Kronos HR Management Platform hit by Ransomware

Kronos hit with ransomware, warns of data breach and 'several week' outage

The HR management platform has already informed major customers, like the city government of Cleveland, about the attack.

Krono's software is used by many major corporations and local governments.  Among it's many clients, Tesla, City of Cleveland, hospitals and universities including Clemson, Temple and Winthrop University Hospital.  The clients use Kronos work management software.

The ransomware attack has compromised employee information including names, addresses and social security numbers.

Worst of all is the outage is going to cause many to miss payroll this week.  Not a pleasant thing during the holiday season.

https://www.zdnet.com/article/hr-platform-kronos-brought-down-by-ransomware-attack-ukg-warns-of-data-breach/?ftag=TREc64629f&bhid=%7B%24external_id%7D&mid=%7B%24MESSAGE_ID%7D&cid=%7B%24contact_id%7D&eh=%7B%24CF_emailHash%7D

These researchers wanted to test cloud security. They were shocked by what they found.

Cybersecurity researchers set up a tempting cloud honeypot to examine how cyber attackers work.

Cloud computing has become ubiquitous in business today.  The problem is the same lax password requirements and slack security is being utilized by many of the companies.  Recently cybersecurity experts at Palo Alto Networks set up a honeypot of 320 entry points around the world.  A "honeypot" is similar to a sacrificial lamb and is meant to attract cybercriminals.

The honeypot was designed with weak passwords used default passwords that was shipped from factory, info readily available online.  The honeypot was made up of common remote services, misconfigured to attract malicious actors.

And it wasn't long before cyber criminals discovered the honeypot and looked to exploit it -- some of the sites were compromised in minutes while 80% of the 320 honeypots were compromised within 24 hours. All of them had been compromised within a week. 

"The speed of vulnerability management is usually measured in days or months. The fact that attackers could find and compromise our honeypots in minutes was shocking. This research demonstrates the risk of insecurely exposed services," said Jay Chen, principal cloud security researcher at Palo Alto Networks. 

https://www.zdnet.com/article/these-researchers-wanted-to-test-cloud-security-they-were-shocked-by-what-they-found/

Intel 11th Generation based Workstations by Driving Force

Global Microsoft Outage, Apple Woes, Cybercrime, Nvidia RTX 30 series graphics cards.

Global Microsoft outage brings down Teams, Office 365 and Outlook

Microsoft says a recent update has affected the processing of authentication requests, making cloud-based services inaccessible.

Microsoft Blames Software ‘Code Issue’ For Office 365 Outage

“It’s amazing to me that a change in code could cause a platform as big as Azure to go down,” says a senior executive for one of Microsoft’s top partners, who did not want to be identified. “It sounds like someone wrote some code that was merged into a production environment and it broke authentication. That’s ridiculous. If you can’t get into email or documents for five hours it’s pretty bad.” CRN

The outage affected users between the hours of 5:25 pm EST to 10:25 pm EST.  I did not hear from a single user concerning any issues.  Fortunately for us the outage occurred after normal business hours and from what I read, users who had a session established were okay.  It was only those who tried to log in during that period of time who were affected.

Microsoft attributed the Azure service outage to a “recent configuration change impacted a backend storage layer, which caused latency to authentication requests.” CRN.

https://www.crn.com/news/cloud/microsoft-blames-software-code-issue-for-office-365-outage

https://www.theguardian.com/technology/2020/sep/29/major-microsoft-outage-brings-down-office-365-outlook-and-teams?ref=hvper.com

https://www.bing.com/news/search?q=Office+365+Outage&qpvt=office+365+outage&FORM=NWRFSH

Apple News

Who'd have thought... Apple makes mistakes too.  Read the link below, 

iOS 14.0.1: The battery and connectivity woes continue

iOS 14.0.1 fixes some things. Breaks other things.

The bottom line is that we're into that messy period at the beginning of an iOS launch where there will be a lot of bugs and fixes and new bugs. I suspect iOS 14.0.2 is not that far away, and that it won't be long until iOS 14.1 is released, likely to be the iOS version that ships on the new iPhones.

https://www.zdnet.com/article/ios-14-0-1-the-battery-and-connectivity-woes-continue/?ftag=TRE-03-10aaa6b&bhid=2219791&mid=13076371&cid=716603217

iPhone 12 64GB model incoming, says leaker, shipments start next week

A new report from serial Apple leaker Jon Prosser states the iPhone 12 will be getting a 64GB storage option, despite previous reports Apple was ditching the configuration.

https://www.imore.com/iphone-12-64gb-model-confirmed-shipments-start-next-week

Cyber Crime

Cyberattack hobbles major hospital chain's US facilities, staff forced to use paper records

https://www.foxbusiness.com/healthcare/cyberattack-hobbles-major-hospital-chains-us-facilities-staff-forced-to-use-paper-records

A computer outage at a major hospital chain thrust healthcare facilities across the U.S. into chaos Monday, with treatment impeded as doctors and nurses already burdened by the coronavirus pandemic were forced to rely on paper backup systems.

Universal Health Services Inc., which operates more than 250 hospitals and other clinical facilities in the U.S., blamed the outage on an unspecified IT “security issue” in a statement posted to its website Monday but provided no details about the incident, such as how many facilities were affected and whether patients had to be diverted to other hospitals.

Google removes 17 Android apps caught engaging in WAP billing fraud

The 17 apps were infected with the Joker (Bread) malware, which Google described in January 2020 as one of the most persistent threats it dealt with since 2017.

https://www.zdnet.com/article/google-removes-17-android-apps-doing-wap-billing-fraud-from-the-play-store/

The FBI's most wanted cybercriminals

https://www.zdnet.com/pictures/the-fbis-most-wanted-cyber-criminals/

NVIDIA GeForce RTX 30 Series Graphics Cards

Nvidia announced their new RTX 30 graphic cards on September 17th.  The GeForce RTX 3090 was released September 24th.  I was at the Marietta Micro Center store on the 23rd of September and saw this scene that I had to take a picture of;

I first thought it was the line to get in due to the Pandemic, (there usually is a line on weekends due to restrictions on the number of people allowed in at one time), but then I saw people going into the store bypassing the line.

Once inside I asked the lady what was going on, she replied "they are camping and waiting for the release of the Nvidia graphics card tomorrow."  WOW, not only are these people going to fork over $1500 for a video card but they can afford a whole day of their life devoted to this purpose, and they don't need to work, they have the money.  SMDH.

Read more about the new Nvidia cards and while at it, be sure to buy a DForce Gaming computer.

Thanks for reading!

https://www.nvidia.com/en-us/geforce/news/introducing-rtx-30-series-graphics-cards/

DFORCE Gaming Rigs, Ultra-fast performance, Powerful and expandable!