Don't Clone that Repo
Cybersec Café #8 - 04/12/2024
Good Morning and Happy Friday - Your weekly sip of cybersecurity news from the Cybersec Cafe: Malicious GitHub Repos are lurking in your search results. Apple update’s their spyware system. Your smart TV may be an attack vector.
Apple's Spyware Alert System Gets a Major Update
Guess what - Apple just updated its spyware threat notification system to let users know when they might be individually targeted by sneaky attacks. They're calling out companies like NSO Group for making tools like Pegasus, used by state actors to target folks like journalists and activists. This means Apple's keeping an eye out for you and sending alerts to folks in 92 countries if they think they're being targeted by state-sponsored attackers. It's all part of the ongoing battle against commercial spyware misuse, with governments around the world teaming up to fight against invasive surveillance tech. Plus, Google's sounding the alarm about a rise in zero-day vulnerabilities linked to commercial surveillance vendors, showing just how important it is to stay vigilant against these digital threats.
Malicious Repositories Lurking on GitHub
Cybercriminals are using GitHub's search feature to spread malware through fake repositories disguised as popular projects. By manipulating search rankings, they are able to bring malicious repositories to the top to trick users into downloading malicious code, posing a significant threat to the open-source community. Stay cautious and verify repository authenticity to avoid falling victim to these sneaky attacks.
LG Smart TVs at Risk!
LG smart TV owners, did you know your devices might be vulnerable to security risks? Some versions of webOS (from 4.9.7 to 7.3.1) have flaws that let attackers bypass PINs, elevate privileges, and gain root access—yikes! It's super important to update your TV's software ASAP to stay protected. With over 91,000 exposed devices out there, this issue could affect a lot of people. Make sure to stay on top of security updates to keep your devices and data safe.
Microsoft Issues Record Security Updates
Microsoft just dropped a whopping 149 security updates in April 2024, tackling some serious vulnerabilities. Two of these bugs are already being exploited in the wild, putting users at risk, tracked as CVE-2024-26234 and CVE-2024-29988. It's important to update your systems safe from cyber nasties. And it's not just Microsoft—lots of other software got patched too - inclduing Adobe, GitLab, Google Chrome, Jenkins, Mozilla Firefox, Splunk, VMWare, WordPress, Zoom, and more! Make sure you stay up to date.
Watch Out for Fake Adobe Acrobat Reader Installers Spreading Byakugan Malware
Heads up! Scammers are using sneaky PDF files to spread a new malware called Byakugan, pretending it's Adobe Acrobat Reader. Remember to be careful when downloading software from unknown sources to avoid malicious software and getting your data stolen. Stay sharp and keep your security software updated. And if you come across any sketchy stuff, report it to the community to help protect others from getting tricked.
Securely Yours,
The Cybersec Cafe
Just a heads up, The Cybersec Cafe's got a pretty cool weekly cadence.
Every week, expect to dive into the hacker’s mindset in our Methodology Walkthroughs or explore Deep Dive articles on various cybersecurity topics.
. . .
Oh, and if you want even more content and updates, hop over to Ryan G. Cox on Twitter/X or my Website. Can't wait to keep sharing and learning together!