21 Jan 2022
Week in review
Greetings,
Last week’s undersea volcanic eruption near Tonga has impacted the island nation in several ways, including upon the submarine cables on which Tonga relied to connect to the world which is expected to take at least four weeks to repair.
The eruption ruptured the single fibre cable, one of 280 across the globe, responsible for more than 95% of global data transfer.
The Conversation highlights the vulnerable state of the network and, suggests how to potentially mitigate risk moving forward, in order to protect the 1.3 million kilometres (approx.) of cables.
Time is running out to get your submission in for the AUSCERT2022 conference. The call for presentations and tutorials closes on January 30 and we’re on the lookout for unique topics, extraordinary projects or perhaps a clever way of optimising processes.
So if you, or someone you know, has something to say and would like to share it, complete your submission online. AUSCERT is also able to assist in covering the travel and accommodation costs for one speaker per successful submission (conditions apply).
Red Cross begs hackers not to leak data of “highly vulnerable people”
Date: 2022-01-19
Author: The Record
The Red Cross has disclosed that it was the victim of a cyber attack and has asked the hackers who broke into the IT network of one of its contractors not to leak the personal information of more than 515,000 of “highly vulnerable people.”
The data was stolen from a Red Cross program called Restoring Family Links, which aims to reunite family members separated by conflict, disaster, or migration.
“While we don’t know who is responsible for this attack, or why they carried it out, we do have this appeal to make to them,” said Robert Mardini, director-general for the International Committee of the Red Cross.
Singapore monetary authority threatens action on bank over widespread phishing scam
Date: 2022-01-18
Author: The Register
The Monetary Authority of Singapore says it is considering supervisory action against Southeast Asia's second largest bank, Oversea-Chinese Banking Corporation, which was criticised for its incident response to a widespread phishing scheme across the island nation.
"Monetary Authority Singapore takes a serious view of the recent phishing scams involving OCBC Bank. They have significantly impacted several customers. OCBC has acknowledged that its incident response and customer service should have been better. MAS has been following up with the bank on these and broader issues relating to the incident," said MAS deputy managing director Ms Ho Hern Shin in a statement to The Register.
Bunnings customers’ personal data compromised following cyber attack
Date: 2022-01-17
Author: Cyber Security Connect
Bunnings Warehouse customers who shopped using the contactless pick-up service may have had some of their personal information stolen.
The company has emailed customers to say they have recently been made aware of a data security breach experienced by its third-party booking provider FlexBooker.
In December of 2021, the third-party software firm suffered a cyber security breach that led to the information of 3.7 million customers being exposed, and last week Bunnings was forced to warn its customers of the incident.
The compromised information may have included customers' names and email addresses, which were provided when they selected a timeslot for a drive and collect order.
ASB-2022.0046 – Oracle Java SE: Multiple vulnerabilities
Oracle released their 3-monthly critical patches this week. Many products were patched. These Java fixes are likely to flow on to many other products over the next few weeks.
ESB-2022.0223 – telnet: Execute arbitrary code/commands – Remote/unauthenticated
Hopefully not too many people are still using telnet, but if so, consider patching.
ESB-2022.0256 – AIDE: Multiple vulnerabilities
A possible root compromise in this useful security tool.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
