-today-feb-21-2022-data-on-internet-society-members-exposed-an-alert-to-linux-administrators-microsoft-teams-users-get-tricked-and-more","status":"publish","type":"post","link":"https:\/\/technewsday.com\/staging\/cyber-security-today-feb-21-2022-data-on-internet-society-members-exposed-an-alert-to-linux-administrators-microsoft-teams-users-get-tricked-and-more\/","title":{"rendered":"Cyber Security Today, Feb. 21, 2022 \u2013 Data on Internet Society members exposed, an alert to Linux administrators, Microsoft Teams users get tricked and more"},"content":{"rendered":"<p>Data on Internet Society members exposed, an alert to Linux administrators, Microsoft Teams users get tricked and more.<\/p>\n<p>Welcome to Cyber Security Today. It\u2019s Monday February 21st. I\u2019m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.<br \/>\n<iframe loading=\"lazy\" style=\"border: none;\" title=\"Libsyn Player\" src=\"https:\/\/html5-player.libsyn.com\/embed\/episode\/id\/22193882\/height\/90\/theme\/custom\/thumbnail\/yes\/direction\/forward\/render-playlist\/no\/custom-color\/000000\/\" width=\"100%\" height=\"90\" scrolling=\"no\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<table style=\"width: 100%;\">\n<tbody>\n<tr>\n<td><a href=\"https:\/\/www.amazon.com\/ITWC-Cyber-Security-Today\/dp\/B07BRNG89P\/ref=sr_1_1?s=digital-skills&amp;ie=UTF8&amp;qid=1522688435\"  rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-396718 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-alexa-200.png\" alt=\"Cyb er Security Today on Amazon Alexa\" width=\"200\" height=\"74\" border=\"none\" \/><\/a><\/td>\n<td><a href=\"https:\/\/www.google.com\/podcasts?feed=aHR0cDovL2N5YmVyc2VjdXJpdHl0b2RheS5saWJzeW4uY29tL3Jzcw%3D%3D\"  rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" loading=\"lazy\" class=\"thumbnail aligncenter wp-image-408712 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2018\/09\/sub-gp-200.png\" alt=\"Cyber Security Today on Google Podcasts\" width=\"200\" height=\"74\" \/><\/a><\/td>\n<td><a href=\"https:\/\/itunes.apple.com\/ca\/podcast\/cyber-security-today\/id1363182054\"  rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-396720 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-itunes-200.png\" alt=\"Subscribe to Cyber Security Today on Apple Podcasts\" width=\"200\" height=\"74\" border=\"none\" \/><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>People are still being clumsy<\/strong> with the way data is stored on the internet. The latest example: Files with names, email addresses and login details of thousands of members of the Internet Society were recently found in an unsecured Microsoft Azure blob. The Internet Society is an international non-profit that lobbies for a resilient internet. What happened? According to security researchers who found the flaw, the Internet Society blames the association management software it uses. That software, which allows membership information to be stored in the cloud, was configured incorrectly. As a result, if someone knew where to look the information was open to be copied. It isn\u2019t known if anyone other than the researchers found those open files. Misconfigurations are a prime cause of data exposures. Credit for the discovery goes to <a href=\"https:\/\/clario.co\/blog\/internet-society-member-data-breach\/\"  rel=\"noopener\">researchers at Clario<\/a> and independent researcher Bob Diachenko.<\/p>\n<p><strong>Last week I reported<\/strong> on a vulnerability in Adobe Commerce and Magento e-commerce platforms. However, the patch Adobe issued to fix this flaw wasn\u2019t enough.<a href=\"https:\/\/www.zdnet.com\/article\/adobe-updates-critical-magento-commerce-vulnerability-advisory-with-new-threat\/\"  rel=\"noopener\"> A new security update has been released for some versions of Commerce and Magento<\/a>. Check with the Adobe website to see if your implementation needs this patch.<\/p>\n<p><strong>Attention Linux administrators:<\/strong> \u00a0<a href=\"https:\/\/blog.qualys.com\/vulnerabilities-threat-research\/2022\/02\/17\/oh-snap-more-lemmings-local-privilege-escalation-vulnerability-discovered-in-snap-confine-cve-2021-44731\"  rel=\"noopener\">Security researchers at Qualys have discovered<\/a> multiple vulnerabilities in the snap-confine function on Linux operating systems. One of them can be exploited to escalate privileges to gain root privileges. And once an attacker has root privileges they can do pretty much anything. Snap\u00a0is a software packaging and deployment system allowing software developers to distribute their applications directly to Linux systems. Administrators are urged to apply security patches from their Linux distributions as soon as possible to plug this hole.<\/p>\n<p><strong>Researchers at Avanan<\/strong> <a href=\"https:\/\/www.avanan.com\/blog\/hackers-attach-malicious-.exe-files-to-teams-conversations\"  rel=\"noopener\">have detailed a scam<\/a> for tricking people using the Microsoft Teams collaboration service into downloading malware. It works like this: A hacker gets into a Teams discussion by one of several ways. If it involves people in two companies, one of the firms might have been hacked. Or the hacker has compromised a person\u2019s email address or Microsoft password to access Teams. Then in the middle of a conversation they attach a compromised file to one or all of the participants. This is a trick that can work with any collaboration or chat application. But hackers often chose Microsoft Teams because Microsoft products are widely used by organizations. To defend against this IT administrators need to add anti-malware protection that sandboxes and scans attachments in collaboration software.<\/p>\n<p><strong>Canadians are getting recorded phone calls<\/strong> from someone claiming to be from the \u201cthe department of Service Canada.\u201d This is a fraud. The goal is to get your government of Canada or bank passwords and then your personal information. Just hang up.<\/p>\n<p><strong>Attention WordPress administrators:<\/strong> If you use the free or paid UpdraftPlus backup and recovery plugin, <a href=\"https:\/\/updraftplus.com\/updraftplus-security-release-1-22-3-2-22-3\/\"  rel=\"noopener\">install the latest security patch fast.<\/a> It fixes a serious vulnerability that allows anyone \u2013 not just an administrator &#8212; who logs into a WordPress console to compromise a backup. The developer says it would take a very skilled hacker to do that, but assume a few of them are around. Administrators using UpdraftPlus Premium\u2019s feature for encrypting a database backup are protected against data theft.<\/p>\n<p><strong>Finally,<\/strong> The U.S. Cybersecurity and Infrastructure Security Agency is making it easier for IT and business leaders to access its free cybersecurity resources. The agency has created a new online portal. It has resources under titles like \u201cFix the known security flaws in software,\u201d and \u201cHalt bad practices.\u201d If you type \u2018CISA free\u2019 you\u2019ll find the link. <a href=\"https:\/\/www.cisa.gov\/free-cybersecurity-services-and-tools\"  rel=\"noopener\">It\u2019s also included here<\/a>. The government of Canada\u2019s free online advisory resources are at <a href=\"https:\/\/www.cyber.gc.ca\/en\/\"  rel=\"noopener\">the Canadian Centre for Cyber Security.<\/a> The U.K. resources are at the <a href=\"https:\/\/www.ncsc.gov.uk\/\"  rel=\"noopener\">National Cyber Security Centre<\/a>. All three are great places to start looking for advice on everything from stopping ransomware to setting up a cybersecurity program.<\/p>\n<p>Remember links to details about podcast stories are in the text version at ITWorldCanada.com. That\u2019s where you\u2019ll also find other stories of mine.<\/p>\n<p>You can follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.<\/p>\n<p>The post <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-feb-21-2022-data-on-internet-society-members-exposed-an-alert-to-linux-administrators-microsoft-teams-users-get-tricked-and-more\/473901\">Cyber Security Today, Feb. 21, 2022 \u2013 Data on Internet Society members exposed, an alert to Linux administrators, Microsoft Teams users get tricked and more<\/a> first appeared on <a href=\"https:\/\/www.itworldcanada.com\/\">IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This episode reports on a misconfiguration that exposed member info of the Internet Society, a serious Linux bug that has to be patched and more<\/p>\n<p>The post <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-feb-21-2022-data-on-internet-society-members-exposed-an-alert-to-linux-administrators-microsoft-teams-users-get-tricked-and-more\/473901\">Cyber Security Today, Feb. 21, 2022 \u2013 Data on Internet Society members exposed, an alert to Linux administrators, Microsoft Teams users get tricked and more<\/a> first appeared on <a href=\"https:\/\/www.itworldcanada.com\/\">IT World Canada<\/a>.<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[360,16],"tags":[389,388],"class_list":["post-20345","post","type-post","status-publish","format-standard","hentry","category-podcasts","category-security","tag-cyber-security-today","tag-privacy-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/20345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=20345"}],"version-history":[{"count":1,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/20345\/revisions"}],"predecessor-version":[{"id":20346,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/20345\/revisions\/20346"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=20345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=20345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=20345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}