Vulnerabilities in Microsoft Apps for macOS; 400 CVE Numbering Authorities; More National Public Data Breach Information

The issue here is that once an application has the entitlements like camera access, these entitlements extend to the entire application, including libraries loaded at run time or extensions and plugins. It is up to the application at this point to protect itself. The issue Cisco points out is that the applications do not enforce security features available to protect the application. However, all of these applications have some form of scripting interface. This would allow an attacker to abuse these applications even if dynamically loaded libraries are validated.

As always, this is a good writeup from the Talos group around a portion of the enterprise ecosystem that seldom gets talked about. There is a lot of effort to subvert Windows, but how many MacOS devices are in the corporate ecosystem? Specifically in the executive suites at a minimum.

macOS has a layered security model, including TCC and entitlements which are aimed at protecting user privacy and system security. They are not foolproof. These apps include the entitlement to disable library validation, which only allows them to access libraries signed by their developer, which was removed with updates to Teams and OneNote. Excel, Outlook, PowerPoint and Word remain this capability to support plug-ins. Other than pushing updated applications, reviewing their access (user granted, e.g. Camera/Microphone access) is a good idea.

I appreciate Mitre making it easier to assign CVEs. The solution to the current "flood" of vulnerability is not to ignore them. NIST has laid out a plan to catch up with its NVD database, and even if the data enrichment is incomplete, it is better to have a CVE than not to have a CVE.

While I applaud multiple organizations stepping up here, most are scoped to support their products only, this does give them more skin in the game which is needed. Even so, the bigger need is to support CVE analysis to clear both the current and seven-month backlog. As of June 3, there were 13,358 CVEs waiting to be analyzed, as of August 13th the number was 17,372 and is projected to hit nearly 28,400 by the end of 2024. Fingers crossed the contractor is able to scale up to process 200-300 CVEs/day to overcome the backlog.

National Public Data is downplaying the breach. The data posted by USDoD for sale was analyzed by Troy Hunt (maintainer of HaveIBeenPwned) found the data contains 134 million unique email addresses, as well as criminal record data for 70 million of those addresses. Access Data Privacy analyzed the data and found as many of 272 million unique SSNs, many of which are no longer living. While there is precedent for changing the amount of data exfiltrated as the investigation proceeds, it's important to get this straight rapidly, particularly when others are analyzing the data and find a discrepancy with your reporting. While this gets sorted, double down on ID protection/restoration services and don't forget to freeze your credit.

The current read on this is that the company is “unsure” of how many records have been stolen. They claim that only 1.3 million (instead of 2.9 billion) records were taken. According to reports from Troy Hunt, 134 million email addresses are in the dump. This doesn’t mean that all the data is from the same place, so there is still speculation about this entire breach. One to watch. Is this the fourth or fifth time our social security number data has been breached? I lose count.

Well that was a bit of a rounding error by National Public Data. Still, its 1.34M people affected that had little say in how their information was collected and used. Perhaps it’s time to regulate data brokers and ‘for Pete’s sake,’ let’s pass a national data protection law.

This is data from the July 18th ransomware attack by the Rysida gang which claims to have stolen 6.5 terabytes of data. The data appears to have been released on the dark web, and while the average citizen doesn't have access to it, criminals likely do which is why the city attorney is letting city residents, customers and employees know they are ready to support them with needed protection or other civil orders relating to this data being released. Offering to support your customer in a breach, beyond just ID/Credit monitoring/restoration is a classy move to consider for your playbook.

Good on Columbus for not paying the ransom. Bad on Columbus for not exhibiting a standard of reasonableness in protecting its citizens information. While much of the information is likely public, the city still has a responsibility to protect it as some of it may be sensitive. Take a look at the ‘Blueprint for Ransomware Defense,’ an actionable framework for ransomware mitigation, response, and recovery.

The third-party payment site was decommissioned in late June, and a new secure site provisioned. Nevertheless, payment information, including names, card numbers, CVV and expiration dates were exfiltrated for six months. The zoo is notifying affected parties and offering them a year of credit monitoring.

While not as serious as new account application fraud, card transaction fraud remains a nuisance and a cost in the system. This is in part because online merchants continue to accept, not to say rely on, them rather than use payment proxies like PayPal, Amazon, Google Pay, and Apple Pay. While use of the proxies does have a cost, it is more than offset by the reduction in fraud loss.

Microsoft provides multiple MFA options for Entra including FIDO2 security keys, certificate-based authentication (CAC, PIV, X509), passkeys and the Microsoft authenticator using biometrics, push notifications or OTP. Don't enable SMS/phone-call based MFA; it's too easily compromised. alk to your Azure/Entra ID administrators about their plans for MFA, not only about which technical options they will support but also their communication and user-support activities.

The trend continues making MFA mandatory for users. Microsoft signaled its intent late last year and this is its follow-through. We can add Microsoft to the ‘mandatory use’ club and MFA as the de facto standard for identity management.

There is nothing quite like the letter from a provider letting you know your data has been breached. Take note of the guidance on their incident web site; it provides in-depth options and contacts for organizations which can aid users both secure their credit as well as help monitor for activity related to the use of their data.

I’m sorry but nine months is about seven months too long to begin notifying individuals that their information has been taken. I get that there needs to be a balance between investigation and victim notification. Just remember for every day the investigation continues it’s a day the evil doer can use it, unbeknownst to the victim.

Yet another vulnerability [er, software defect] in a WordPress plug in. The open-source plugin has had several critical vulnerabilities over the last 18 months, this continues that trend. Sometimes the open-source model comes at a cost to the end-user.

CVE-2024, InPost for WooCommerce and InPost PL plugin vulnerabilities, CVSS score of 10, needs to be addressed post-haste. Check for both plugins. InPost-for-woocommerce should already be auto-updated to 1.4.5 or higher. If you're still running woo-InPost, you need to replace it, including uninstalling the old one.