October 21, SecurityWeek – (International) Weebly breach affects over 43 million users. Weebly, a San Francisco-based Web hosting service, confirmed that hackers stole the account information of over 43 million users, including usernames, Internet Protocol (IP) addresses, and password hashes after breaching the company’s systems in February 2016. The company advised its user to reset their passwords and the cause of the breach remains under investigation. Source
October 20, Softpedia – (International) Linux kernel zero-day CVE-2016-5195 patched after being deployed in live attacks. The Linux kernel team patched a zero-day security flaw named Dirty COW, as it is caused by a race condition in the way Linux kernel’s memory handles copy-on-write (COW) breakage of read-only memory mappings, which could allow an attacker to escalate their privileges, potentially to root level, on a targeted system. A security researcher notified Red Hat of attackers deploying an exploit that leverages this vulnerability in the wild. Source
October 20, Help Net Security – (International) Cisco plugs critical bug in ASA security devices. Cisco patched a critical vulnerability affecting the Identity Firewall feature of its Cisco Adaptive Security Appliance (ASA) Software, which could allow a remote attacker to take control of the system, cause a reload, and execute arbitrary code by sending a specially crafted NetBIOS packet in response to a NetBIOS probe sent by the software. Cisco reported the vulnerability is caused by a buffer overflow in the affected area code. Source
Above Reprinted from the USDHS Daily Open Source Infrastructure Report
October 21, Dark Reading - DDoS Attack On DNS Provider Disrupts Okta, Twitter, Pinterest, Reddit, CNN, Others. Brief but widespread attack illuminated vulnerability of the Internet's Domain Name System (DNS) infrastructure. A major distributed denial-of-service (DDoS) attack on Internet domain service provider Dyn in the early morning hours on the East Coast today disrupted major websites - including Okta, CNN, Pinterest, Reddit, and Twitter - and provided a grim reminder of the vulnerability of a key element of the Internet's infrastructure. Source
October 21, - Dark Reading -Indian Banks Hit By Debit Card Security Breach. Around 3.25 million debit cards affected by breach of 90 ATMs, prompting card replacement and PIN change. A cybersecurity issue has hit the debit card network in India with a possible compromise of the backend system of ATM operations, thus forcing several banks to replace cards or ask for changes in security codes, reports Reuters. Authorities say 3.25 million debit cards involving around 90 ATMs may have been impacted by the breach. Source