This week’s Knowledge Update talks about the Imgur data breach that exposed 1.7 million users, the Scarab ransomware that uses Necurs bots to spread to millions of inboxes and Apple rush to fix a major password bug.
Imgur Breach exposes 1.7 million users
Imgur’s, COO, Roy Sehal has recently confirmed that the popular image sharing site suffered a data breach of 1.7million user accounts in 2014. The information compromised included email accounts and passwords.
Imgur are still investigating how account information was compromised as passwords had been encrypted on their database. However, they believe that the account information was compromised due to an older hashing algorithm (SHA-256) that was being used at the time. Imgur has now updated their algorithm to the new bcrypt algorithm.
Large data breaches reinforce the need to have strong and separate passwords for each account. Using separate passwords limits your exposure to third-party data breaches. Where possible companies and individuals should deploy technical controls to support authentication, such as Two Factor Authentication (2FA).
For more information contact [email protected] or visit www.londondsc.co.uk.
Scarab Ransomware uses Necurs bots to spread to millions of inboxes
Security researchers have been warned of a new major ransomware campaign that uses the infamous Necurs botnet to spread millions of spam emails.
According to Forcepoint, It was first spotted on 23 November. The Scarab ransomware is being primarily sent to .com and .co.uk inboxes, With 12.5million email addresses affected in the first four hours. The emails that have been sent have a subject line called “Scanned from (Printer company name)” and contain a 7zip attachment with a VBScript downloader.
As strains of Ransomware develop and evolve it is increasingly important for businesses to regularly and securely back up their critical data. Businesses cannot rely on anti-virus alone to protect themselves from Ransomware, a guide to Ransomware can be found here.
For more information contact [email protected] or visit www.londondsc.co.uk.
Apple rush to fix major password bug
Apple have said that it is working to fix a serious password bug within its operating system. The flaw makes it possible for anyone to gain access to a device without a password. Granting the attacker powerful administrator rights. In a statement, Apple have said that “We are working on a software update to address this issue.
The issue was found by a Turkish developer, Lemi Ergin. He would be granted unrestricted access to the machine if he entered the username “root”, leaving the password field empty and hitting “Enter” numerous times.
Although Apple’s latest update will be applied automatically, users should ensure that their operating systems and devices are updated regularly, if not automatically. This will protect your organisation from the latest known flaws and vulnerabilities. It is also recommended that all default passwords should be changed. Information on what makes a strong password can be found here.
For more information contact [email protected] or visit www.londondsc.co.uk.
