State of (in)security - Week 36, 2024
Take action: It's terrifying that in 2024 a piece of software has hardcoded admin credentials. Never ever hardcode or default credentials - it's going to be the worst kept secret of your product in no time. Logging cookies or passwords in the application or debug log is a common mistake, and a terrible one - it exposes all credentials for exploit by at least disgruntled employees, and if the logs can leak - anyone.
Learn More
In the week between Sept. 2, 2024, midnight and Sept. 9, 2024, midnight we witnessed a total of:
- 13 advisory/vulnerability events
- 19 incident/data breach events
Week over Week comparison of week 36 2024 vs week 35 2024:
- Advisories have increased, incidents have decreased. Advisories are up from 11 in week 35 to 13 in week 36. Incidents are down from 27 in week 35 to 19 in week 36.
- The number of known impacted individuals has again increased massively - From 174 million in week 35 to over 393 million in week 36.
We also shared 3 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 393,366,448 impacted individuals across 7 incidents, with the largest breach being the Hacker leaks data of 390 million, claims to be scrape fo russian social network "VK" incident exposing 390,425,719 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Cause breakdown of incidents
| Cause | Number of incidents |
|---|---|
| Malware, Ransomware and Related Attacks | 5 |
| Third Party Compromise | 2 |
| System Misconfiguration Exploits | 1 |
| Unauthorized access | 1 |
| None | 1 |
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| Healthcare | 3 |
| Transport/Logistics | 3 |
| Non-profit/Charity | 3 |
| Finance | 3 |
| Government | 2 |
| IT/Software/Technology | 2 |
| Education | 1 |
| Entertainment/Leisure | 1 |
| Consulting/Professional Services | 1 |
Read the Event Details of the Week
Knowledge
- active attack | CISA reports active exploitation of two high-severity DrayTek VigorConnect flaws
- active attack | GeoServer flaw actively targeted by hackers, patch now
- active exploit | SonicWall critical flaw actively exploited, patch now
Vulnerabilities
- critical vulnerability | Apache fixes another remote code execution flaw in OFBiz Software
- critical vulnerability | Baxter reports two critical vulnerabilities in Connex Health Portal
- critical vulnerability | CISA reports multiple flaws, including critical in LOYTEC Electronics LINX Series devices
- critical vulnerability | Cisco reports critical flaws in Smart Licensing Utility
- critical vulnerability | D-Link reporting critical flaws in DIR-846W router, won't be fixed
- critical vulnerability | Google releases Chrome 128 fixing eight high severity flaws
- critical vulnerability | Google releases September 2024 patches, at least one exploited flaw
- critical vulnerability | LiteSpeed Cache bug leaks cookies through debug log, exposing WordPress sites account takeover attacks
- critical vulnerability | Progress LoadMaster critical vulnerability allows hackers to execute arbitrary code
- critical vulnerability | Researchers report unfixable flaw in older YubiKeys enabling cloning, but exploit is very difficult
- critical vulnerability | Veeam patches 18 Flaws, 5 critical in its products
- critical vulnerability | VMware fixes high-severity code execution flaw in VMware Fusion
- critical vulnerability | Zyxel releases patch multiple flaws, one citical enabling RCE
Incidents
- data breach | WS Audiology hit by ransomware attack, patient data breached
- data breach | Ally Bank reports data breach
- data breach | Dr. Daniel J. Leeman reports data breach affecting patient information
- data breach | Transport for London reports ongoing cyberattack
- data breach | Wisconsin medical institutions report impact on Medicare users from a MOVEit related breach
- data breach | Free Russia Foundation internal documents leaked, investigating cyberattack
- data breach | Metro Pacific Tollways Corporation reports data breach of Easytrip platform
- data breach | Irish Fota Wildlife Park reports data breach, asks customers to cancel cards
- data breach | Tracelo, smartphone geolocation tracking breached, data of 1.4 million users leaked
- data breach | Hacker leaks data of 390 million, claims to be scrape fo russian social network "VK"
- data breach | Avis car rental reports data breach impacting customers
- data breach | Graham Emmanuel Baptist Church reports data breach
- data breach | Two US banks report data breaches, exposing data of 33k customers
- data breach | Katz Nannis + Solomon accountants report data breach exposing customer information
- ransomware | Albyn Housing Society hit by ransomware
- ransomware | Iranian IT vendor Tosan allegedly paying ransom to resolve cyberattack
- ransomware | Swinburne University of Technology Sarawak Campus hit by ransomware, student data breached
- ransomware | Planned Parenthood clinic in Montana hit by ransomware
- ransomware | Cyberattack disrupts services at Tewkesbury Borough Council near UK GCHQ headquarters
