January 16, SecurityWeek – (International) Flaws found in Carlo Gavazzi energy monitoring products. Carlo Gavazzi released firmware updates after a security researcher found that the company’s VMU-C product was plagued with a flaw that grants a malicious actor access to most of the application’s functions without authentication, as well as a cross-site request forgery (CSRF) issue that can be exploited to change configuration parameters. The researcher also found the product stores some sensitive information in clear text, and warned that the flaws can be remotely exploited if the device’s administrator interface is accessible from the Internet or local network. Source
January 15, SecurityWeek – (International) New RIG campaign distributes Cerber ransomware. Researchers from Heimdal Security found that a recently spotted campaign is leveraging the Empire Pack version of the RIG exploit kit (EK) to exploit one of eight vulnerabilities plaguing outdated versions of Adobe Flash Player, Microsoft Internet Explorer, Microsoft Edge, and Microsoft Silverlight in order to compromise a victim’s device and download and install the Cerber ransomware. The researchers reported that users must keep their software updated at all times to ensure protection against such attacks. Source
January 13, Washington Post – (International) Virginia college student pleads guilty to federal computer malware charges. A student at James Madison University in Virginia pleaded guilty January 13 to Federal charges after he developed malicious keylogger software and sold the malware to more than 3,000 users, who subsequently used the software to infect more than 16,000 computers. Source
January 13, SecurityWeek – (International) Advantech WebAccess flaws allow access to sensitive data. Advantech released patches addressing several serious vulnerabilities in version 8.1 of its WebAccess software package after researchers from Tenable Network Security discovered that the product was impacted by a critical Structured Query Language (SQL) injection flaw and a critical authentication bypass issue, which could enable a remote attacker to access potentially sensitive information. Source
Above Reprinted from the USDHS Daily Open Source Infrastructure Report