IRS warns of SMS phishing campaign / Fast Company confirms hack / Cyberowl raises $5.1M

Plus: Google releases Chrome 106 update

Inside.com Part of   Network September 28, 2022

Presented by

The IRS has warned U.S. citizens of an active SMS phishing campaign. The number of cases has recently increased exponentially. More: Hackers are sending SMS phishing cyberattacks with the purpose of stealing sensitive information such as home addresses, email addresses, bank account details, etc. The threat actors have built false landing pages that pretend to be official application forms or statements. In some instances, users are led to believe that their credit cards have been frozen and that they need to give their login credentials in order to restore them. The IRS stated that those who believe that they've been a victim of this hacking campaign should send an email to phishing@irs.gov and forward the scammer's details to phone providers and law authorities.

Fast Company has confirmed that its Apple News account has been hacked. The threat actors abused a CMS flaw. More: The unknown threat actor used a flaw in the company's CMS to send offensive messages on the company's Apple News channel. Apple confirmed that it shut down Fast Company's channel in order to avoid any more damage being caused. The business magazine got hit by a cyberattack only 48 hours later. The hackers publically criticized the company's security practices through a message board on the company's website. The threat actor claims that the company used weak password security practices, leading to 6,000 employee records being stolen. Fast Company shut down its websites as a way of cutting off the hackers and protecting user data. The company claims user data has not been affected after the breach.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work.  They are: Manual Inconsistent Take too long Don’t scale Don’t give developers what they need When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by design through automating threat modeling, generating application security requirements, and providing secure development and compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Download whitepaper bundle

Cyberowl, a maritime risk cybersecurity company, has raised a $5.1M growth round. The company is based in the U.K. More: The round was led by 24Haymarket and Techstars with participation from Brookstreet Equity Partners and Phaze Ventures. Cyberowl offers a proprietary software named Medulla. The company claims this software makes maritime companies more capable of defending their assets from threat actors. The company aims to use the funds for international expansion and for product development. The startup has worked with a wide range of clients, such as Eastern Pacific Shipping, Tufton Asset Management, Pacific International Lines, Pacific Carriers Limited, and Swire. Founded in 2019, Cyberowl is also active in Greece and Singapore.

Google has released Chrome 106, its newest wave of bug patches. The update has patched 20 bugs. More: The update has patched five bugs that had a high CVSS risk rating and eight other flaws that had a medium CVSS risk rating. Users will be able to update to the new version in the upcoming days and weeks as the company rolls out the changes to all Mac, Linux, and Windows users. Google listed the bugs it patched, including details such as those who tracked them and the amount given to them as compensation. The details regarding the high-risk flaws are as follows: [1358907] High CVE-2022-3304: [$9,000] [1343104] High CVE-2022-3201: [$3,000] [1319229] High CVE-2022-3305: [$TBD] [1320139] High CVE-2022-3306: [$TBD] [1323488] High CVE-2022-3307: [$TBD]

A message from QUANTUM Avoid Paying a Ransom - Get the Ultimate Backup Guide Before You Need It Paying a ransom may sound like the best case scenario: get your data back, make your customers feel worth it. But actually, it can affect your business in other ways and may, in some cases, be illegal. Make sure your systems are protected across the entire data lifecycle - and never pay a ransom again. You’re able to balance cost while maximizing efficiency. No one can stop ransomware or fully prevent it from taking place - but you can make sure you’re protecting your customers and your data by ensuring that there is a fully air-gapped solution. Request A Demo

Cisco has confirmed that a new breaching campaign affects several router models made by the company. The company has tracked four bugs. More: The four security flaws are tracked as: CVE-2021-27853, CVE-2021-27854, CVE-2021-27861 and, CVE-2021-27862. According to the statement, hackers are using DDoS attacks to override security protocols and gain unauthorized access. That access can be used to manipulate traffic to specific websites. Cisco claims that software releases 17.6.3 and 17.8.1 address patches for IOS XE models and that other bugs have either been already patched or do not pose a threat to its customers. Cisco has notified over 200 clients regarding this update.

Quick Hits: Own 100% of a single-family investment property entirely online with Doorvest.* Researchers have tracked a new hacking campaign named Quantum Builder. The campaign deploys a malware-as-a-service tool that can be purchased on the dark web for as little as $200. Multiple hacktivist groups are helping Iranian citizens through Signal and Telegram by enabling them to use the apps through proxies. Signal recently published a blog post instructing its users on how to use proxies for this specific purpose. A new report shows that the number of hacking campaigns that target Chrome and Microsoft bugs has increased in 2022 compared to last year. The U.K.’s data protection regulator, ICO, has reprimanded seven public and private sector organizations for failing to meet security protocols that are specified under the GDPR and U.K. Data Protection Act. Some of the reprimanded entities are The Ministry of Defense, The Home Office, local police authorities, etc. *This is sponsored content.

Upcoming events at Inside: September 28 - AMA with Leigh-Ann Buchanan (Founder of aīre ventures) (Register Here) October 04 - Webinar: Shrink the Attack Surface (Register Here) * October 05 - AMA with Ram Bartov (Chief Accounting Officer at TripActions)* (Register Here) October 11 - AMA with Mike Malone (Smallstep)* (Register Here) October 19 - AMA with Zecca Lehn (Responsibly VC) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here) November 02 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) December 07 - Live AMA with Deividi Silva ( Head of Developer Relations at Gun.io) (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

With Quantum, we shift the focus from accumulating data to making it work for you.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.