{"id":29900,"date":"2022-10-17T08:54:03","date_gmt":"2022-10-17T12:54:03","guid":{"rendered":"https:\/\/www.itworldcanada.com?p=508298"},"modified":"2022-10-18T09:53:37","modified_gmt":"2022-10-18T13:53:37","slug":"cyber-security-today-oct-17-2022-warnings-to-vmware-and-office-365-administrators","status":"publish","type":"post","link":"https:\/\/technewsday.com\/staging\/cyber-security-today-oct-17-2022-warnings-to-vmware-and-office-365-administrators\/","title":{"rendered":"Cyber Security Today, Oct. 17, 2022 \u2013 Warnings to VMware and Office 365 administrators"},"content":{"rendered":"<p data-ar-index=\"0\">Warnings to VMware hypervisor and Office 365 administrators.<\/p>\n<p data-ar-index=\"1\">Welcome to Cyber Security Today. It\u2019s Monday, October 17th, 2022. I\u2019m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.<\/p>\n<p data-ar-index=\"2\"><iframe style=\"border: none;\" title=\"Libsyn Player\" src=\"https:\/\/html5-player.libsyn.com\/embed\/episode\/id\/24701907\/height\/90\/theme\/custom\/thumbnail\/yes\/direction\/forward\/render-playlist\/no\/custom-color\/000000\/\" width=\"100%\" height=\"90\" scrolling=\"no\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<table style=\"width: 100%;\">\n<tbody>\n<tr>\n<td><a href=\"https:\/\/www.amazon.com\/ITWC-Cyber-Security-Today\/dp\/B07BRNG89P\/ref=sr_1_1?s=digital-skills&amp;ie=UTF8&amp;qid=1522688435\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"aligncenter wp-image-396718 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-alexa-200.png\" alt=\"Cyb er Security Today on Amazon Alexa\" width=\"200\" height=\"74\" border=\"none\" \/><\/a><\/td>\n<td><a href=\"https:\/\/www.google.com\/podcasts?feed=aHR0cDovL2N5YmVyc2VjdXJpdHl0b2RheS5saWJzeW4uY29tL3Jzcw%3D%3D\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"thumbnail aligncenter wp-image-408712 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2018\/09\/sub-gp-200.png\" alt=\"Cyber Security Today on Google Podcasts\" width=\"200\" height=\"74\" \/><\/a><\/td>\n<td><a href=\"https:\/\/itunes.apple.com\/ca\/podcast\/cyber-security-today\/id1363182054\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"aligncenter wp-image-396720 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-itunes-200.png\" alt=\"Subscribe to Cyber Security Today on Apple Podcasts\" width=\"200\" height=\"74\" border=\"none\" \/><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p data-ar-index=\"3\">\n<p data-ar-index=\"4\"><strong>A major event<\/strong> happened over the weekend: VMware ended general support for versions 6.5 and 6.7 of its ESXi hypervisor. There will be no more security patches or bug fixes for these versions. There are two more years of technical guidance available, where VMware will give support for low-severity issues. But, I repeat, no more security patches for versions 6.5 and 6.7. How many IT departments are running these two versions? <a href=\"https:\/\/www.lansweeper.com\/eol\/vmware-esxi-end-of-life\/\" rel=\"noopener\">A company called Lansweeper,<\/a> which sells asset management software, said 6,000 of its customers run about 79,000 instances of ESXi. Of them, at the end of September tens of thousands of organizations were running versions about to go end of life. By the way, quite a few were still running versions older than 6.5. The current version of ESXi is 7.0. Remember old versions of applications are at the greatest risk of being hacked.<\/p>\n<p data-ar-index=\"5\"><strong>Attention Microsoft Office 365 administrators:<\/strong> If you use the suite\u2019s Message Encryption tool it might be exposing the organization to risk. That\u2019s according to researchers at a company in Helsinki <a href=\"https:\/\/labs.withsecure.com\/advisories\/microsoft-office-365-message-encryption-insecure-mode-of-operation\" rel=\"noopener\">called WithSecure<\/a>. Office Message Encryption, or OME, uses an insecure technology called Electronic Codebook for encryption. In fact, the researchers point out, NIST said so as far back as 2020. Briefly, if enough encrypted messages are captured a hacker might be able to infer parts of the clear text of scrambled messages. Microsoft isn\u2019t planning to change OME. So the researchers recommend administrators change to a more secure method of email encryption.<\/p>\n<p data-ar-index=\"6\"><strong>Most malware<\/strong> doesn\u2019t work alone. Threat actors need a communications server or servers to communicate back and forth with the malware initially implanted on a victim\u2019s computer and servers. That\u2019s how they upload tools like backdoors and ransomware, and download stolen data.\u00a0 Researchers at Cisco Systems have discovered a new attack framework run by an unnamed gang. They call this framework Alchimist. Along with it they discovered a new piece of malware they call Insekt, which when installed on a victim\u2019s computer signals back to the Alchimist command and control server. An instructor at the SANS Institute notes there are currently 110 command and control frameworks being used by threat actors around the world. For security professionals looking for indicators of compromise <a href=\"https:\/\/blog.talosintelligence.com\/2022\/10\/alchimist-offensive-framework.html\" rel=\"noopener\">there\u2019s a link to the Cisco report here.<\/a><\/p>\n<p data-ar-index=\"7\"><strong>Threat actors try<\/strong> to infect applications made by one company as a way to get into the IT systems of that firm\u2019s customers. The SolarWinds Orion hack is an example. Putting corrupt copies of packages in open-source libraries is another.<a href=\"https:\/\/blog.aquasec.com\/private-packages-disclosed-via-timing-attack-on-npm\" rel=\"noopener\"> Researchers at Aqua Security say<\/a> the latest attack on packages in the NPM library goes after private packages that are supposed to be visible only to a limited number of developers. The tactic being used is called a timing attack: The hacker sends a request to get a package they think exists on the NPM site. Unapproved or unauthenticated users get an error message that says \u201c404 not found.\u201d But if the attacker sends five consecutive requests the speed of the error response will signal if there really is a private package with that name. Then the attacker can find a way to add a re-named but infected version of that package to the developer\u2019s NPM page, hoping a victim will download that version. GitHub says it can\u2019t fix this problem. So the researchers advise developers with private packages on NPM to regularly search for and delete packages with lookalike names.<\/p>\n<p data-ar-index=\"8\"><strong>I regularly warn<\/strong> listeners to stay away from emailed or text offers of free or cracked versions of commercial software and games. Invariably they deliver malware to your computer. One of the latest campaigns is <a href=\"https:\/\/www.zscaler.com\/blogs\/security-research\/new-php-variant-ducktail-infostealer-targeting-facebook-business-accounts\" rel=\"noopener\">reported by researchers at Zscaler.<\/a> A gang known for trying to get usernames and passwords of employees\u2019 Facebook Business accounts is expanding its targets. Now it\u2019s using these offers of hacked software to steal the credentials of anyone with a Facebook account. And it also scoops up as much personal data as it can that\u2019s stored in Chrome browsers. Again, messages you get by email, text, LinkedIn or any social media account from someone you don\u2019t know offering a deal on commercial software is likely poison.<\/p>\n<p data-ar-index=\"9\"><strong>Finally,<\/strong> don\u2019t forget IT World Canada\u2019s free MapleSec cybersecurity summit will be held this week. Wednesday\u2019s sessions are in-person in mid-town Toronto at the Aga Khan Museum. Among the sessions will be a panel discussion on ransomware. Another features a panel of CISOs. Thursday\u2019s sessions will be online and include a session on cybersecurity essentials for SMBs. <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-oct-12-2022-toyota-blames-contractor-for-five-year-data-leak-code-from-intel-is-leaked-and-more\/www.itworldcanada.com\/maplesec\" rel=\"noopener\">Click here to see the full agenda and register.<\/a><\/p>\n<p data-ar-index=\"10\">The post <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-oct-17-2022-warnings-to-vmware-and-office-365-administrators\/508298\">Cyber Security Today, Oct. 17, 2022 \u2013 Warnings to VMware and Office 365 administrators<\/a> first appeared on <a href=\"https:\/\/www.itworldcanada.com\/\">IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This episode reports on versions of WMware hypervisor going end of support, a caution on the encryption in Office 365<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[360,16],"tags":[389,456],"class_list":["post-29900","post","type-post","status-publish","format-standard","hentry","category-podcasts","category-security","tag-cyber-security-today","tag-vmware"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/29900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=29900"}],"version-history":[{"count":3,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/29900\/revisions"}],"predecessor-version":[{"id":29950,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/29900\/revisions\/29950"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=29900"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=29900"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=29900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}