Weekly News Digest #9

New Chrome 0-day Under Active Attacks – Update Your Browser Now

The new Chrome Zero-day vulnerability is actively exploited by the intruders. So Google is urgently notifying all users to update their browsers. Tracked as CVE-2020-15999, the actively exploited vulnerability is a type of memory-corruption flaw called heap buffer overflow in Freetype, a popular open-source software development library for rendering fonts that comes packaged with Chrome.

Link here

U.S. Charges 6 Russian Intelligence Officers Over Destructive Cyberattacks

On Monday, the US government published a list of Russian government hackers. They are people who work for Unit 74455 of the Russian Main Intelligence Directorate (GRU). They have been accused of perpetrating the “most disruptive and destructive series of computer attacks ever attributed to a single group.” Five years ago, Russian hackers belonged to Sandworm (aka APT28, Telebots, Voodoo Bear, or Iron Viking) group. This group attacked Ukraine’s power grid, Ministry of Finance, and State Treasury Service using malware such as BlackEnergy, Industroyer, and KillDisk. Before embarking on a spree of destructive cyberattacks — including unleashing NotPetya in 2017.

Link here

New Framework Released to Protect Machine Learning Systems From Adversarial Attacks

A group of companies (Microsoft, MITRE, IBM, NVIDIA, and Bosch) has released a new open framework for cybersecurity called the Adversarial ML Threat Matrix. That aims to help security analysts detect, respond to, and remediate adversarial attacks against machine learning (ML) systems.

Companies hope to address threats against the weaponization of data with a curated set of vulnerabilities and adversary behaviors that Microsoft and MITRE vetted to be effective against ML systems. 

Link here

Researcher: I Hacked Trump’s Twitter by Guessing Password

An ethical hacker Victor Gevers claims it only took five attempts to suggest the password to President Donald Trump’s Twitter account — “maga2020!”. Donald Trump’s weak Twitter password and lack of basic two-factor authentication protections made it shockingly simple to hack his account, says the researcher. 

Link here

Oracle Kills 402 Bugs in Massive October Patch Update

Oracle attracts customers to update their systems in the October release of its quarterly Critical Patch Update, which fixes 402 vulnerabilities across various product families. The bulk of the vulnerabilities are in Oracle Financial Services Applications, Oracle MySQL, Oracle Communications, Oracle Fusion Middleware, Oracle Retail Applications, and Oracle E-Business Suite. More than 20 Oracle product families are affected by the flaws. Users can find a patch availability document for each product on the official website.

Link here