Blog
Cybersecurity Industry News Review: February 7, 2023
By Joe Fay
Derivatives traders, trainer trainers, and finger lickers all hit by ransomware. Russian hackers lash out after Ukraine tanks deal announced. Apple patches decade old devices.
ION Markets Hit by “Cyber Security Event”
Dublin-based data and software firm ION Markets has been hit by a “cyber event” which has had a knock-on effect on financial futures and derivatives markets worldwide. The attack is thought to have been ransomware related. ION Markets said the attack on its ION Cleared Derivatives division was “contained to a specific environment”, all the affected servers are disconnected, and remediation of services is ongoing. Traders were left having to complete business manually.
https://iongroup.com/press-release/markets/cleared-derivatives-cyber-event/
Hackers target trainers, fast food giants
Sportswear retailer JD Sports said a “security incident” had affected historic orders at its JD, Size?, Millets, Blacks, Scotts and MilletSports brands. Details of around 10 million customers may have been affected. Meanwhile, KFC owner Yum! Brands is recovering from a ransomware attack that led to 300 of its UK restaurants being shuttered for a day. The restaurant group, which also owns Pizza Hut and Taco Bell, confirmed data was taken from its network but said there was no evidence that customer databases were stolen.
https://otp.tools.investis.com/clients/uk/jdplc1/rns/regulatory-story.aspx?newsid=1664679&cid=222
Russian hackers blast back after Western tanks deal
The war in Ukraine continues to spill out into cyberspace. It has emerged that Ukraine’s Computer Emergency Response Team discovered five different data wipers had been used in an attack on the country’s official news agency. Meanwhile, Western agreements to supply tanks to Ukraine are likely to have provoked another wave of Russian attacks on the country’s allies . Canada’s Communications Security Establishment said it was aware of “Russian state-aligned hacktivist groups” targeting Ukraine’s allies and called for heightened vigilance.
https://www.infosecurity-magazine.com/news/five-data-wipers-attack-ukrainian/
Microsoft Defender to put Linux devices into isolation
Microsoft has had a volatile relationship with Linux over the years. However, it is giving the open source operating system equal billing in one sense. Microsoft has launched a public preview of device isolation in Microsoft Defender for Endpoint for Linux. This disconnects the compromised device from the network but retains connectivity to Defender for Endpoint. This can be done through the Microsoft 365 Defender Portal or using an API.
Apple runs up patches for aging, fraying devices
Apple released an iOS update to fix a flaw that left aging iPhones and iPads exposed. iOS 12.5.7 addresses CVE-2022-42856, a type confusion flaw uncovered by Clément Lecigne of Google’s Threat Analysis Group, and which affected devices include iPhone 5s, 6 and 6 Plus, along with the iPad Air, mini 2, mini 3 and iPod touch (6th generation). This means devices up to 11 years old are being patched. While tech professionals aren’t necessarily using such devices anymore, plenty of their family members could be.
https://support.apple.com/en-gb/HT213597
EU could extend patching requirements for IoT kit
The EU’s Cyber Resiliency Act is continuing to work its way through the Union’s legislative machine. Euroactiv reports that a new compromise text was due to be discussed which included proposals that could extend the period over which vendors should provide security patches for IoT products. The original draft proposed a maximum of five years. The new text also proposes changes to how manufacturers should report vulnerabilities, shifting initial responsibility from ENISA to the national CSIRTs.
