Atlassian Confluence Unauthorized Admin Account (CVE-2023-22515)

Read Time:33 Second

What is the Attack?

The vulnerability attack is targeting an authentication bypass flaw in Atlassian Confluence Server and Confluence Data Center. The vulnerability is due to insufficient validation of user-supplied inputs. A successful exploitation may create an administrator account on the vulnerable server.

What is the Vendor Solution?

Atlassian released firmware updates to the affected products. For more information, click here.

What FortiGuard Coverage is available?

FortiGuard Labs has an IPS signature “Atlassian.Confluence.Unauthorized.Admin.Account.Creation” to detect and block any attack targeting CVE-2023-22515.

FortiGuard Labs also advises to install the latest available patch for the affected products from the vendor as soon as possible.

Read More

Pickpocketing – Digital Style

Read Time:6 Minute, 30 Second

In today’s digital era, pickpocketing has taken a new form. Gone are the days when thieves would physically steal your wallet. Instead, they are using sophisticated techniques to steal your personal information and drain your bank accounts without you even realizing it. This article aims to shed light on digital pickpocketing, its impacts on your digital assets, and measures to prevent it.

What is Digital Pickpocketing?

Digital pickpocketing, also known as electronic pickpocketing or e-pickpocketing, refers to the use of digital tools and technologies to steal someone’s personal information without their knowledge or consent. The information stolen usually includes credit card numbers, passwords, and other sensitive details that can be used for fraudulent activities.

→Dig Deeper: Russian Hackers Steal 1.2 Billion Passwords

It’s important to note that digital pickpocketing doesn’t only happen on the internet. With the advancement of technology, pickpockets can now steal your credit card information just by standing close to you, thanks to a method called Radio Frequency Identification (RFID) skimming. This makes digital pickpocketing a pervasive threat that needs urgent attention.

The Modus Operandi

Before we delve into ways to prevent digital pickpocketing, it’s crucial to understand how it happens. There are numerous ways somebody can fall victim, and being informed about these methods is the first line of defense.

The most common form of digital pickpocketing is done via malicious software programs called malware. These programs find their way onto your computer or smartphone through email attachments, infected websites, or unsecured Wi-Fi networks. Once installed, they work quietly in the background, collecting your personal data and sending it off to the thief.

Another method is phishing, where fraudsters impersonate a trustworthy entity such as a bank or a website you frequent, tricking you into providing your personal information. The communication usually appears as an urgent call-to-action, prompting you to click on a link or download an attachment, which ultimately leads to your information being stolen.

RFID skimming, on the other hand, involves the use of a portable device that scans and records data from RFID-enabled cards when they come into its proximity. This method doesn’t require internet access or any form of physical contact, making it a more stealthy approach to digital pickpocketing.

The Impact of Digital Pickpocketing

The consequences of digital pickpocketing stretch far beyond financial loss. The theft of your personal information can lead to numerous problems, including identity theft, damaged credit score, and emotional distress.

Identity theft can be particularly damaging. Once a fraudster has enough of your personal information, they can potentially open new bank accounts, take out loans, or even commit crimes in your name. Not only could this lead to a huge financial mess, but it could also get you into legal trouble.

Furthermore, if credit card information is stolen and used fraudulently, it can significantly damage your credit score. A low credit score can make it more difficult to get loans, secure housing, or even find employment. The process of repairing your credit can be long and arduous, causing unnecessary stress and inconvenience.

Preventing Digital Pickpocketing

Preventing digital pickpocketing is possible with the right precautions. Protecting your personal information demands a proactive approach. Here are some tips and steps to help prevent digital pickpocketing:

RFID-blocking Wallets and Card Holders: Invest in RFID-blocking wallets or card holders to protect your contactless credit cards from unauthorized scanning.
Stay Informed about RFID Technology: Understand how Radio Frequency Identification (RFID) technology works and be aware of the potential risks associated with it.
Regularly Check Your Accounts: Routinely monitor your bank and credit card statements for any unauthorized or suspicious transactions. Report discrepancies promptly.
Use Strong Passwords: One of the most effective ways to prevent electronic pickpocketing is by using strong, unique passwords across all your accounts. Password managers can also help generate and store complex passwords, increasing your security. 
Enable Two-Factor Authentication (2FA): Enhance the security of your online accounts by enabling two-factor authentication wherever possible.
Use Secure Wi-Fi Networks: Avoid conducting sensitive transactions or accessing personal information on public Wi-Fi networks. Use secure, password-protected networks whenever possible.
Be Cautious in Crowded Spaces: Exercise caution in crowded areas where digital pickpocketing is more likely to occur. Be mindful of your surroundings and who is in close proximity.
Regularly Update Your Security Software: Keep your antivirus and security software current to protect against emerging threats and vulnerabilities.
Shred Sensitive Documents: Shred documents containing personal information before disposing of them to prevent identity theft.
Educate Yourself about Phishing: Be vigilant against phishing attempts. Avoid clicking on suspicious links or providing personal information in response to unsolicited messages.
Consider Credit Monitoring Services: Explore credit monitoring services, like those offered by McAfee, to receive timely alerts about any unusual activity on your credit accounts.
Secure Your Mobile Devices: Set up passcodes or biometric authentication on your mobile devices to prevent unauthorized access.

Digital pickpocketing poses a serious threat in this digital age. However, with the right information and measures, you can protect your personal information and avoid falling victim. Remember, prevention is always better than cure.

How to Respond to Digital Pickpocketing

If you’ve fallen victim to digital pickpocketing, swift action is key. The first step is to contact your bank or credit card company and inform them about the theft. Most companies have policies in place to protect their customers, and they can help prevent further damage by blocking your card or changing your account details.

Next, file a report with your local law enforcement, and consider contacting a credit reporting agency to place a fraud alert on your credit file. This can make it harder for a thief to open more accounts in your name. It’s also important to change your passwords and consider enrolling in an identity protection service, which can monitor your credit and personal information for any suspicious activity.

The Role of Technology

While technology has given rise to digital pickpocketing, it also offers solutions to combat it. Many apps and services now feature advanced security measures such as biometric authentication, encryption, and machine learning algorithms to detect and prevent fraudulent activities.

→ Dig Deeper: Banks are Using Biometric Measures to Protect Against Fraud

Financial institutions and tech companies are continually improving their security systems, implementing advanced firewalls, intrusion detection systems, and secure networks to protect customer data. While these technologies can’t guarantee absolute safety, they significantly reduce the risk of digital pickpocketing and help create a safer digital environment.

Legal and Regulatory Measures

From a legal perspective, governments and regulatory bodies worldwide are tightening regulations on data privacy and security. Laws like the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have strict guidelines and penalties for data breaches, encouraging businesses to prioritize data protection.

While these laws are a step in the right direction, it’s crucial for individuals to stay informed about their rights and the protective measures they can take. After all, the fight against digital pickpocketing is a collective effort that requires the participation of consumers, businesses, and regulators alike.

Final Thoughts

Ultimately, digital pickpocketing is a modern-day problem that requires a modern-day solution. By understanding the threats and implementing protective measures, we can protect ourselves from these digital thieves. It’s also reassuring to know that as technology advances, so do the methods to combat such digital crimes, and regulatory measures are continually being updated to provide better security in the digital era.

Remember, the key to combating digital pickpocketing lies in awareness, vigilance, and proactive protection. Stay informed and secure with McAfee, and let’s make the digital world a safer place for everyone.

The post Pickpocketing – Digital Style appeared first on McAfee Blog.

Read More

Scam Texts Are More Painful Than Getting a Root Canal

Read Time:7 Minute, 23 Second

Sick and tired of scam messages? So are the 54% of Americans who said they’d rather get a root canal than fall for one of those scams. 

That’s one of the striking findings we uncovered in our Global Scam Message Study. We surveyed more than 7,000 adults worldwide including more than 1,000 in the U.S. for their thoughts on scam messages and texts. And just how painful they are.  

If it seems like you’re getting more scam messages than before, you’re not alone. We found that Americans receive an average of 11.6 fake messages or scams each day. And it’s getting tougher to tell what’s real and what’s fake. More than 80% of Americans said that it’s harder than ever to spot if a text, email, or social media message is a scam. 

What’s driving this fresh flood of increasingly believable scam messages? AI – and if you’ve tuned into our blogs this past year, that likely comes as little surprise.  

As we’ve reported, the bad actors out there have supercharged their scams with AI tools. Effectively, AI makes it far easier to spin up their scams in two significant ways: 

AI does the writing for them. Instead of spending hours cooking up scam-worthy stories, AI does the work in seconds.

AI makes the messages look more legit. Before AI tools, you’d often find scam messages loaded with typos and grammatical errors. And sometimes they felt awkward. They didn’t make sense when you read them. Not so with AI. It can write far more smoothly than many bad actors can. 

With that comes the inevitable fallout. Two-thirds (65%) of Americans have clicked or fallen for a scam. Of them, 45% lost money as a result, and 15% of them lost more than $1,000. 

Engaging with scam messages can be costly and stressful.  

Now, about that root canal stat. People who fall victim to online messaging scams really do find it painful. Particularly as the time and money lost to those scams take their toll. Some people found them so painful, they said they’d rather deal with the following instead: 

Doing taxes every month – 57% 
Sleep in a haunted house for one night – 55% 
See the dentist for a one-time root canal – 54% 
Get hit with 24-hour food poisoning – 40% 

Ouch. You probably have your own answer to this “would you rather” question, but clearly people feel pretty fed up with this deluge of scam messaging. 

You can get a little more insight into those feelings by looking at all the time they waste. Our study found that the average American spends more than an hour-and-a-half each week reviewing, verifying, or deciding whether the messages they get are real or fake.  

Realistically, that’s the equivalent of watching a short feature film or streaming three shows or 94 minutes spent doing just about anything else. Add that up, and it amounts to more than two full work weeks each year spent on scam-spotting.  

Specifically, we found: 

Over email, 95% of Americans surveyed indicate that they receive fake messages or scams via email daily. 40% receive five or more fake email messages each day. 

Via text, 87% of U.S. survey respondents indicate that they receive fake messages or scams via text each day. 30% receive five or more fake text messages each day. 

Over social media, 75% of the people surveyed indicate that they receive fake messages or scams via social media every day. 30% receive five or more of these social media scams daily. 

Today’s scam messages cloak themselves in clever camouflage. 

With the increased volume and more advanced appearance of scam messages, only 35% of Americans have avoided clicking on or falling for fake messages in the last year.  

This sophisticated trickery takes five common forms. Below, you can see the types of messages people in the U.S. said they received in the past year: 

“You’ve won a prize!” – 62% 
Info about a purchase the recipient didn’t make – 57% 
Fake missed delivery or delivery problem notification – 56% 
Amazon security alert, or notification messages regarding account updates – 43% 
Netflix (or a similar streaming service) subscription updates – 42% 

In line with these findings, 65% of survey respondents have believed that one or more scam messages they got were real. The messages they believed the most were: 

“You’ve won a prize!” – 25% 
Info about a purchase the recipient didn’t make – 22% 
Fake missed delivery or delivery problem notification – 20% 
Sign in and location verification messages – 20% 

AI scams have lowered people’s trust. 

With scams evolving into increasingly clever forms, 40% of U.S. survey respondents said their trust in digital communications has decreased. Put another way, 55% of people believe they have a better shot at solving the Rubik’s Cube than identifying a scam message. We further found: 

37% of people said they don’t know if they are doing the right things to protect themselves.  

33% of people said they ignore a message when they think an email or text might be a scam. 

31% said they block the sender when they receive this type of message. 

26% said they reported suspected scam messages. 

In all, AI has made the murky world of online scams that much murkier. And sadly, that’s partly ruined people’s time online. They spend a part of each day trying to decide if what they’re reading is real or fake. However, you can take a few straightforward steps that can spare you the pain and without having a root canal instead. 

How to protect yourself from scam messages. 

Think before you click.  

Cybercriminals use phishing emails or fake sites to lure people into clicking links that might lead to malware. If you receive an email or text message asking you to click on a link, it’s best to avoid interacting with the message altogether. Particularly if it’s a great-sounding deal or promises useful info. Always go direct to the source and interact with reputable companies. 

Remember that if it seems too good to be true, it probably is.  

Many scams are effective because the scammer creates a false sense of urgency or preys on a heightened emotional state. Pause before you rush to interact with any message that is threatening or urgent, especially if it is from an unknown or unlikely sender. 

Go “unlisted.” 

Scammers have to get your contact info from somewhere. Often, they get it from online data brokers and other “people finder” sites. These sites collect and sell massive amounts of personal info to any buyer. You can remove that info from some of the riskiest data brokers with our Personal Data Cleanup service. It can help you remove that info, and with select products it can even manage the removal for you. Likewise, set your social media accounts to “friends and family” only so that your profile info doesn’t show up in search results. 

Use AI to beat AI.  

From blocking dangerous links that appear in text messages, social media, or web browsers, you have AI on your side. McAfee Scam Protection automatically identifies and alerts you if it detects a dangerous URL in your text. No more wondering if a delivery message or bank notification text is real or not. McAfee’s patented AI technology instantaneously detects malicious links to stop you before you click by sending an alert message. It’ll even block risky sites if you accidentally click on a scam link in a text, email, social media, and more. You’ll find it in our online protection plans like our award-winning McAfee+ subscriptions. 

You have what it takes to beat AI messaging scams. 

Root canals and Rubik’s Cubes aside, you can protect yourself against AI messaging scams. Even as these scams look more and more like the real thing, the same protections apply. In fact, you have new AI-driven tools that can keep you safer too. If there’s one thing we’ve talked about in our blogs plenty as of late, it’s how AI works both ways. While scammers have their AI tools for hoodwinking you, you have AI tools that can keep you safer too. 

It’s easy to feel a little helpless with all these AI scams floating about. Yet you really can take far more control than you might think. In fact, online protection software like ours is the most sophisticated it’s ever been. It’s truly an all-in-one fix for protecting your devices, privacy, and identity and for keeping scam messages at bay.

The post Scam Texts Are More Painful Than Getting a Root Canal appeared first on McAfee Blog.

Read More

The Benefits of Protection – Why Employees Place a High Value on Digital Wellness

Read Time:4 Minute, 50 Second

In workplaces around the world, employees agree they feel strongly about online protection. 

Our joint research with Statista puts a figure to that feeling. Worldwide, 80% or more of employees said that online protection was important or very important to them. Based on what we saw in our previous article in the series, that comes as little surprise. 

There, we covered how much time they spend online. Nearly seven hours a day on average. What’s more, they’re spending more time doing more important things. They’re managing their finances, doing their shopping, tracking their health, and even visiting their doctors online. And at historically high rates that only continue to climb. 

Yet with that increased activity has come increased risk. Our research found that 27% of employees worldwide said they were a victim of cybercrime. A mix of data theft, malware, phishing, and targeted spearphishing attacks led the way. Strikingly, more than half of employees in the U.S. reported the theft of sensitive info (54%). 

Of note for organizations, our research found that 1 in 2 employees use one or more personal devices for work as well. Most often that was an Android (60%) or Windows (55%) device. iOS devices featured prominently as well at 33%. 

This makes a strong case for offering comprehensive online protection as part of a digital wellness program. Employers gain the confidence that their employees are protected regardless of which device they use. Employees gain the protection they want, and need, to stay safe online in the workplace and across their daily lives. Both benefit. 

Everyone benefits from online protection. 

Just as organizations have protection measures in place to protect employees on business devices, comprehensive online protection does the same for their personal devices. In this way, organizations gain the assurance that their employees are protected across practically every device they use, wherever they use them.  

So, what does comprehensive protection look like? Comprehensive online protection like ours goes beyond antivirus. It protects the whole employee, by protecting their devices, their privacy, and their personal info. Within that, it covers the top online protection measures that employees want most. As found in our research with Statista, the top five measures they want include: 

Identity theft protection. 
Password protection. 
Device security. 
Protection from malicious sites. 
Online privacy protection. 

It further includes more features that they might not be aware of yet that can benefit them greatly. A few examples: 

Transaction Monitoring keeps tabs on transactions in connected bank, credit card, and 401(k) accounts. This helps employees quickly identify fraudulent transactions and protect their wealth and investments. 
McAfee Scam Protection uses artificial intelligence (AI) to combat phishing attacks. It automatically detects text scams and can block risky links in emails, social media, and more.  
Our industry-first McAfee Protection Score helps them improve their security overall. It checks the health of your employees’ online protection and provides simple steps to fix weak spots and raise their scores. 

Comprehensive online protection offers an added layer of protection for employees, whether they work remotely, in a hybrid role, or in the office. Employees see that as a big benefit. 

Employees see online protection as a big benefit. 

Employers know quite well that attractive benefits packages help attract and retain great employees. Likewise, employees said much the same in our research. Globally, 4 out of 5 employees said that benefits are key to joining and staying with an employer. 

Specific to online protection and digital wellness, 55% of employees cited online protection as an important benefit. That puts it in close association with other core benefits. In India, Brazil, and Australia, online protection is closely linked with healthcare and paid leave. In the U.S. and European countries, 2 in 5 employees consider online digital protection tied to core employee benefits such as paid leave and bonuses. 

Employees broadly acknowledged that this kind of protection benefits their employers as well. More than half said that they were interested in online protection because it can protect data and networks from unauthorized access (67%). More than half (52%) said that it could help them avoid unknowingly risky behaviors that might endanger their work. 

Employees help make the case for online protection as a benefit. 

Comprehensive online protection as part of a digital wellness program can benefit employees and employers alike. Employees see the value in it as they increasingly handle sensitive and personal matters online, ranging from their finances to their health and wellness.  

With that increased reliance on the internet comes increased risk of hacks, attacks, and scams. Online protection can reduce those risks significantly. It helps prevent cyberattacks that can rob employees of their time and money as they attempt to recover from an attack. And it provides a clear path forward with restorative measures in the event of a data breach or identity theft. 

Aside from offering a benefit that employees highly value, organizations can realize benefits of their own when they offer comprehensive online protection. They’ll have employees who’re unburdened and undistracted from disruptive attacks. Moreover, they’ll extend protections to personal devices that their employees use. Devices that half of them use for work and personal purposes. 

In our next article, we’ll help you make the business case for online protection and digital wellness programs from an organizational standpoint. Based on interviews with organizations of varying verticals and sizes, we’ll see what they had to say about the role that digital wellness plays in their workplace today. 

Editor’s note: Want to learn more? Visit us at https://www.mcafee.com/en-us/resources/digital-wellness.html or reach out to EmployeeBenefits@mcafee.com. 

The post The Benefits of Protection – Why Employees Place a High Value on Digital Wellness appeared first on McAfee Blog.

Read More

USN-6474-1: xrdp vulnerabilities

Read Time:1 Minute, 43 Second

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,
CVE-2023-42822)

It was discovered that xrdp improperly handled session establishment
errors. An attacker could potentially use this issue to bypass the
OS-level session restrictions by PAM. (CVE-2023-40184)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds writes. An attacker
could possibly use this issue to cause memory corruption or execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds writes. An attacker
could possibly use this issue to cause memory corruption or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-23478)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)

Read More