CyberSec Roundup
A synopsis of the Latest Cybersecurity News
FBI LEEP Hacked
The FBI’s Law Enforcement Enterprise Portal was hacked last week, which resulted in false FBI warnings being sent to over 100,000 mailboxes. The spam email claimed that the recipients’ networks were compromised and data was stolen as part of a sophisticated chain attack done by threat actor Vinny Troia. It appears this was some type of prank since Vinny Troia is not a threat actor, but the founder of dark web intelligence company Shadowbyte. However, this attack had the potential to be much worse, since it came from the FBI’s legitimate address.
HP Aruba Breached
HP Enterprises revealed that data repositories for their Aruba Central network monitoring platform were compromised when a threat actor obtained an access key. The hacker had access for 18 days in October and was able to view customer data stored in the Aruba Central environment, but no internal company systems were breached. When the breach was discovered, the key was revoked and Aruba took actions to ensure the breach wouldn’t reoccur, however they didn’t disclose how the access key was obtained by the threat actor.
CISA Equipment Warning
CISA released an advisory about IT equipment from various vendors that have serious vulnerabilities which need to be addressed immediately. If these vulnerabilities are exploited, they could cause denial-of-service attacks or remote code execution, which could lead to information exposure. Administrators with the following devices in their networks need to apply the latest updates urgently:
Eclipse CycloneDDS | eProsima Fast DDS |
GurumNetworks GurumDDS |Object Computing, Inc. (OCI) OpenDDS |
Real-Time Innovations (RTI) Connext DDS Professional and Connext DDS Secure |
RTI Connext DDS Micro | TwinOaks Computing CoreDX DDS
By: David Pinder
IT & Security Consultant
Certified Ethical Hacker (Master)
