[Security News] Authorities investigating massive security breach at Global Affairs Canada

January 2024

 

1. Authorities investigating massive security breach at Global Affairs Canada

Canadian authorities are investigating a prolonged data security breach following the “detection of malicious cyber activity” affecting the internal network used by Global Affairs Canada staff. The breach affected at least two internal drives, as well as emails, calendars and contacts of many staff members and working remotely was stopped as of last Wednesday. It’s not clear whether secret information was lost in the breach, which lasted longer than a month. It’s also not clear who was behind the breach.

Sources: CBC, Global News, CTV

 

2. 45k Jenkins servers exposed to RCE attacks using public exploits

Researchers found roughly 45,000 Jenkins instances exposed online that are vulnerable to CVE-2023-23897. On January 24, 2024, project released versions 2.442 and LTS 2.426.3 to fix CVE-2023-23897, an arbitrary file read problem that can lead to executing arbitrary command-line interface (CLI) commands. But the issue arises from CLI’s feature that automatically replaces an @ character followed by a file path with the contents of the file.

Sources: Bleeping Computer, The Hacker News, The Register

 

3. Vans, Supreme, North Face Parent Hacked: Data of 35 Million Customer Exposed

VF, a globally renowned  parent company of iconic fashion brands such as Vans, Supreme, and The North Face, announced a compromise of personal data belonging to approximately 35.5 million customers. This incident occurred last December and it raises concerns about the security of customer information for the fashion giant. The ransomware group ALPHV (also known as Black Cat ransomware) claimed responsibility for this incident.

Sources: The Cyber Express, Security Week, CNBC

 

Check out Penta Security’s product lines:

Web Application Firewall: WAPPLES

Database Encryption: D’Amo

Identity and Access Management: iSIGN+ 

Car, Energy, Factory, City Solutions: Penta IoT Security

Click here for inquiries regarding the partner system of Penta Security

Check out the product lines of  Cloudbric by Penta Security:

Cloud-based Fully Managed WAAP: Cloudbric WAF+

Agent based Zero Trust Network Access Solution: Cloudbric PAS

Agentless Zero Trust Network Access Solution: Cloudbric RAS

Blockchain: Blockchain Security Solution

Click here for inquiries regarding the partner system of Cloudbric